Authentication providers

canette supports four login methods: GitHub OAuth, Google OAuth, generic OIDC (SSO), and email/password. All four can be active simultaneously. Social providers are hidden from the login page when not configured.

GitHub OAuthCopy Anchor Link

1. Create an OAuth AppCopy Anchor Link

1. Go to GitHub → Settings → Developer settings → OAuth Apps → New OAuth App
2. Fill in the fields:
   • Application name: e.g. canette
   • Homepage URL: your canette URL, e.g. https://canette.example.com
   • Authorization callback URL: https://canette.example.com/api/auth/callback/github
3. Click Register application
4. Copy the Client ID
5. Click Generate a new client secret and copy the secret

2. Configure HelmCopy Anchor Link

api:
  githubClientId: "<client-id>"
  githubClientSecret: "<client-secret>"

Or reference a pre-existing Kubernetes Secret for the client secret:

api:
  githubClientId: "<client-id>"
  githubClientSecretRef:
    name: my-github-secret
    key: client-secret

Once configured, a Continue with GitHub button appears on the login page.

Google OAuthCopy Anchor Link

1. Create an OAuth 2.0 clientCopy Anchor Link

1. Open the Google Cloud Console and select or create a project
2. Go to APIs & Services → Credentials → Create Credentials → OAuth client ID
3. If prompted, configure the OAuth consent screen first (set User Type to Internal for org-only access, or External to allow any Google account)
4. Choose Application type: Web application
5. Under Authorised redirect URIs, add: https://canette.example.com/api/auth/callback/google (leave Authorised JavaScript origins empty — that is only needed for browser-side OAuth flows)
6. Click Create and copy the Client ID and Client secret

2. Configure HelmCopy Anchor Link

api:
  googleClientId: "<client-id>"
  googleClientSecret: "<client-secret>"

Or reference a pre-existing Kubernetes Secret for the client secret:

api:
  googleClientId: "<client-id>"
  googleClientSecretRef:
    name: my-google-secret
    key: client-secret

Once configured, a Continue with Google button appears on the login page.

Generic OIDC (SSO)Copy Anchor Link

Generic OIDC lets users log in via your organisation's identity provider — Okta, Auth0, Keycloak, Azure AD, or any OIDC-compliant IdP. It is the recommended method for enterprise deployments where user lifecycle (onboarding, offboarding, MFA) is managed centrally.

1. Create an OIDC application in your IdPCopy Anchor Link

The exact steps vary by provider, but the common fields are:

• Application type: Web application (or equivalent)
• Redirect / callback URL: https://canette.example.com/api/auth/callback/oidc
• Scopes: openid, profile, email (canette requests these automatically)

Copy the Client ID, Client secret, and Issuer URL from the application settings.

Common issuer URL formats:

The issuer URL is the base URL as returned in the iss claim of OIDC tokens. canette appends /.well-known/openid-configuration to discover the authorization and token endpoints automatically.

2. Configure HelmCopy Anchor Link

auth:
  oidc:
    clientId: "<client-id>"
    clientSecret: "<client-secret>"
    issuerUrl: "https://your-org.okta.com/oauth2/default"

Or reference a pre-existing Kubernetes Secret for the client secret:

auth:
  oidc:
    clientId: "<client-id>"
    clientSecretRef:
      name: my-oidc-secret
      key: client-secret
    issuerUrl: "https://your-org.okta.com/oauth2/default"

Once configured, a Continue with SSO button with a key icon appears on the login page.

Button labelCopy Anchor Link

The button label defaults to SSO. Set auth.oidc.displayName to match your IdP's name:

auth:
  oidc:
    displayName: "Okta"   # renders as "Continue with Okta"

Enforcement modeCopy Anchor Link

When OIDC is configured, you can optionally disable all other login methods so that users must authenticate via your IdP:

auth:
  oidc:
    enforce: true

When enforcement is on:

• GitHub OAuth, Google OAuth, and magic-link buttons are hidden from the login page
• The /login/email route redirects back to /login
• Email/password, magic-link, and social OAuth providers are not registered in the auth backend — preventing access even via direct API calls

Email loginCopy Anchor Link

Email/password login is always available. Users sign in with their email address and a password that meets the minimum policy (12+ characters, at least one uppercase, lowercase, and digit).

Signup modeCopy Anchor Link

The signup mode controls how new users can register via email. It is configured in the admin UI under Admin → Settings → Signup and takes effect immediately — no restart or Helm upgrade required.

Hard disable via HelmCopy Anchor Link

For deployments where email signup should be permanently locked at the infrastructure level — regardless of what any admin sets in the UI — use the Helm override:

api:
  disableEmailSignup: true

When this is set, the admin UI shows a notice that signup is globally disabled via Helm and the mode selector is locked. This is useful for SSO-only deployments or when you want ops to enforce the policy rather than trusting admin UI access.

Magic link loginCopy Anchor Link

Magic link login lets users sign in without a password by receiving a one-time link via email. It requires an email provider to be configured.

When enabled, a Sign in with magic link button appears below the password form on the email login page. Magic links are for existing users only — they do not create new accounts. Users must first register via email/password, after which they can sign in with either method.

Password resetCopy Anchor Link

A Forgot password? link is always shown on the email sign-in page. What happens when a user clicks it depends on whether an email provider is configured:

• With an email provider — the user enters their email and receives a reset link. The link expires after 1 hour.
• Without an email provider — the page displays a message directing the user to contact an administrator. Admins can reset any user's password from Admin → Users → Reset password, which generates a temporary password shown once.

Configuring ResendCopy Anchor Link

Resend is the first supported email provider and has a generous free tier.

1. Create an account at resend.com and obtain an API key
2. Verify your sending domain in the Resend dashboard
3. Configure canette:

api:
  email:
    provider: resend
    resendApiKey: "<your-resend-api-key>"
    from: "canette <noreply@yourdomain.com>"

Or reference a pre-existing Kubernetes Secret for the API key:

api:
  email:
    provider: resend
    from: "canette <noreply@yourdomain.com>"
    resendApiKeyRef:
      name: my-resend-secret
      key: api-key