Skip to main content
PostSider supports several sign-in methods. Which ones are offered depends on the deployment and the configured environment variables.

​
Sign-in methods

  • Email and password - standard local accounts. Passwords must be at least 8 characters.
  • Google - OAuth sign-in/registration, available on Cloud and configurable on self-hosted instances.
  • GitHub - OAuth sign-in; configure GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET.
  • Generic OIDC / SSO - connect an external identity provider such as Authentik with the POSTSIDER_GENERIC_OAUTH and POSTSIDER_OAUTH_* variables (self-hosted).
  • Wallet - sign in with a cryptographic challenge that is valid for 60 seconds and single-use.
  • Farcaster - sign in via the Neynar Sign In With Neynar (SIWN) widget.

​
Registration control

  • DISABLE_REGISTRATION=true makes the instance invite-only; only invited members can join.
  • REQUIRE_EMAIL_ACTIVATION=true requires local sign-ups to confirm their email via a one-time activation link before first login.
  • After registration, new users land on the onboarding flow.

​
Sessions

Sessions are stateless JWTs signed with JWT_SECRET, stored in an httpOnly secure cookie. The session token is valid for 7 days while the cookie persists for 14 days, so a browser may need to re-authenticate before the cookie expires. Logging out clears the cookie. There is no server-side session revocation or login-history list; the middleware re-resolves the user from the database on every request.

​
API credentials

The public API accepts organization API keys (ps_... self-service keys or a legacy organization key) or pos_... OAuth tokens in the Authorization header, without a Bearer prefix. See Agent authentication for API keys and OAuth apps for tokens.