> ## Documentation Index
> Fetch the complete documentation index at: https://docs.postsider.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PostSider authentication and sessions

> Sign-in methods, registration control, and the session model for PostSider.

PostSider supports several sign-in methods. Which ones are offered depends on the deployment and the configured environment variables.

## Sign-in methods

* **Email and password** - standard local accounts. Passwords must be at least 8 characters.
* **Google** - OAuth sign-in/registration, available on Cloud and configurable on self-hosted instances.
* **GitHub** - OAuth sign-in; configure `GITHUB_CLIENT_ID` and `GITHUB_CLIENT_SECRET`.
* **Generic OIDC / SSO** - connect an external identity provider such as Authentik with the `POSTSIDER_GENERIC_OAUTH` and `POSTSIDER_OAUTH_*` variables (self-hosted).
* **Wallet** - sign in with a cryptographic challenge that is valid for 60 seconds and single-use.
* **Farcaster** - sign in via the Neynar Sign In With Neynar (SIWN) widget.

## Registration control

* `DISABLE_REGISTRATION=true` makes the instance invite-only; only invited members can join.
* `REQUIRE_EMAIL_ACTIVATION=true` requires local sign-ups to confirm their email via a one-time activation link before first login.
* After registration, new users land on the [onboarding flow](/get-started/first-run).

## Sessions

Sessions are stateless JWTs signed with `JWT_SECRET`, stored in an `httpOnly` secure cookie. The session token is valid for 7 days while the cookie persists for 14 days, so a browser may need to re-authenticate before the cookie expires. Logging out clears the cookie. There is no server-side session revocation or login-history list; the middleware re-resolves the user from the database on every request.

## API credentials

The public API accepts organization **API keys** (`ps_...` self-service keys or a legacy organization key) or **`pos_...` OAuth tokens** in the `Authorization` header, without a `Bearer` prefix. See [Agent authentication](/agent/authentication) for API keys and [OAuth apps](/security/oauth-apps) for tokens.