feat: add users and authentication support by mudler · Pull Request #9061 · mudler/LocalAI

mudler · 2026-03-18T19:01:04Z

Description

This PR adds an (optional) authentication system for LocalAI.

support still API_KEY only, or no-auth (still default as before)
Add support for light SQLite login with no third-party
Support PostgreSQL
Support for Github as auth provider, and OIDC to plug in any other auth mechanism
Fine grained user permissions (set models/features)
Users can create their API keys autonomously (which are mapped to their permissions)

Besides, it defines admin and user roles, and allows to set fine-grained permissions on the users enabling/disabling specific features, e.g. Agents, Skills, etc.

From this PR, also Skills, Agents, Knowledge bases are specific per-user instead of being global. Each user has its own resources and admins can manage the resources for the whole application.

Important: there is no performance penalty with auth disabled. The middlewares are not registered and there are no additional computational costs, however, when auth is enabled endpoints will check for authentication which could slow operations - suggestion is for production to use PostgreSQL.

Usage metrics

API keys for users

Account settings

Admin view - Users

Admin view - invites

Admin view - user permissions

Notes for Reviewers

This pull request introduces a comprehensive authentication and authorization system to the application, enabling user management, OAuth integration, and per-feature access control. It adds support for configuring authentication via environment variables and CLI flags, initializes and manages the authentication database, and integrates new middleware for route protection. Additionally, it provides API key management functionality and updates various parts of the application to accommodate these new features.

Authentication & Authorization Integration:

Added AuthConfig to ApplicationConfig and extended CLI options to support enabling authentication, specifying database URL, OAuth (GitHub/OIDC) credentials, admin email, and registration mode. [1] [2] [3]
Application startup now initializes the authentication database when enabled, starts session cleanup routines, and wires user-scoped services for per-user isolation. [1] [2] [3]

Middleware & Route Protection:

Replaced legacy key-auth middleware with new unified authentication middleware, applying it to all endpoints and integrating per-feature and per-model access control. Admin-only routes are now protected by dedicated middleware. [1] [2] [3] [4]
Updated exempt paths to include authentication and asset routes, ensuring correct bypass behavior for unauthenticated endpoints.

API Key Management:

Introduced core/http/auth/apikeys.go for secure API key generation, validation, listing, and revocation, supporting per-user and per-role API keys.

Build & Environment Configuration:

Updated Dockerfile to include auth in GO_TAGS for builds, ensuring authentication code is included when building the application.

These changes collectively enable robust authentication, OAuth integration, API key management, and granular access control throughout the application.

netlify · 2026-03-18T19:01:10Z

✅ Deploy Preview for localai ready!

Name	Link
🔨 Latest commit	`92c14f5`
🔍 Latest deploy log	https://app.netlify.com/projects/localai/deploys/69bc3831845ebf00083a91e2
😎 Deploy Preview	https://deploy-preview-9061--localai.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

richiejp · 2026-03-19T08:52:24Z

core/http/react-ui/src/components/UserGroupSection.jsx

+        .ugs-user-count {
+          font-size: 0.75rem;
+          color: var(--color-text-muted);
+        }


This is a very large inline style with a lot of hardcoded sizes and dimensions. My recommendation is to cross-reference this with all of the other CSS and look for a way to unify the styles to avoid exceeding context limits.

richiejp · 2026-03-19T08:55:53Z

core/http/react-ui/src/pages/Users.jsx

+        fontSize: '0.75rem',
+        fontWeight: 600,
+        background: 'var(--color-success, #22c55e)22',
+        color: 'var(--color-success, #22c55e)',


we have vars, but with what looks like a fallback. Need to check these vars exist (I think they do).

richiejp · 2026-03-19T08:58:44Z

core/http/react-ui/src/pages/Users.jsx

+                  <td style={{ fontSize: '0.8125rem' }}>
+                    {inv.createdBy?.name || inv.createdBy?.id || '-'}
+                  </td>
+                  <td style={{ fontSize: '0.8125rem' }}>


More inline styles with no vars, are we using TailwindCSS still? Can we unify all these styles across the code base to avoid divergence? May need to add/update CLAUDE.md and AGENTS.md with rules for styling to avoid divergence across the UI

richiejp · 2026-03-19T09:03:13Z

core/http/auth/db_sqlite.go

+package auth
+
+import (
+	"gorm.io/driver/sqlite"


Is this the purego version? We are not relying on CGO are we?

this is the CGO version, when I was looking for a sqlite non-cgo I found only https://github.com/glebarez/sqlite which appears to be unmaintained, so I opted in for basing it on the maintained upstream version instead

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

… is configured Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

* feat(ui): add users and authentication support Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat: allow the admin user to impersonificate users Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore: ui improvements, disable 'Users' button in navbar when no auth is configured Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat: add OIDC support Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix: gate models Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore: cache requests to optimize speed Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * small UI enhancements Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore(ui): style improvements Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix: cover other paths by auth Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore: separate local auth, refactor Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * security hardening, approval mode Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix: fix tests and expectations Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore: update localagi/localrecall Signed-off-by: Ettore Di Giacinto <mudler@localai.io> --------- Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Signed-off-by: localai-bot <bot@localai.com>

* feat(ui): add users and authentication support Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat: allow the admin user to impersonificate users Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore: ui improvements, disable 'Users' button in navbar when no auth is configured Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * feat: add OIDC support Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix: gate models Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore: cache requests to optimize speed Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * small UI enhancements Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore(ui): style improvements Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix: cover other paths by auth Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore: separate local auth, refactor Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * security hardening, approval mode Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * fix: fix tests and expectations Signed-off-by: Ettore Di Giacinto <mudler@localai.io> * chore: update localagi/localrecall Signed-off-by: Ettore Di Giacinto <mudler@localai.io> --------- Signed-off-by: Ettore Di Giacinto <mudler@localai.io> Signed-off-by: localai-bot <bot@localai.com> Signed-off-by: localai-bot <localai-bot@localai.io>

* feat(ui): add users and authentication support * feat: allow the admin user to impersonificate users * chore: ui improvements, disable 'Users' button in navbar when no auth is configured * feat: add OIDC support * fix: gate models * chore: cache requests to optimize speed * small UI enhancements * chore(ui): style improvements * fix: cover other paths by auth * chore: separate local auth, refactor * security hardening, approval mode * fix: fix tests and expectations * chore: update localagi/localrecall --------- Signed-off-by: localai-bot <localai-bot@localai.io>

mudler force-pushed the feat/auth branch 5 times, most recently from c621129 to 5d49724 Compare March 18, 2026 21:49

richiejp reviewed Mar 19, 2026

View reviewed changes

mudler force-pushed the feat/auth branch from 742d0bf to 09bc0f4 Compare March 19, 2026 17:14

mudler added 11 commits March 19, 2026 17:37

feat(ui): add users and authentication support

cebfd83

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

feat: allow the admin user to impersonificate users

d12defc

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

chore: ui improvements, disable 'Users' button in navbar when no auth…

4e8339a

… is configured Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

feat: add OIDC support

ed4be6f

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

fix: gate models

98ea1b5

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

chore: cache requests to optimize speed

6b87c8f

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

small UI enhancements

3697e5a

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

chore(ui): style improvements

b7f28e4

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

fix: cover other paths by auth

b5a195b

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

chore: separate local auth, refactor

229702b

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

security hardening, approval mode

020fddf

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

mudler force-pushed the feat/auth branch from 0647152 to d152a56 Compare March 19, 2026 17:37

fix: fix tests and expectations

b1658ee

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

mudler force-pushed the feat/auth branch from d152a56 to b1658ee Compare March 19, 2026 17:52

chore: update localagi/localrecall

92c14f5

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

mudler merged commit aea2195 into master Mar 19, 2026
37 checks passed

mudler deleted the feat/auth branch March 19, 2026 20:40

mudler added the enhancement New feature or request label Mar 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add users and authentication support#9061

feat: add users and authentication support#9061
mudler merged 13 commits intomasterfrom
feat/auth

mudler commented Mar 18, 2026 •

edited

Loading

Uh oh!

netlify bot commented Mar 18, 2026 •

edited

Loading

Uh oh!

richiejp Mar 19, 2026

Uh oh!

richiejp Mar 19, 2026

Uh oh!

richiejp Mar 19, 2026

Uh oh!

richiejp Mar 19, 2026

Uh oh!

mudler Mar 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mudler commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Usage metrics

API keys for users

Account settings

Admin view - Users

Admin view - invites

Admin view - user permissions

Uh oh!

netlify bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for localai ready!

Uh oh!

richiejp Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

richiejp Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

richiejp Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

richiejp Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

mudler Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mudler commented Mar 18, 2026 •

edited

Loading

netlify bot commented Mar 18, 2026 •

edited

Loading