Authentication & SSO

Authentication is handled by Better Auth, stored in your MongoDB. Out of the box, Imprime offers:

• Email & password sign-up and sign-in — always enabled;
• Google, Microsoft and GitHub SSO — each enabled when its credentials are set;
• API keys for scripts, and OAuth 2.1 for MCP clients — always enabled.

The login page only shows the providers that are configured.

Caution

Sign-up is open: anyone who can reach your instance can create an account (and only sees their own templates). To restrict access, put the instance behind your VPN, an identity-aware proxy, or IP filtering.

Single sign-on

Every provider asks for a redirect / callback URL. It is always:

<PUBLIC_APP_URL>/api/auth/callback/<provider>

Google

1. In the Google Cloud console, create an OAuth client ID of type Web application.

2. Authorized JavaScript origins: https://imprime.example.com

3. Authorized redirect URIs: https://imprime.example.com/api/auth/callback/google

4. Set the credentials:

   GOOGLE_CLIENT_ID=…apps.googleusercontent.com
   GOOGLE_CLIENT_SECRET=GOCSPX-…

Microsoft

1. In the Microsoft Entra admin center, go to App registrations → New registration.

2. Redirect URI (platform Web): https://imprime.example.com/api/auth/callback/microsoft

3. In Certificates & secrets, create a client secret.

4. Set the credentials. MICROSOFT_TENANT_ID restricts who can sign in: common (any account), organizations (work/school), consumers (personal) or your tenant ID (your organization only).

   MICROSOFT_CLIENT_ID=00000000-0000-0000-0000-000000000000
   MICROSOFT_CLIENT_SECRET=…
   MICROSOFT_TENANT_ID=common

GitHub

1. In GitHub, go to Settings → Developer settings → OAuth Apps → New OAuth App.

2. Homepage URL: https://imprime.example.com

3. Authorization callback URL: https://imprime.example.com/api/auth/callback/github

4. Generate a client secret and set the credentials:

   GITHUB_CLIENT_ID=Iv1.…
   GITHUB_CLIENT_SECRET=…

Restart the app after changing the configuration (docker compose up -d).

Email verification

To make sure users own the email they sign up with:

REQUIRE_EMAIL_VERIFICATION=true
SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_USER=no-reply@example.com
SMTP_PASS=…
SMTP_FROM=Imprime <no-reply@example.com>

A verification link is sent on sign-up; clicking it verifies the address and signs the user in.

MCP OAuth

Nothing to configure: the OAuth 2.1 authorization server for MCP clients is built in. It publishes its metadata at:

<PUBLIC_APP_URL>/.well-known/oauth-authorization-server
<PUBLIC_APP_URL>/.well-known/oauth-protected-resource

Make sure your reverse proxy forwards /.well-known/* to Imprime, and that PUBLIC_APP_URL is the exact public HTTPS origin — clients use it to find the authorization server.