Authentication

Releval supports email/password authentication by default, with optional OAuth providers for single sign-on.

Registration

Variable	Default	Description
Registration__Enabled	false	Whether self-registration is allowed. When disabled, new members must be added through admin invitations.
Registration__AllowedDomain	(none)	Restrict registration to a specific email domain

Restricting registration

When self-registration is enabled, you can limit it to a single email domain so only people from your organization can register:

Environment Variable

environment:
  - Registration__Enabled=true
  - Registration__AllowedDomain=example.com

appsettings.json

{
  "Registration": {
    "Enabled": true,
    "AllowedDomain": "example.com"
  }
}

This only allows email addresses ending in @example.com to register. People outside this domain can still be added via admin invitation.

To disable self-registration entirely and require admin invitations:

Environment Variable

environment:
  - Registration__Enabled=false

appsettings.json

{
  "Registration": {
    "Enabled": false
  }
}

OAuth providers

Releval supports Google and GitHub as external authentication providers. When configured, members see additional login options on the sign-in page.

Google

Variable	Description
Authentication__Google__ClientId	Google OAuth 2.0 client ID
Authentication__Google__ClientSecret	Google OAuth 2.0 client secret

To set up Google authentication:

1. Create a project in the Google Cloud Console
2. Navigate to APIs & Services > Credentials
3. Create an OAuth 2.0 Client ID (Web application type)
4. Add https://${RELEVAL_HOST}/api/auth/login-google as an authorized redirect URI
5. Set the client ID and secret:

Environment Variable

environment:
  - Authentication__Google__ClientId=your-client-id.apps.googleusercontent.com
  - Authentication__Google__ClientSecret=your-client-secret

appsettings.json

{
  "Authentication": {
    "Google": {
      "ClientId": "your-client-id.apps.googleusercontent.com",
      "ClientSecret": "your-client-secret"
    }
  }
}

GitHub

Variable	Description
Authentication__GitHub__ClientId	GitHub OAuth App client ID
Authentication__GitHub__ClientSecret	GitHub OAuth App client secret

To set up GitHub authentication:

1. Go to Settings > Developer Settings > OAuth Apps in GitHub
2. Create a new OAuth App
3. Set the Authorization callback URL to https://${RELEVAL_HOST}/api/auth/login-github
4. Set the client ID and secret:

Environment Variable

environment:
  - Authentication__GitHub__ClientId=your-client-id
  - Authentication__GitHub__ClientSecret=your-client-secret

appsettings.json

{
  "Authentication": {
    "GitHub": {
      "ClientId": "your-client-id",
      "ClientSecret": "your-client-secret"
    }
  }
}

JWT settings

JWT tokens are used for App Client authentication via the OAuth 2.0 client credentials flow.

Variable	Default	Description
JwtSettings__Issuer	(required)	Token issuer, e.g. https://${RELEVAL_HOST}
JwtSettings__Audience	(required)	Token audience, e.g. https://${RELEVAL_HOST}
JwtSettings__ExpireTimeSpan	01:00:00	Token lifetime (1 hour)
JwtSettings__Certificate__Path	(none)	Path to a PFX/PKCS#12 file containing a certificate used to sign tokens
JwtSettings__Certificate__Password	(none)	Password for the PFX/PKCS#12 file, if protected
JwtSettings__Certificate__Thumbprint	(none)	Thumbprint of a certificate to load from the machine store (alternative to Path)

Tokens are signed with an asymmetric key. The certificate's key type selects the algorithm:

• an ECDSA certificate signs with ES256/ES384/ES512 (by curve)
• an RSA certificate with RS256 — and the public key is published

at /.well-known/jwks.json so clients can verify tokens.

Info

If no certificate is configured, Releval generates a signing key and persists it in the Data Protection keys directory (/app/keys by default), so it survives restarts and is shared across replicas. This is fine for most self-hosted deployments as long as that directory is on a durable volume. If the keys directory is not persisted, the key is regenerated on every start and all previously issued App Client tokens stop validating. Configure a certificate, or persist the keys directory, for any restart-surviving or multi-instance deployment.

Encryption at rest

Releval encrypts sensitive data at rest (such as endpoint authentication credentials) using the ASP.NET Core Data Protection key ring. There is no separate encryption key to configure.

Info

Persist the Data Protection keys directory (/app/keys by default) on a durable volume. If the key ring is lost — for example when the container falls back to ephemeral in-memory keys — previously encrypted values can no longer be decrypted. See Data Protection.

Password policy

Releval enforces the following password requirements:

• Minimum 8 characters
• At least one uppercase letter
• At least one lowercase letter
• At least one digit
• At least one non-alphanumeric character