Authup

Appearance

Configuration ​

The UI is distributed as a prebuilt Nuxt/Nitro server bundle (npm package and docker image alike). That distinction matters for environment variables:

  • Plain names like API_URL, PUBLIC_URL or COOKIE_DOMAIN are read at build time only — they are compiled into the bundle when building the app from source and have no effect on the published bundle.
  • At runtime, the prebuilt bundle honors Nuxt's runtime-config names (NUXT_PUBLIC_*) plus Nitro's server binding variables.

Runtime environment variables ​

dotenv
# The application port (NITRO_PORT also works).
PORT=3000
# The bind address (NITRO_HOST also works).
HOST=0.0.0.0
# The address where the API can be reached.
NUXT_PUBLIC_API_URL=http://localhost:3001
# The public url of the user interface.
NUXT_PUBLIC_PUBLIC_URL=http://localhost:3000
# Optional: widen the session cookie domain (e.g. .example.com).
NUXT_PUBLIC_COOKIE_DOMAIN=
# The OAuth2 client the console authenticates against. Defaults to the
# per-realm built-in admin-console client; override only for a fork that
# registers its own client.
NUXT_PUBLIC_CLIENT_ID=admin-console

If NUXT_PUBLIC_API_URL is not set, the UI falls back to http://localhost:3001 (the API's default address).

Cookie domain

Do not point NUXT_PUBLIC_COOKIE_DOMAIN at a domain shared with the API's hosted auth pages (the /authorize login/consent UI): both surfaces use identical session cookie names, so a shared cookie domain has them overwriting each other's session state. Leave the cookie host-scoped unless you share it between your own applications only.

Configuration file (via the authup CLI) ​

When the UI is launched through the authup quickstart CLI instead of directly, it can also be configured through the shared multi-section configuration file — the CLI reads the client.admin-console section and passes the values to the UI process as the appropriate runtime environment variables:

dotenv
client.admin-console.port=3000
client.admin-console.host=0.0.0.0
client.admin-console.apiUrl=http://localhost:3001
client.admin-console.publicUrl=http://localhost:3000
dotenv
port=3000
host=0.0.0.0
apiUrl=http://localhost:3001
publicUrl=http://localhost:3000

When apiUrl is not set, the CLI derives it from the server.core section's publicUrl, so a single multi-section file keeps both services aligned. Environment variables override file values.

Login redirect allowlist

The login screen redirects through the API's authorization-code flow and back to this UI's origin. In production, that origin must be trusted by the API — add the UI origin (NUXT_PUBLIC_PUBLIC_URL) to the server's TRUSTED_ORIGINS unless it is already the API's PUBLIC_URL origin. In development, http://localhost:3000 is trusted automatically.