Deployment authentication

Google, GitHub, WeChat, email login, SMTP, and SMS belong to the entire AskTable instance and are read only from environment variables. Restart the web and worker processes after changing them. System settings no longer edit these authentication settings.

OAuth providers

Provider	Environment variables
Google	`GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`
GitHub	`GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET`
WeChat	`WECHAT_APP_ID`, `WECHAT_APP_SECRET`

Each ID and secret must be supplied together. Leaving a complete pair empty disables that provider; setting only one value makes startup fail with an incomplete-configuration error.

docker-compose.yaml

services:
  asktable:
    environment:
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
      WECHAT_APP_ID: ${WECHAT_APP_ID:-}
      WECHAT_APP_SECRET: ${WECHAT_APP_SECRET:-}
      SMS_API_URL: ${SMS_API_URL:-}
      SMS_API_KEY: ${SMS_API_KEY:-}

GET /system/info returns only availability and non-sensitive client IDs. It never returns secrets or any organization-scoped WeCom/WPS configuration.

China cloud

Cloud + CN production allows only WeChat login. WeChat, WeCom, and WPS authentication first creates a normal session; users without a phone number must complete verification in the shared setup page before entering the product workspace. WECHAT_APP_ID, WECHAT_APP_SECRET, SMS_API_URL, and SMS_API_KEY are all mandatory at startup; a missing value stops the process with an explicit configuration error. make dev PROFILE=cn enables AT_DEV_MODE=1 without requiring WeChat or an SMS gateway. The production WeChat sign-in layout remains intact, with a Developer login link added below the QR code and agreements. Enter a test username: the same normalized username reuses one simulated account, while different usernames create separate accounts. First login creates a normal session and then uses the production phone-binding page; the random verification code is written only to the server log. Without a WeChat AppID, the original QR slot shows an unconfigured state; with an AppID, the real QR code and developer entry are both available. Shared development and staging environments should set AT_DEV_MODE=0 and provide all four production values.

docker-compose.yaml

services:
  asktable:
    environment:
      EMAIL_LOGIN_ENABLED: "true"
      EMAIL_SMTP_PROVIDER: aliyun # aliyun | custom
      EMAIL_SMTP_HOST: ""         # required for custom
      EMAIL_SMTP_PORT: "465"
      EMAIL_SMTP_USERNAME: ""
      EMAIL_SMTP_PASSWORD: ${EMAIL_SMTP_PASSWORD:-}
      EMAIL_SMTP_USE_SSL: "true"
      EMAIL_SENDER_ADDRESS: noreply@example.com

aliyun uses the fixed Alibaba Cloud Direct Mail host and SSL port, with the sender address as the username. custom uses the supplied host, port, and SSL setting, and falls back to the sender address when Username is empty. Tasks that need email skip delivery when SMTP is incomplete.

If Google, GitHub, and WeChat are all disabled, email login remains available as a fallback even when EMAIL_LOGIN_ENABLED=false, preventing a deployment with no login entry. Organization-scoped WeCom/WPS does not count toward this fallback.

Organization Owners/Admins connect WeCom and WPS from Enterprise integrations; see Enterprise integration login. For legacy configuration migration, see Migration.

​OAuth providers

​China cloud

​Email login and SMTP

OAuth providers

China cloud

Email login and SMTP