Deployment authentication configuration

Google, GitHub, WeChat, email login, SMTP, and SMS apply to the entire AskTable instance and are read only from environment variables. Restart Web and Worker after making changes; System settings no longer provides these authentication settings.

Deployment mode and Region

AT_REGION defaults to cn and can also be set to global. Private deployment (AT_DEPLOY_MODE=local) always uses email as the account identifier, regardless of Region. Domestic Cloud uses phone numbers; overseas Cloud uses email. Keep Region fixed after deployment; plan an identity data migration before changing it.

When using Docker Compose, merge the configuration below into the existing asktable.environment. After changing environment variables, run docker compose up -d asktable to recreate the container with the new configuration. Simply restarting the container does not read changes to Compose environment variables. If Web and Worker run separately, update and restart both.

OAuth providers

Each ID and Secret pair must be set together. Leaving the entire pair empty disables the provider; setting only one causes application startup to fail with an incomplete-configuration error.

services:
  asktable:
    environment:
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
      WECHAT_APP_ID: ${WECHAT_APP_ID:-}
      WECHAT_APP_SECRET: ${WECHAT_APP_SECRET:-}
      SMS_API_URL: ${SMS_API_URL:-}
      SMS_API_KEY: ${SMS_API_KEY:-}

GET /system/info returns only enabled status and non-sensitive Client IDs. It does not return Secrets or any organization-level WeCom/WPS/Feishu/DingTalk configuration.

Domestic cloud

The unified production login page for Cloud + CN offers only WeChat; organization-specific WeCom/WPS/Feishu/DingTalk login URLs remain available. Successful WeChat, WeCom, WPS, Feishu, or DingTalk authentication first establishes a normal session. If a phone number is missing, the unified setup page requires verification before entering the product workspace. Startup requires WECHAT_APP_ID, WECHAT_APP_SECRET, SMS_API_URL, and SMS_API_KEY together; a missing value causes the process to report an explicit error and stop.

Email login and SMTP

services:
  asktable:
    environment:
      EMAIL_LOGIN_ENABLED: "true"
      EMAIL_SMTP_PROVIDER: aliyun # aliyun | custom
      EMAIL_SMTP_HOST: ""         # Required for custom
      EMAIL_SMTP_PORT: "465"
      EMAIL_SMTP_USERNAME: ""
      EMAIL_SMTP_PASSWORD: ${EMAIL_SMTP_PASSWORD:-}
      EMAIL_SMTP_USE_SSL: "true"
      EMAIL_SENDER_ADDRESS: noreply@example.com

aliyun uses the fixed Alibaba Cloud Direct Mail host and SSL port, with the sender address also used as the username. custom uses the supplied Host, Port, and SSL options; an empty Username falls back to the sender address. Tasks that depend on email delivery skip sending when SMTP configuration is incomplete.

Organization Owners/Admins should connect WeCom, WPS, Feishu, and DingTalk through login integrations; see Enterprise integration login. See Migration for upgrade requirements from older versions.