> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asktable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment authentication

> Configure Google, GitHub, WeChat, email login, SMTP, and SMS through static environment variables.

Google, GitHub, WeChat, email login, SMTP, and SMS belong to the entire AskTable instance and are read only from environment variables. Restart the web and worker processes after changing them. System settings no longer edit these authentication settings.

## OAuth providers

| Provider | Environment variables                      |
| -------- | ------------------------------------------ |
| Google   | `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET` |
| GitHub   | `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET` |
| WeChat   | `WECHAT_APP_ID`, `WECHAT_APP_SECRET`       |

Each ID and secret must be supplied together. Leaving a complete pair empty disables that provider; setting only one value makes startup fail with an incomplete-configuration error.

```yaml docker-compose.yaml theme={null}
services:
  asktable:
    environment:
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
      WECHAT_APP_ID: ${WECHAT_APP_ID:-}
      WECHAT_APP_SECRET: ${WECHAT_APP_SECRET:-}
      SMS_API_URL: ${SMS_API_URL:-}
      SMS_API_KEY: ${SMS_API_KEY:-}
```

`GET /system/info` returns only availability and non-sensitive client IDs. It never returns secrets or any organization-scoped WeCom/WPS configuration.

## China cloud

Cloud + CN production allows only WeChat login. WeChat, WeCom, and WPS authentication first creates a normal session; users without a phone number must complete verification in the shared setup page before entering the product workspace. `WECHAT_APP_ID`, `WECHAT_APP_SECRET`, `SMS_API_URL`, and `SMS_API_KEY` are all mandatory at startup; a missing value stops the process with an explicit configuration error.

`make dev PROFILE=cn` enables `AT_DEV_MODE=1` without requiring WeChat or an SMS gateway. The production WeChat sign-in layout remains intact, with a **Developer login** link added below the QR code and agreements. Enter a test username: the same normalized username reuses one simulated account, while different usernames create separate accounts. First login creates a normal session and then uses the production phone-binding page; the random verification code is written only to the server log. Without a WeChat AppID, the original QR slot shows an unconfigured state; with an AppID, the real QR code and developer entry are both available. Shared development and staging environments should set `AT_DEV_MODE=0` and provide all four production values.

## Email login and SMTP

```yaml docker-compose.yaml theme={null}
services:
  asktable:
    environment:
      EMAIL_LOGIN_ENABLED: "true"
      EMAIL_SMTP_PROVIDER: aliyun # aliyun | custom
      EMAIL_SMTP_HOST: ""         # required for custom
      EMAIL_SMTP_PORT: "465"
      EMAIL_SMTP_USERNAME: ""
      EMAIL_SMTP_PASSWORD: ${EMAIL_SMTP_PASSWORD:-}
      EMAIL_SMTP_USE_SSL: "true"
      EMAIL_SENDER_ADDRESS: noreply@example.com
```

`aliyun` uses the fixed Alibaba Cloud Direct Mail host and SSL port, with the sender address as the username. `custom` uses the supplied host, port, and SSL setting, and falls back to the sender address when Username is empty. Tasks that need email skip delivery when SMTP is incomplete.

<Note>
  If Google, GitHub, and WeChat are all disabled, email login remains available as a fallback even when `EMAIL_LOGIN_ENABLED=false`, preventing a deployment with no login entry. Organization-scoped WeCom/WPS does not count toward this fallback.
</Note>

Organization Owners/Admins connect WeCom and WPS from Enterprise integrations; see [Enterprise integration login](/en/concepts/organization/enterprise-login). For legacy configuration migration, see [Migration](/en/deploy/migration).