# Deployment authentication configuration

Configure Google, GitHub, WeChat, email login, SMTP, and SMS through static environment variables.

部署说明 · 模块: deploy · 管理人员 · 部署形态：Cloud / 私有部署 · 已确认产品版本：资料未说明 · 来源：编辑整理 · 变更章节按产品 4.2.48-1026 核对（CLI 命令另按 0.0.10）；不代表所有实例已升级，也不是完整历史支持矩阵。

Google, GitHub, WeChat, email login, SMTP, and SMS apply to the entire AskTable instance and are read only from environment variables. Restart Web and Worker after making changes; System settings no longer provides these authentication settings.

## Deployment mode and Region

`AT_REGION` defaults to `cn` and can also be set to `global`. Private deployment (`AT_DEPLOY_MODE=local`) always uses email as the account identifier, regardless of Region. Domestic Cloud uses phone numbers; overseas Cloud uses email. Keep Region fixed after deployment; plan an identity data migration before changing it.

When using Docker Compose, merge the configuration below into the existing `asktable.environment`. After changing environment variables, run `docker compose up -d asktable` to recreate the container with the new configuration. Simply restarting the container does not read changes to Compose environment variables. If Web and Worker run separately, update and restart both.

## OAuth providers

| Provider | Environment variables                      |
| -------- | ------------------------------------------ |
| Google   | `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET` |
| GitHub   | `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET` |
| WeChat   | `WECHAT_APP_ID`, `WECHAT_APP_SECRET`       |

Each ID and Secret pair must be set together. Leaving the entire pair empty disables the provider; setting only one causes application startup to fail with an incomplete-configuration error.

```yaml docker-compose.yaml
services:
  asktable:
    environment:
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
      WECHAT_APP_ID: ${WECHAT_APP_ID:-}
      WECHAT_APP_SECRET: ${WECHAT_APP_SECRET:-}
      SMS_API_URL: ${SMS_API_URL:-}
      SMS_API_KEY: ${SMS_API_KEY:-}
```

`GET /system/info` returns only enabled status and non-sensitive Client IDs. It does not return Secrets or any organization-level WeCom/WPS/Feishu/DingTalk configuration.

## Domestic cloud

The unified production login page for Cloud + CN offers only WeChat; organization-specific WeCom/WPS/Feishu/DingTalk login URLs remain available. Successful WeChat, WeCom, WPS, Feishu, or DingTalk authentication first establishes a normal session. If a phone number is missing, the unified setup page requires verification before entering the product workspace. Startup requires `WECHAT_APP_ID`, `WECHAT_APP_SECRET`, `SMS_API_URL`, and `SMS_API_KEY` together; a missing value causes the process to report an explicit error and stop.

## Email login and SMTP

```yaml docker-compose.yaml
services:
  asktable:
    environment:
      EMAIL_LOGIN_ENABLED: "true"
      EMAIL_SMTP_PROVIDER: aliyun # aliyun | custom
      EMAIL_SMTP_HOST: ""         # Required for custom
      EMAIL_SMTP_PORT: "465"
      EMAIL_SMTP_USERNAME: ""
      EMAIL_SMTP_PASSWORD: ${EMAIL_SMTP_PASSWORD:-}
      EMAIL_SMTP_USE_SSL: "true"
      EMAIL_SENDER_ADDRESS: noreply@example.com
```

`aliyun` uses the fixed Alibaba Cloud Direct Mail host and SSL port, with the sender address also used as the username. `custom` uses the supplied Host, Port, and SSL options; an empty Username falls back to the sender address. Tasks that depend on email delivery skip sending when SMTP configuration is incomplete.

**Note**

For private deployment and overseas Cloud, if Google, GitHub, and WeChat are all disabled, the system retains email login as a fallback even when `EMAIL_LOGIN_ENABLED=false`, so the deployment still has a login entry. Organization-level WeCom/WPS/Feishu/DingTalk does not participate in this decision.

Organization Owners/Admins should connect WeCom, WPS, Feishu, and DingTalk through login integrations; see [Enterprise integration login](https://docs.asktable.com/en/organization/enterprise-login). See [Migration](https://docs.asktable.com/en/deploy/migration) for upgrade requirements from older versions.