Skip to main content

Authelia

What is Authelia?​

Authelia is a self-hosted single sign-on (SSO) and multi-factor authentication server. It provides a secure authentication portal that protects all your web applications with a shared login across multiple services. Authelia and Vouch Proxy are mutually exclusive; you can only have one installed.

Authentication Modes​

Authelia supports three authentication modes:

  • Password mode (--password): Simple password-only authentication (single factor)
  • MFA mode (--mfa): Password + Time-based One-Time Password (TOTP) for two-factor authentication
  • Passwordless mode (--passwordless): Magic links via email for password-free login

Installation​

Password Mode (Default)​

box install authelia --domain example.com

MFA Mode​

box install authelia --domain example.com --mfa

After installation, a TOTP setup link is displayed. Users can visit this link to:

  1. Generate a QR code for their authenticator
  2. Scan it with Google Authenticator, Microsoft Authenticator, Authy, or FreeOTP
  3. Save the code in their authenticator app

On subsequent logins:

  1. Enter your password
  2. Enter the 6-digit TOTP code from your authenticator app

Passwordless Mode​

box install authelia --domain example.com --passwordless \
  --admin-email [email protected] \
  --smtp-host smtp.gmail.com \
  --smtp-port 587 \
  --smtp-username [email protected] \
  --smtp-password APP_PASSWORD \
  --smtp-sender [email protected]

This mode sends magic login links via email. No password is stored or required. You must provide valid SMTP credentials (Gmail, SendGrid, or other email provider).

Note

Passwordless mode for Authelia currently does not support one_factor authentication. Only passwordless (magic link) authentication is available in this mode.

Management​

  • Update: box update authelia
  • Remove: box remove authelia

Authentication Migration​

If you're migrating from another auth provider:

qbAuthMigrate --provider authelia

This command handles provider-aware Nginx auth migration and preserves existing configurations.

Limitation

qbAuthMigrate can only migrate from basic or store authentication to basic authentication. It cannot directly convert existing Authelia or Vouch Proxy configurations.

Requirements​

  • Docker must be installed
  • Valid domain for Authelia portal (e.g., auth.example.com)
  • SMTP credentials required only for passwordless mode