> Without OIDCISSUER the app is open to anyone who can reach it. With it, every page asks for a sign-in through your provider (Pocket ID, Authentik, Authelia, Keycloak, ...)…
> Source: https://orochibraru.com/bercail/docs/sign-in · Site index: https://orochibraru.com/llms.txt

# Sign-in

Without `OIDC_ISSUER` the app is open to anyone who can reach it. With it, every page asks for a
sign-in through your provider (Pocket ID, Authentik, Authelia, Keycloak, ...). Register a
confidential client with the redirect URL `<ORIGIN>/auth/callback`. Sessions last 30 days and
renew while in use.

Set `OIDC_ALLOWED_EMAILS` unless the provider already restricts who can use this client. With a
provider anyone can sign up to, leaving it unset lets anyone in.