Authentication

TaskView supports multiple ways to sign in - email/password, email/code, GitHub, Google, and Apple. You can enable whichever methods make sense for your team.

Choosing login methods

By default the login page offers every method. Use the AUTH_LOGIN_METHODS environment variable to offer only the ones you need:

# Comma-separated list: magic-link, password, sso, social
AUTH_LOGIN_METHODS="password,sso"

Disabled methods disappear from the login page and their API endpoints return 403 — the setting is enforced server-side, not just hidden in the UI. Google/GitHub/Apple buttons are additionally shown only when the provider is actually configured, so unconfigured providers never render dead buttons.

Email and password

This is the default method and works out of the box. Users register with an email and password, and log in the same way (email conformation is required).

If you have SMTP configured, users will receive a confirmation email after registration. Without SMTP, email confirmation is skipped and accounts should be activated manually.

Changing your password

Users can set or change their password from Account settings → Password. How the change is confirmed depends on the PASSWORD_CHANGE_CONFIRMATION environment variable:

• email (default) — a confirmation code is sent to the user's email. Requires SMTP.
• password — the user confirms with their current password. No SMTP needed; recommended for installations without a mail server (password login is the only way in there, so every user knows their password).

After a successful change all other sessions are signed out; the current one stays active.

Password recovery

Requires SMTP. Users click "Forgot password" on the login screen, enter their email, and receive a reset link. Without SMTP configured, password recovery is not available - you'll need to reset passwords manually in the database.

The default user (self-hosted)

Fresh installations ship a preinstalled user (user / user1!#Q). That account gets a dedicated Login and email card in Account settings to claim it in one step — set your own login, email and password, confirmed by the current password, no SMTP required. See Installation → Claim the default account.

OAuth providers

TaskView can use external providers for login. This is separate from the integration OAuth (which is for connecting GitHub/GitLab repositories).

GitHub login

Users click "Sign in with GitHub" and authorize the app. TaskView only requests the user:email scope - it reads the email to match or create an account.

To enable, you need a GitHub OAuth App (separate from the integrations one):

1. Go to GitHub Developer Settings
2. Create a New OAuth App
3. Set the callback URL to {API_URL}/module/auth/provider/github/callback

Google login

Works the same way. Create credentials in the Google Cloud Console, set the callback to {API_URL}/module/auth/provider/google/callback.

Apple login

Available for users on Apple devices. Requires an Apple Developer account and Sign in with Apple configuration.

Sessions

TaskView uses JWT tokens for session management:

• Access token - short-lived (default: 1 day), used for API requests
• Refresh token - longer-lived (default: 2 days), used to get a new access token

When the access token expires, the app automatically uses the refresh token to get a new one. Users stay logged in as long as the refresh token is valid.

You can adjust token lifetimes with the ACCESS_LIFE_TIME and REFRESH_LIFE_TIME environment variables.

Account deletion

Users can delete their own account from the account settings page. This is a two-step process - they request a deletion code (sent by email if SMTP is configured), then confirm. Account deletion removes all personal data (You cannot undo this action. You can only restore the data from a backup, if you have one.).