[GH-ISSUE #3447] [feature]: Username/password registration and authentication for self-hosted services

kerem commented

2026-03-16 18:55:12 +03:00

Owner

Originally created by @yarray on GitHub (Oct 12, 2023).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/3447

Is there an existing issue for this?

I have searched the existing issues

Summary

Hi, I have a small project that has to be developed in a LAN without internet. As I know Hoppscotch only supports OAuth and Email verification now so I have to setup an Email server with smpt in the LAN, which seems an unnecessary overhead. It would be great if we can have an option to allow registering and logining with only username and password?

Why should this be worked on?

For the VITE_ALLOWED_AUTH_PROVIDERS, allow "Simple" or "UserPass" besides the current options. When it is set, allow users to register accounts and login with the username/passwords later.

Originally created by @yarray on GitHub (Oct 12, 2023). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/3447 ### Is there an existing issue for this? - [X] I have searched the existing issues ### Summary Hi, I have a small project that has to be developed in a LAN without internet. As I know Hoppscotch only supports OAuth and Email verification now so I have to setup an Email server with smpt in the LAN, which seems an unnecessary overhead. It would be great if we can have an option to allow registering and logining with only username and password? ### Why should this be worked on? For the VITE_ALLOWED_AUTH_PROVIDERS, allow "Simple" or "UserPass" besides the current options. When it is set, allow users to register accounts and login with the username/passwords later.

kerem added the

feature

self-host

labels

2026-03-16 18:55:12 +03:00

kerem commented

2026-03-16 18:55:24 +03:00

Author

Owner

@kpguru20001 commented on GitHub (Oct 21, 2023):

Hey @AndrewBastin is this something that Hopscotch team is open to work on? Was thinking I could work on this feature. If you assign this to me I ll pass over a RFC.

@kpguru20001 commented on GitHub (Oct 21, 2023): Hey @AndrewBastin is this something that Hopscotch team is open to work on? Was thinking I could work on this feature. If you assign this to me I ll pass over a RFC.

kerem commented

2026-03-16 18:55:29 +03:00

Author

Owner

@MisterScience5 commented on GitHub (Nov 5, 2023):

I second this, I've spent a few days trying to get Hoppscotch set up self hosted, but the STMP options seem bugged, so that doesn't work either with an external provider or Mailcatcher.

After wasting a couple more hours on Github OAuth which apparently doesn't work through an SSL proxy, I am giving up - but will check in in a few months and see if a user friendly alternative to these elaborate authorization options has been implemented.

@MisterScience5 commented on GitHub (Nov 5, 2023): I second this, I've spent a few days trying to get Hoppscotch set up self hosted, but the STMP options seem bugged, so that doesn't work either with an external provider or Mailcatcher. After wasting a couple more hours on Github OAuth which apparently doesn't work through an SSL proxy, I am giving up - but will check in in a few months and see if a user friendly alternative to these elaborate authorization options has been implemented.

kerem commented

2026-03-16 18:55:34 +03:00

Author

Owner

@dudename commented on GitHub (Nov 25, 2023):

I had the same issue. I'm using prebuilt images from Docker-Hub (backend, frontend, admin and pgSQL) and cant setup Auth throught mail server, because after clicking "Send magic link" server returns 500 errors, and docker logs of backend container show this:

Invalid this.prisma.user.create() invocation in
/usr/src/app/packages/hoppscotch-backend/dist/user/user.service.js:88:52

85 }
86 }
87 async createUserViaMagicLink(email) {
→ 88 const createdUser = await this.prisma.user.create(
The table public.User does not exist in the current database.

@dudename commented on GitHub (Nov 25, 2023): I had the same issue. I'm using prebuilt images from Docker-Hub (backend, frontend, admin and pgSQL) and cant setup Auth throught mail server, because after clicking "Send magic link" server returns 500 errors, and docker logs of backend container show this: Invalid `this.prisma.user.create()` invocation in /usr/src/app/packages/hoppscotch-backend/dist/user/user.service.js:88:52 85 } 86 } 87 async createUserViaMagicLink(email) { → 88 const createdUser = await this.prisma.user.create( The table `public.User` does not exist in the current database.

kerem commented

2026-03-16 18:55:39 +03:00

Author

Owner

@coderxi1 commented on GitHub (Nov 27, 2023):

I had the same issue. I'm using prebuilt images from Docker-Hub (backend, frontend, admin and pgSQL) and cant setup Auth throught mail server, because after clicking "Send magic link" server returns 500 errors, and docker logs of backend container show this:

Invalid invocation in /usr/src/app/packages/hoppscotch-backend/dist/user/user.service.js:88:52this.prisma.user.create()

85 } 86 } 87 async createUserViaMagicLink(email) { → 88 const createdUser = await this.prisma.user.create( The table does not exist in the current database.public.User

same issue

@coderxi1 commented on GitHub (Nov 27, 2023): > I had the same issue. I'm using prebuilt images from Docker-Hub (backend, frontend, admin and pgSQL) and cant setup Auth throught mail server, because after clicking "Send magic link" server returns 500 errors, and docker logs of backend container show this: > > Invalid invocation in /usr/src/app/packages/hoppscotch-backend/dist/user/user.service.js:88:52`this.prisma.user.create()` > > 85 } 86 } 87 async createUserViaMagicLink(email) { → 88 const createdUser = await this.prisma.user.create( The table does not exist in the current database.`public.User` same issue

kerem commented

2026-03-16 18:55:44 +03:00

Author

Owner

@dudename commented on GitHub (Nov 27, 2023):

I had the same issue. I'm using prebuilt images from Docker-Hub (backend, frontend, admin and pgSQL) and cant setup Auth throught mail server, because after clicking "Send magic link" server returns 500 errors, and docker logs of backend container show this:

Invalid this.prisma.user.create() invocation in /usr/src/app/packages/hoppscotch-backend/dist/user/user.service.js:88:52

85 } 86 } 87 async createUserViaMagicLink(email) { → 88 const createdUser = await this.prisma.user.create( The table public.User does not exist in the current database.

In my case, this trouble occurred due to the migration to pgSQL mentioned in the official doc:
https://docs.hoppscotch.io/documentation/self-host/community-edition/install-and-build

@dudename commented on GitHub (Nov 27, 2023): > I had the same issue. I'm using prebuilt images from Docker-Hub (backend, frontend, admin and pgSQL) and cant setup Auth throught mail server, because after clicking "Send magic link" server returns 500 errors, and docker logs of backend container show this: > > Invalid `this.prisma.user.create()` invocation in /usr/src/app/packages/hoppscotch-backend/dist/user/user.service.js:88:52 > > 85 } 86 } 87 async createUserViaMagicLink(email) { → 88 const createdUser = await this.prisma.user.create( The table `public.User` does not exist in the current database. In my case, this trouble occurred due to the migration to pgSQL mentioned in the official doc: https://docs.hoppscotch.io/documentation/self-host/community-edition/install-and-build

kerem commented

2026-03-16 18:55:49 +03:00

Author

Owner

@ddnomad commented on GitHub (Mar 20, 2024):

This would be very a very useful feature for air gapped deployments. The fact that you have to send a "magic link" or use some OAuth provider to even create the admin user seems somewhat backwards to me.

@ddnomad commented on GitHub (Mar 20, 2024): This would be very a very useful feature for air gapped deployments. The fact that you _have_ to send a "magic link" or use some OAuth provider to even create the admin user seems somewhat backwards to me.

kerem commented

2026-03-16 18:55:54 +03:00

Author

Owner

@foxx commented on GitHub (Mar 21, 2024):

Are the Hoppscotch maintainers planning to keep on supporting self-hosting deployments? The amount of time this ticket has been outstanding is a little concerning. If lack of resources is an issue, maybe introduce a bounty program to encourage PRs, or charge a small support fee?

@foxx commented on GitHub (Mar 21, 2024): Are the Hoppscotch maintainers planning to keep on supporting self-hosting deployments? The amount of time this ticket has been outstanding is a little concerning. If lack of resources is an issue, maybe introduce a bounty program to encourage PRs, or charge a small support fee?

kerem commented

2026-03-16 18:55:59 +03:00

Author

Owner

@yuyuko233 commented on GitHub (Aug 21, 2024):

any news?

@yuyuko233 commented on GitHub (Aug 21, 2024): any news?

kerem commented

2026-03-16 18:56:04 +03:00

Author

Owner

@bigghe commented on GitHub (Sep 12, 2024):

Hello there,

No news regarding this?
The issue #4232 cites the possibility to login through an external provider (Microsoft in that case) also in the selfhosted edition.
So probably this issue #3447 is somehow solved?

@bigghe commented on GitHub (Sep 12, 2024): Hello there, No news regarding this? The issue #4232 cites the possibility to login through an external provider (Microsoft in that case) also in the selfhosted edition. So probably this issue #3447 is somehow solved?

kerem commented

2026-03-16 18:56:09 +03:00

Author

Owner

@nicklasring commented on GitHub (Nov 22, 2024):

Not very intuitive, one of the most annoying docker setups ive experienced, got some work to do there.

In our case we enabled only email and i dont see any way of creating a password, you just have to request the magic link over and over again, and its only session based? Dont really get this approach.

Also experienced tons of issues with the SMTP config, had to spend almost a full day setting that up, in the end the only thing that worked was to disable MAILER_SMTP_SECURE which does not feel very great.

If the github or google auth is as messy we will probably abandon this tool.

@nicklasring commented on GitHub (Nov 22, 2024): Not very intuitive, one of the most annoying docker setups ive experienced, got some work to do there. In our case we enabled only email and i dont see any way of creating a password, you just have to request the magic link over and over again, and its only session based? Dont really get this approach. Also experienced tons of issues with the SMTP config, had to spend almost a full day setting that up, in the end the only thing that worked was to disable MAILER_SMTP_SECURE which does not feel very great. If the github or google auth is as messy we will probably abandon this tool.

kerem commented

2026-03-16 18:56:14 +03:00

Author

Owner

@XiEdAotonG commented on GitHub (Feb 21, 2025):

Feature Proposal: Offline-Friendly Authentication via Username/Password

Context:
Many users (especially in enterprise/LAN environments) require offline-first solutions where external dependencies like OAuth providers or SMTP servers are unavailable or impractical. Setting up an email server solely for authentication adds unnecessary overhead in such scenarios.

Request:
Introduce a simple username/password authentication provider alongside existing methods (OAuth/Email). This can be enabled via a new VITE_ALLOWED_AUTH_PROVIDERS option (e.g., userpass or simple).

Why This Matters:

Offline/LAN Compatibility: Enables Hoppscotch deployment in isolated networks without internet access or SMTP infrastructure.
Reduced Complexity: Eliminates the need for maintainers to configure third-party services (OAuth, SMTP) in constrained environments.
Flexibility: Aligns with real-world use cases where lightweight, self-contained authentication is critical (e.g., internal tools, air-gapped networks).
Security Control: Organizations can enforce their own password policies and user management workflows locally.

Implementation Suggestions:

Add a username/password option to the auth provider settings.
Include registration/login UI forms for local accounts when the provider is enabled.
Securely hash passwords (e.g., bcrypt) and store credentials locally.
Optional: Allow admins to manage users via a simple interface (CRUD operations).

Tradeoffs Addressed:

Security: Proper hashing and validation mitigate risks of plaintext storage.
Optionality: Disabled by default; users opt-in via config, preserving current behavior.

This feature would significantly broaden Hoppscotch’s usability in restricted environments while maintaining simplicity for standard use cases.

@XiEdAotonG commented on GitHub (Feb 21, 2025): **Feature Proposal: Offline-Friendly Authentication via Username/Password** **Context:** Many users (especially in enterprise/LAN environments) require offline-first solutions where external dependencies like OAuth providers or SMTP servers are unavailable or impractical. Setting up an email server solely for authentication adds unnecessary overhead in such scenarios. **Request:** Introduce a **simple username/password authentication provider** alongside existing methods (OAuth/Email). This can be enabled via a new `VITE_ALLOWED_AUTH_PROVIDERS` option (e.g., `userpass` or `simple`). **Why This Matters:** 1. **Offline/LAN Compatibility:** Enables Hoppscotch deployment in isolated networks without internet access or SMTP infrastructure. 2. **Reduced Complexity:** Eliminates the need for maintainers to configure third-party services (OAuth, SMTP) in constrained environments. 3. **Flexibility:** Aligns with real-world use cases where lightweight, self-contained authentication is critical (e.g., internal tools, air-gapped networks). 4. **Security Control:** Organizations can enforce their own password policies and user management workflows locally. **Implementation Suggestions:** - Add a `username/password` option to the auth provider settings. - Include registration/login UI forms for local accounts when the provider is enabled. - Securely hash passwords (e.g., bcrypt) and store credentials locally. - Optional: Allow admins to manage users via a simple interface (CRUD operations). **Tradeoffs Addressed:** - **Security:** Proper hashing and validation mitigate risks of plaintext storage. - **Optionality:** Disabled by default; users opt-in via config, preserving current behavior. This feature would significantly broaden Hoppscotch’s usability in restricted environments while maintaining simplicity for standard use cases.

kerem commented

2026-03-16 18:56:19 +03:00

Author

Owner

@tuxthepenguin84 commented on GitHub (Mar 9, 2025):

Here's how you can get the magic link without sending any emails.

Go to the Admin portal, click "Continue with email", put in an email address, and click "Send magic link"
Next we need to query the DB and find your "uid"

SELECT * FROM public."User"

Then query for the tokens

SELECT * FROM public."VerificationToken"

Find the token that matches your "uid"
Put in your token in the url to open your "magic link" (replace localhost:3100 with whatever the endpoint you have for the admin portal"
http://localhost:3100/enter?token=your_token

If you logout you'll need to repeat the steps above.

@tuxthepenguin84 commented on GitHub (Mar 9, 2025): Here's how you can get the magic link without sending any emails. 1. Go to the Admin portal, click "Continue with email", put in an email address, and click "Send magic link" 2. Next we need to query the DB and find your "uid" ``` SELECT * FROM public."User" ``` 3. Then query for the tokens ``` SELECT * FROM public."VerificationToken" ``` 4. Find the token that matches your "uid" 5. Put in your token in the url to open your "magic link" (replace localhost:3100 with whatever the endpoint you have for the admin portal" http://localhost:3100/enter?token=your_token If you logout you'll need to repeat the steps above.

kerem commented

2026-03-16 18:56:25 +03:00

Author

Owner

@adrianipopescu commented on GitHub (Mar 9, 2025):

true but doesn't seem... user friendly at all, especially for selfhosted enthusiasts

@adrianipopescu commented on GitHub (Mar 9, 2025): true but doesn't seem... user friendly at all, especially for selfhosted enthusiasts

kerem commented

2026-03-16 18:56:30 +03:00

Author

Owner

@ddnomad commented on GitHub (Mar 10, 2025):

true but doesn't seem... user friendly at all, especially for selfhosted enthusiasts

This may or may not be partially intentional. Hoppscotch needs to monetise themselves somehow.

That's being said, this specific issue forced the company I work at to give up on trying to use Hoppscotch, precisely because we needed a way to easily deploy it in a self-hosted environment with local & independent authentication options.

@XiEdAotonG pretty much perfectly covered it already.

@ddnomad commented on GitHub (Mar 10, 2025): > true but doesn't seem... user friendly at all, especially for selfhosted enthusiasts This may or may not be partially intentional. Hoppscotch needs to monetise themselves somehow. That's being said, this specific issue forced the company I work at to give up on trying to use Hoppscotch, precisely because we needed a way to easily deploy it in a self-hosted environment with local & independent authentication options. @XiEdAotonG pretty much perfectly covered it already.

kerem commented

2026-03-16 18:56:35 +03:00

Author

Owner

@adrianipopescu commented on GitHub (Mar 10, 2025):

That's being said, this specific issue forced the company I work at to give up on trying to use Hoppscotch, precisely because we needed a way to easily deploy it in a self-hosted environment with local & independent authentication options.

That's what I'm afraid of mostly, as Small to Medium sized Orgs' IT teams tend to pilot things at home / in the work playground, and if it feels like a burden in the free version most will end up not recommending it further up the chain

I understand the need to monetize, but would be better to make an amazing first impression, then get people hooked on premium services on top, typically aimed at companies

@adrianipopescu commented on GitHub (Mar 10, 2025): > That's being said, this specific issue forced the company I work at to give up on trying to use Hoppscotch, precisely because we needed a way to easily deploy it in a self-hosted environment with local & independent authentication options. That's what I'm afraid of mostly, as Small to Medium sized Orgs' IT teams tend to pilot things at home / in the work playground, and if it feels like a burden in the free version most will end up not recommending it further up the chain I understand the need to monetize, but would be better to make an amazing first impression, then get people hooked on premium services on top, typically aimed at companies

kerem referenced this issue

2026-03-17 00:44:55 +03:00

[PR #1163] [CLOSED] Bump eslint from 7.8.1 to 7.9.0 #3101

Rows
Columns

[GH-ISSUE #3447] [feature]: Username/password registration and authentication for self-hosted services #1163

Is there an existing issue for this?

Summary

Why should this be worked on?