@lobehub/lobehub 2.0.0-next.332 → 2.0.0-next.334

package/docs/self-hosting/advanced/auth/better-auth/github.mdx

@@ -0,0 +1,93 @@
+---
+title: Configuring GitHub Authentication for LobeChat
+description: >-
+  Learn how to configure GitHub SSO for LobeChat, including creating a GitHub
+  App, setting up environment variables, and deployment.
+tags:
+  - GitHub
+  - Authentication
+  - LobeChat
+  - Single Sign-On
+---
+
+# Configuring GitHub Authentication
+
+<Steps>
+  ### Create a GitHub App
+
+  1. Go to [GitHub Developer Settings](https://github.com/settings/apps/new)
+  2. Fill in the **GitHub App name** and **Homepage URL**
+
+  <Image alt="Create a GitHub App" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/2f919f99-2aaa-4fa7-9938-169d3ed09db7" />
+
+  ### Configure Callback URL
+
+  <Callout type={'info'}>
+    Callback URL format:
+
+    - Local development: `http://localhost:3210/api/auth/callback/github`
+    - Production: `https://your-domain.com/api/auth/callback/github`
+  </Callout>
+
+  Set the Webhook URL according to your needs (can be disabled if not used).
+
+  <Image alt="Fill in other fields" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/d7ef5ad1-b1a3-435e-b1bc-4436d2b6fecd" />
+
+  ### Configure Permissions
+
+  Set permission to read user email addresses:
+
+  <Image alt="Set required permissions" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/23131ca1-9e84-4a89-a840-ef79c4bc0251" />
+
+  <Image alt="Set permission to read email addresses" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/358bca8d-3d82-4e76-9a5e-90d16a39efde" />
+
+  Set whether the app is publicly accessible or only accessible to yourself.
+
+  <Image alt="Set accessibility" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/995780cb-9096-4a36-ab17-d422703ab970" />
+
+  Click **Create GitHub App**.
+
+  ### Generate Client Secret
+
+  After creation, click **Generate a new client secret**.
+
+  <Image alt="Create a new client secret" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/6d69bdca-7d18-4cbc-b3e0-220d8815cd29" />
+
+  Save the **Client ID** and **Client Secret**.
+
+  <Image alt="Save credentials" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/c6108133-a918-48b0-ab1a-e3fa607572a4" />
+
+  ### Configure Environment Variables
+
+  | Environment Variable             | Type     | Description                                                     |
+  | -------------------------------- | -------- | --------------------------------------------------------------- |
+  | `AUTH_SECRET`                    | Required | Session encryption key, generate with `openssl rand -base64 32` |
+  | `AUTH_SSO_PROVIDERS`             | Required | Set to `github`                                                 |
+  | `AUTH_GITHUB_ID`                 | Required | Client ID from the GitHub App                                   |
+  | `AUTH_GITHUB_SECRET`             | Required | Client Secret from the GitHub App                               |
+
+  <Callout type={'tip'}>
+    Go to [📘 Environment Variables](/docs/self-hosting/environment-variables/auth#github)
+    for detailed information.
+  </Callout>
+</Steps>
+
+<Callout type={'info'}>
+  After successful deployment, users will be able to authenticate with GitHub
+  and use LobeChat.
+</Callout>
+
+## Common Issues
+
+### email\_not\_found Error
+
+This usually happens when the GitHub App doesn't have email read permission. Go to your app settings, navigate to **Permissions & events** > **Account permissions** > **Email addresses** and set it to **Read-only**.
+
+### No Refresh Token
+
+GitHub OAuth does not issue refresh tokens. Access tokens remain valid until the user revokes access, the app revokes access, or the token hasn't been used for one year.
+
+## Related Resources
+
+- [GitHub Developer Settings](https://github.com/settings/developers)
+- [GitHub Apps Documentation](https://docs.github.com/en/apps)

package/docs/self-hosting/advanced/auth/better-auth/github.zh-CN.mdx

@@ -0,0 +1,90 @@
+---
+title: 在 LobeChat 中配置 GitHub 身份验证
+description: 学习如何在 LobeChat 中配置 GitHub SSO，包括创建 GitHub App、设置环境变量和部署。
+tags:
+  - GitHub
+  - 身份验证
+  - LobeChat
+  - 单点登录
+---
+
+# 配置 GitHub 身份验证
+
+<Steps>
+  ### 创建 GitHub App
+
+  1. 前往 [GitHub 开发者设置](https://github.com/settings/apps/new)
+  2. 填写 **GitHub App name** 和 **Homepage URL**
+
+  <Image alt="创建 GitHub App" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/2f919f99-2aaa-4fa7-9938-169d3ed09db7" />
+
+  ### 配置回调 URL
+
+  <Callout type={'info'}>
+    回调 URL 格式：
+
+    - 本地开发: `http://localhost:3210/api/auth/callback/github`
+    - 生产环境: `https://your-domain.com/api/auth/callback/github`
+  </Callout>
+
+  按需设置 Webhook URL（不需要可禁用）。
+
+  <Image alt="填写其他字段" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/d7ef5ad1-b1a3-435e-b1bc-4436d2b6fecd" />
+
+  ### 配置权限
+
+  设置读取用户邮箱地址的权限：
+
+  <Image alt="设置所需权限" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/23131ca1-9e84-4a89-a840-ef79c4bc0251" />
+
+  <Image alt="设置读取邮件地址权限" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/358bca8d-3d82-4e76-9a5e-90d16a39efde" />
+
+  设置公开访问还是仅自己访问。
+
+  <Image alt="设置访问权限" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/995780cb-9096-4a36-ab17-d422703ab970" />
+
+  点击 **Create GitHub App**。
+
+  ### 生成客户端密钥
+
+  创建成功后，点击 **Generate a new client secret**。
+
+  <Image alt="创建客户端密钥" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/6d69bdca-7d18-4cbc-b3e0-220d8815cd29" />
+
+  保存 **Client ID** 和 **Client Secret**。
+
+  <Image alt="保存凭证" inStep src="https://github.com/lobehub/lobe-chat/assets/64475363/c6108133-a918-48b0-ab1a-e3fa607572a4" />
+
+  ### 配置环境变量
+
+  | 环境变量                             | 类型 | 描述                                     |
+  | -------------------------------- | -- | -------------------------------------- |
+  | `AUTH_SECRET`                    | 必选 | 会话加密密钥，使用 `openssl rand -base64 32` 生成 |
+  | `AUTH_SSO_PROVIDERS`             | 必选 | 填写 `github`                            |
+  | `AUTH_GITHUB_ID`                 | 必选 | GitHub App 的 Client ID                 |
+  | `AUTH_GITHUB_SECRET`             | 必选 | GitHub App 的 Client Secret             |
+
+  <Callout type={'tip'}>
+    前往 [📘 环境变量](/zh/docs/self-hosting/environment-variables/auth#github)
+    可查阅相关变量详情。
+  </Callout>
+</Steps>
+
+<Callout type={'info'}>
+  部署成功后，用户将可以通过 GitHub 身份认证并使用 LobeChat。
+</Callout>
+
+## 常见问题
+
+### email\_not\_found 错误
+
+这通常是因为 GitHub App 没有邮箱读取权限。前往应用设置，导航到 **Permissions & events** > **Account permissions** > **Email addresses**，设置为 **Read-only**。
+
+### 没有 Refresh Token
+
+GitHub OAuth 不发放 refresh token。访问令牌在用户撤销、应用撤销或一年未使用前会一直有效。
+
+## 相关资源
+
+- [GitHub 开发者设置](https://github.com/settings/developers)
+- [GitHub Apps 文档](https://docs.github.com/en/apps)

package/docs/self-hosting/advanced/auth/better-auth/google.mdx

@@ -0,0 +1,80 @@
+---
+title: Configuring Google Authentication for LobeChat
+description: >-
+  Learn how to configure Google SSO for LobeChat, including creating OAuth
+  credentials in Google Cloud Console and setting up environment variables.
+tags:
+  - Google
+  - Authentication
+  - LobeChat
+  - Single Sign-On
+---
+
+# Configuring Google Authentication
+
+<Steps>
+  ### Create Google OAuth Credentials
+
+  1. Go to [Google Cloud Console](https://console.cloud.google.com/apis/credentials)
+  2. Create a new project or select an existing one
+  3. Click **Create Credentials** > **OAuth client ID**
+  4. If this is your first time, configure the OAuth consent screen first (see below)
+  5. Select **Web application** as the application type
+  6. Add authorized redirect URIs (see callback URL configuration below)
+  7. Click Create and save the **Client ID** and **Client Secret**
+
+  ### Configure OAuth Consent Screen
+
+  1. Go to **APIs & Services** > **OAuth consent screen**
+  2. Choose user type:
+     - **External**: For any Google account
+     - **Internal**: For Google Workspace organization users only
+  3. Fill in required information: app name, user support email, etc.
+  4. Add scopes: `email` and `profile`
+  5. If in testing mode, add test users
+
+  ### Configure Callback URL
+
+  Add to authorized redirect URIs:
+
+  <Callout type={'info'}>
+    Callback URL format:
+
+    - Local development: `http://localhost:3210/api/auth/callback/google`
+    - Production: `https://your-domain.com/api/auth/callback/google`
+  </Callout>
+
+  ### Configure Environment Variables
+
+  | Environment Variable             | Type     | Description                                                     |
+  | -------------------------------- | -------- | --------------------------------------------------------------- |
+  | `AUTH_SECRET`                    | Required | Session encryption key, generate with `openssl rand -base64 32` |
+  | `AUTH_SSO_PROVIDERS`             | Required | Set to `google`                                                 |
+  | `AUTH_GOOGLE_ID`                 | Required | Client ID from Google Cloud Console                             |
+  | `AUTH_GOOGLE_SECRET`             | Required | Client Secret from Google Cloud Console                         |
+
+  <Callout type={'tip'}>
+    Go to [📘 Environment Variables](/docs/self-hosting/environment-variables/auth#google)
+    for detailed information.
+  </Callout>
+</Steps>
+
+<Callout type={'info'}>
+  After successful deployment, users will be able to authenticate with Google
+  and use LobeChat.
+</Callout>
+
+## Common Issues
+
+### redirect\_uri\_mismatch Error
+
+Ensure the callback URL configured in Google Cloud Console exactly matches your deployment address, including the protocol (http/https) and port number.
+
+### Testing Mode Limitations
+
+If the OAuth consent screen is in testing mode, only Google accounts added as test users can sign in.
+
+## Related Resources
+
+- [Google Cloud Console](https://console.cloud.google.com/)
+- [Google OAuth 2.0 Documentation](https://developers.google.com/identity/protocols/oauth2)

package/docs/self-hosting/advanced/auth/better-auth/google.zh-CN.mdx

@@ -0,0 +1,77 @@
+---
+title: 在 LobeChat 中配置 Google 身份验证
+description: 学习如何在 LobeChat 中配置 Google SSO，包括在 Google Cloud Console 创建 OAuth 凭证和设置环境变量。
+tags:
+  - Google
+  - 身份验证
+  - LobeChat
+  - 单点登录
+---
+
+# 配置 Google 身份验证
+
+<Steps>
+  ### 创建 Google OAuth 凭证
+
+  1. 前往 [Google Cloud Console](https://console.cloud.google.com/apis/credentials)
+  2. 创建新项目或选择现有项目
+  3. 点击 **Create Credentials** > **OAuth client ID**
+  4. 如果是首次创建，需先配置 OAuth 同意屏幕（见下方步骤）
+  5. 选择 **Web application** 作为应用类型
+  6. 添加授权重定向 URI（见下方回调 URL 配置）
+  7. 点击创建，保存 **Client ID** 和 **Client Secret**
+
+  ### 配置 OAuth 同意屏幕
+
+  1. 前往 **APIs & Services** > **OAuth consent screen**
+  2. 选择用户类型：
+     - **External**：适用于任何 Google 账户
+     - **Internal**：仅限 Google Workspace 组织用户
+  3. 填写应用名称、用户支持邮箱等必填信息
+  4. 添加授权范围：`email` 和 `profile`
+  5. 如果处于测试模式，需添加测试用户
+
+  ### 配置回调 URL
+
+  在授权重定向 URI 中添加：
+
+  <Callout type={'info'}>
+    回调 URL 格式：
+
+    - 本地开发: `http://localhost:3210/api/auth/callback/google`
+    - 生产环境: `https://your-domain.com/api/auth/callback/google`
+  </Callout>
+
+  ### 配置环境变量
+
+  | 环境变量                             | 类型 | 描述                                     |
+  | -------------------------------- | -- | -------------------------------------- |
+  | `AUTH_SECRET`                    | 必选 | 会话加密密钥，使用 `openssl rand -base64 32` 生成 |
+  | `AUTH_SSO_PROVIDERS`             | 必选 | 填写 `google`                            |
+  | `AUTH_GOOGLE_ID`                 | 必选 | Google Cloud Console 中的 Client ID      |
+  | `AUTH_GOOGLE_SECRET`             | 必选 | Google Cloud Console 中的 Client Secret  |
+
+  <Callout type={'tip'}>
+    前往 [📘 环境变量](/zh/docs/self-hosting/environment-variables/auth#google)
+    可查阅相关变量详情。
+  </Callout>
+</Steps>
+
+<Callout type={'info'}>
+  部署成功后，用户将可以通过 Google 身份认证并使用 LobeChat。
+</Callout>
+
+## 常见问题
+
+### redirect\_uri\_mismatch 错误
+
+确保 Google Cloud Console 中配置的回调 URL 与实际部署地址完全匹配，包括协议（http/https）和端口号。
+
+### 测试模式限制
+
+如果 OAuth 同意屏幕处于测试模式，只有添加为测试用户的 Google 账户才能登录。
+
+## 相关资源
+
+- [Google Cloud Console](https://console.cloud.google.com/)
+- [Google OAuth 2.0 文档](https://developers.google.com/identity/protocols/oauth2)

package/docs/self-hosting/advanced/auth/better-auth/keycloak.mdx

@@ -0,0 +1,77 @@
+---
+title: Configuring Keycloak Authentication for LobeChat
+description: >-
+  Learn how to configure Keycloak SSO for LobeChat, including creating a client
+  and setting up environment variables.
+tags:
+  - Keycloak
+  - Authentication
+  - LobeChat
+  - Single Sign-On
+---
+
+# Configuring Keycloak Authentication
+
+[Keycloak](https://www.keycloak.org/) is an open-source Identity and Access Management solution.
+
+<Steps>
+  ### Create Client in Keycloak
+
+  1. Log in to your Keycloak Admin Console
+  2. Select your realm (or create a new one)
+  3. Go to **Clients** > **Create client**
+  4. Configure the client:
+     - **Client type**: `OpenID Connect`
+     - **Client ID**: `lobechat` (or any name you prefer)
+  5. Click **Next**
+  6. Enable **Client authentication** (On)
+  7. Click **Next** and then **Save**
+
+  ### Configure Redirect URI
+
+  In the client **Settings** tab:
+
+  1. Add redirect URI under **Valid redirect URIs**
+
+  <Callout type={'info'}>
+    Callback URL format:
+
+    - Local development: `http://localhost:3210/api/auth/callback/keycloak`
+    - Production: `https://your-domain.com/api/auth/callback/keycloak`
+  </Callout>
+
+  ### Get Client Secret
+
+  Go to the **Credentials** tab and copy the **Client secret**.
+
+  ### Get Issuer URL
+
+  The issuer URL format: `https://your-keycloak-domain/realms/your-realm`
+
+  For example: `https://keycloak.example.com/realms/master`
+
+  ### Configure Environment Variables
+
+  | Environment Variable             | Type     | Description                                                     |
+  | -------------------------------- | -------- | --------------------------------------------------------------- |
+  | `AUTH_SECRET`                    | Required | Session encryption key, generate with `openssl rand -base64 32` |
+  | `AUTH_SSO_PROVIDERS`             | Required | Set to `keycloak`                                               |
+  | `AUTH_KEYCLOAK_ID`               | Required | Client ID                                                       |
+  | `AUTH_KEYCLOAK_SECRET`           | Required | Client Secret                                                   |
+  | `AUTH_KEYCLOAK_ISSUER`           | Required | `https://your-keycloak-domain/realms/your-realm`                |
+
+  <Callout type={'tip'}>
+    Go to [📘 Environment Variables](/docs/self-hosting/environment-variables/auth#keycloak)
+    for detailed information.
+  </Callout>
+</Steps>
+
+<Callout type={'info'}>
+  After successful deployment, users will be able to authenticate with Keycloak
+  and use LobeChat.
+</Callout>
+
+## Related Resources
+
+- [Keycloak Documentation](https://www.keycloak.org/documentation)
+- [Keycloak OpenID Connect Guide](https://www.keycloak.org/docs/latest/securing_apps/#_oidc)

package/docs/self-hosting/advanced/auth/better-auth/keycloak.zh-CN.mdx

@@ -0,0 +1,74 @@
+---
+title: 在 LobeChat 中配置 Keycloak 身份验证
+description: 学习如何在 LobeChat 中配置 Keycloak SSO，包括创建客户端和设置环境变量。
+tags:
+  - Keycloak
+  - 身份验证
+  - LobeChat
+  - 单点登录
+---
+
+# 配置 Keycloak 身份验证
+
+[Keycloak](https://www.keycloak.org/) 是一个开源的身份和访问管理解决方案。
+
+<Steps>
+  ### 在 Keycloak 中创建客户端
+
+  1. 登录 Keycloak 管理控制台
+  2. 选择你的 realm（或创建新的）
+  3. 前往 **Clients** > **Create client**
+  4. 配置客户端：
+     - **Client type**: `OpenID Connect`
+     - **Client ID**: `lobechat`（或任意名称）
+  5. 点击 **Next**
+  6. 启用 **Client authentication**（On）
+  7. 点击 **Next** 然后 **Save**
+
+  ### 配置重定向 URI
+
+  在客户端 **Settings** 标签页中：
+
+  1. 在 **Valid redirect URIs** 下添加重定向 URI
+
+  <Callout type={'info'}>
+    回调 URL 格式：
+
+    - 本地开发: `http://localhost:3210/api/auth/callback/keycloak`
+    - 生产环境: `https://your-domain.com/api/auth/callback/keycloak`
+  </Callout>
+
+  ### 获取客户端密钥
+
+  前往 **Credentials** 标签页复制 **Client secret**。
+
+  ### 获取 Issuer URL
+
+  Issuer URL 格式：`https://your-keycloak-domain/realms/your-realm`
+
+  例如：`https://keycloak.example.com/realms/master`
+
+  ### 配置环境变量
+
+  | 环境变量                             | 类型 | 描述                                               |
+  | -------------------------------- | -- | ------------------------------------------------ |
+  | `AUTH_SECRET`                    | 必选 | 会话加密密钥，使用 `openssl rand -base64 32` 生成           |
+  | `AUTH_SSO_PROVIDERS`             | 必选 | 填写 `keycloak`                                    |
+  | `AUTH_KEYCLOAK_ID`               | 必选 | Client ID                                        |
+  | `AUTH_KEYCLOAK_SECRET`           | 必选 | Client Secret                                    |
+  | `AUTH_KEYCLOAK_ISSUER`           | 必选 | `https://your-keycloak-domain/realms/your-realm` |
+
+  <Callout type={'tip'}>
+    前往 [📘 环境变量](/zh/docs/self-hosting/environment-variables/auth#keycloak)
+    可查阅相关变量详情。
+  </Callout>
+</Steps>
+
+<Callout type={'info'}>
+  部署成功后，用户将可以通过 Keycloak 身份认证并使用 LobeChat。
+</Callout>
+
+## 相关资源
+
+- [Keycloak 文档](https://www.keycloak.org/documentation)
+- [Keycloak OpenID Connect 指南](https://www.keycloak.org/docs/latest/securing_apps/#_oidc)

package/docs/self-hosting/advanced/auth/better-auth/logto.mdx

@@ -0,0 +1,64 @@
+---
+title: Configuring Logto Authentication for LobeChat
+description: >-
+  Learn how to configure Logto SSO for LobeChat, including creating an
+  application and setting up environment variables.
+tags:
+  - Logto
+  - Authentication
+  - LobeChat
+  - Single Sign-On
+  - OIDC
+---
+
+# Configuring Logto Authentication
+
+[Logto](https://logto.io/) is an open-source Auth0 alternative designed for modern apps and SaaS products.
+
+<Steps>
+  ### Create Application in Logto
+
+  1. Log in to your Logto Console
+  2. Go to **Applications** and click **Create application**
+  3. Select **Traditional web** as the application type
+  4. Fill in the application name: `LobeChat`
+  5. Configure redirect URIs:
+
+  <Callout type={'info'}>
+    **Callback URL Format**: `https://your-domain.com/api/auth/callback/logto`
+  </Callout>
+
+  6. After creation, note down the **App ID** and **App Secret**
+
+  ### Get Issuer URL
+
+  The issuer URL is your Logto endpoint, typically:
+
+  - Cloud: `https://your-tenant.logto.app/oidc`
+  - Self-hosted: `https://your-logto-domain/oidc`
+
+  ### Configure Environment Variables
+
+  When deploying LobeChat, you need to configure the following environment variables:
+
+  | Environment Variable             | Type     | Description                                                                   |
+  | -------------------------------- | -------- | ----------------------------------------------------------------------------- |
+  | `AUTH_SECRET`                    | Required | Key used to encrypt session tokens. Generate using: `openssl rand -base64 32` |
+  | `AUTH_SSO_PROVIDERS`             | Required | SSO provider for LobeChat. Use `logto` for Logto                              |
+  | `AUTH_LOGTO_ID`                  | Required | App ID from Logto application                                                 |
+  | `AUTH_LOGTO_SECRET`              | Required | App Secret from Logto application                                             |
+  | `AUTH_LOGTO_ISSUER`              | Required | Logto issuer URL (e.g., `https://your-tenant.logto.app/oidc`)                 |
+
+  <Callout type={'tip'}>
+    Go to [📘 Environment Variables](/docs/self-hosting/environment-variables/auth#logto) for detailed information on these variables.
+  </Callout>
+</Steps>
+
+<Callout type={'info'}>
+  After successful deployment, users will be able to authenticate with Logto and use LobeChat.
+</Callout>
+
+## Related Resources
+
+- [Logto Documentation](https://docs.logto.io/)
+- [Logto Application Setup](https://docs.logto.io/docs/recipes/integrate-logto/)

package/docs/self-hosting/advanced/auth/better-auth/logto.zh-CN.mdx

@@ -0,0 +1,60 @@
+---
+title: 在 LobeChat 中配置 Logto 身份验证
+description: 学习如何在 LobeChat 中配置 Logto SSO，包括创建应用和设置环境变量。
+tags:
+  - Logto
+  - 身份验证
+  - LobeChat
+  - 单点登录
+  - OIDC
+---
+
+# 配置 Logto 身份验证
+
+[Logto](https://logto.io/) 是一个开源的 Auth0 替代方案，专为现代应用和 SaaS 产品设计。
+
+<Steps>
+  ### 在 Logto 中创建应用
+
+  1. 登录 Logto 控制台
+  2. 前往 **Applications**，点击 **Create application**
+  3. 选择 **Traditional web** 作为应用类型
+  4. 填写应用名称：`LobeChat`
+  5. 配置重定向 URI：
+
+  <Callout type={'info'}>
+    **回调 URL 格式**: `https://your-domain.com/api/auth/callback/logto`
+  </Callout>
+
+  6. 创建后，记下 **App ID** 和 **App Secret**
+
+  ### 获取 Issuer URL
+
+  Issuer URL 是 Logto 端点，通常为：
+
+  - 云版：`https://your-tenant.logto.app/oidc`
+  - 自托管：`https://your-logto-domain/oidc`
+
+  ### 配置环境变量
+
+  在部署 LobeChat 时，你需要配置以下环境变量：
+
+  | 环境变量                             | 类型 | 描述                                                        |
+  | -------------------------------- | -- | --------------------------------------------------------- |
+  | `AUTH_SECRET`                    | 必选 | 用于加密会话令牌的密钥。使用以下命令生成：`openssl rand -base64 32`            |
+  | `AUTH_SSO_PROVIDERS`             | 必选 | SSO 提供商。使用 Logto 请填写 `logto`                              |
+  | `AUTH_LOGTO_ID`                  | 必选 | Logto 应用的 App ID                                          |
+  | `AUTH_LOGTO_SECRET`              | 必选 | Logto 应用的 App Secret                                      |
+  | `AUTH_LOGTO_ISSUER`              | 必选 | Logto Issuer URL（例如 `https://your-tenant.logto.app/oidc`） |
+
+  <Callout type={'tip'}>
+    前往 [📘 环境变量](/zh/docs/self-hosting/environment-variables/auth#logto) 可查阅相关变量详情。
+  </Callout>
+</Steps>
+
+<Callout type={'info'}>部署成功后，用户将可以通过 Logto 身份认证并使用 LobeChat。</Callout>
+
+## 相关资源
+
+- [Logto 文档](https://docs.logto.io/)
+- [Logto 应用设置](https://docs.logto.io/docs/recipes/integrate-logto/)