Public (no auth)

Public is the default mode. The dashboard and all /api/v1/* routes are open to anyone who can reach the server.

Setup

No configuration needed — this is the default when CHM_AUTH_PROVIDER is unset.

CHM_AUTH_PROVIDER=none   # or omit entirely

If you also set CHM_API_KEY_SECRET, the API key layer activates — /api/v1/* requires a chm_ token (or an exempt public path such as /api/v1/auth/cli). See API keys.

CLI auth discovery. chm auth login calls public GET /api/v1/auth/cli. With auth=none and no CHM_API_KEY_SECRET, discovery returns method=none (no login needed). With a signing secret and device login still off (the self-hosted default), discovery returns method=api_key.

CLI device login defaults to off in self-hosted (CHM_DEVICE_LOGIN=auto). That matches an internal-network design: mint one key with the signing secret, or leave the API open without a secret. To opt into browser device flow for chm auth login on a trusted LAN (discovery then returns method=device):

CHM_API_KEY_SECRET=a-long-random-string
CHM_DEVICE_LOGIN=true

When to use

Public mode fits environments where every visitor is already trusted:

• Local development
• Internal network with no external exposure
• Read-only dashboards where the data is not sensitive

Avoid public mode for:

• Any public-internet deployment where you want to restrict access
• Dashboards showing sensitive query data or credentials
• Multi-user setups where you need per-user audit trails

Troubleshooting

To add browser authentication, switch to another provider:

To lock down programmatic access only (keep the dashboard open), set CHM_API_KEY_SECRET and issue chm_ tokens to authorized callers. See API keys.

Related