Open Notebook Authentication Options: Password-Based vs OAuth Support

Open Notebook currently supports only password-based authentication via the OPEN_NOTEBOOK_PASSWORD environment variable, with no OAuth 2.0 or JWT implementation available.

Open Notebook is a FastAPI-based open-source application that provides a lightweight authentication mechanism for API access. As of the latest version in the lfnovo/open-notebook repository, the system relies exclusively on a simple password protection scheme rather than modern token-based flows. Understanding these authentication options is essential for securing self-hosted deployments of this notebook automation platform.

How Password Authentication Works in Open Notebook

The authentication system in Open Notebook is intentionally minimalist, checking for a single environment variable at startup to determine whether protection is active.

Configuration via Environment Variables

When the API server initializes, it searches for the OPEN_NOTEBOOK_PASSWORD environment variable or a Docker secret file specified by OPEN_NOTEBOOK_PASSWORD_FILE. The helper function get_secret_from_env in open_notebook/utils/encryption.py handles this lookup, checking both standard environment variables and mounted secret files. If either source contains a value, the API marks authentication as enabled for all subsequent requests.

The Authentication Status Endpoint

The FastAPI router in api/routers/auth.py exposes a single meta-endpoint for checking authentication state. The GET /auth/status route returns a JSON object indicating whether protection is active:

@router.get("/status")
async def get_auth_status():
    auth_enabled = bool(get_secret_from_env("OPEN_NOTEBOOK_PASSWORD"))
    return {
        "auth_enabled": auth_enabled,
        "message": "Authentication is required" if auth_enabled else "Authentication is disabled",
    }

This endpoint allows client applications to detect whether they must supply credentials before accessing protected resources.

OAuth Support Status in Open Notebook

Despite queries about OAuth integration, Open Notebook does not implement OAuth 2.0, JWT tokens, or any third-party identity providers. A search through the codebase reveals only a placeholder comment in api/credentials_service.py regarding Vertex AI's OAuth2 requirements for model discovery, but no actual authentication middleware or token verification logic exists. The absence of OAuth-related routers in api/routers/ confirms that password-based protection remains the sole authentication method available.

Securing Your Open Notebook Deployment

Implementing password protection requires setting the environment variable before launching the containerized service.

Enabling Password Protection

To require authentication for all API endpoints, set the OPEN_NOTEBOOK_PASSWORD variable in your Docker Compose configuration:

services:
  api:
    image: lfnovo/open-notebook:latest
    environment:
      - OPEN_NOTEBOOK_PASSWORD=SuperSecret123
    ports:
      - "5055:5055"

Verifying Authentication Status

You can verify whether authentication is enabled by querying the status endpoint:

curl http://localhost:5055/auth/status

When a password is configured, the response returns:

{"auth_enabled":true,"message":"Authentication is required"}

Running Without Authentication

To disable authentication entirely and allow unrestricted API access, simply omit the OPEN_NOTEBOOK_PASSWORD variable:

docker run -p 5055:5055 lfnovo/open-notebook

This configuration runs the API freely without any credential checks, suitable for trusted local networks or development environments.

Summary

• Open Notebook supports only password-based authentication via the OPEN_NOTEBOOK_PASSWORD environment variable or Docker secrets.
• The GET /auth/status endpoint in api/routers/auth.py reports whether authentication is enabled.
• OAuth 2.0 and JWT are not implemented in the current codebase, with only a placeholder reference in api/credentials_service.py.
• If no password variable is set, the API runs completely open without authentication checks.
• The secret resolution logic resides in open_notebook/utils/encryption.py via the get_secret_from_env helper.

Frequently Asked Questions

Does Open Notebook support OAuth 2.0 authentication?

No, Open Notebook does not support OAuth 2.0 or JWT token authentication. The codebase contains only a placeholder comment in api/credentials_service.py regarding Vertex AI OAuth requirements, but no actual OAuth flow implementation exists for API users. The only supported method is password-based protection using environment variables.

How do I enable password protection in Open Notebook?

Set the OPEN_NOTEBOOK_PASSWORD environment variable before starting the service, or mount a Docker secret file and reference it via OPEN_NOTEBOOK_PASSWORD_FILE. The application automatically detects this variable through the get_secret_from_env function and enables authentication across the API.

What happens if I don't set the OPEN_NOTEBOOK_PASSWORD variable?

If the environment variable is omitted, the API initializes with authentication disabled and runs without any credential requirements. The GET /auth/status endpoint will return {"auth_enabled": false}, indicating that the API is accessible without passwords.

Where is the authentication logic implemented in the source code?

The authentication status endpoint is implemented in api/routers/auth.py, which imports the secret resolution helper from open_notebook/utils/encryption.py. This utility function checks for both standard environment variables and Docker secret files to determine whether password protection should be active.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}