# Open Notebook Authentication Options: Password-Based vs OAuth Support

> Explore Open Notebook authentication options. Currently, only password-based auth is supported via OPEN_NOTEBOOK_PASSWORD. Discover limitations and future possibilities.

- Repository: [Luis Novo/open-notebook](https://github.com/lfnovo/open-notebook)
- Tags: how-to-guide
- Published: 2026-06-27

---

**Open Notebook currently supports only password-based authentication via the `OPEN_NOTEBOOK_PASSWORD` environment variable, with no OAuth 2.0 or JWT implementation available.**

Open Notebook is a FastAPI-based open-source application that provides a lightweight authentication mechanism for API access. As of the latest version in the `lfnovo/open-notebook` repository, the system relies exclusively on a simple password protection scheme rather than modern token-based flows. Understanding these authentication options is essential for securing self-hosted deployments of this notebook automation platform.

## How Password Authentication Works in Open Notebook

The authentication system in Open Notebook is intentionally minimalist, checking for a single environment variable at startup to determine whether protection is active.

### Configuration via Environment Variables

When the API server initializes, it searches for the **`OPEN_NOTEBOOK_PASSWORD`** environment variable or a Docker secret file specified by **`OPEN_NOTEBOOK_PASSWORD_FILE`**. The helper function `get_secret_from_env` in [`open_notebook/utils/encryption.py`](https://github.com/lfnovo/open-notebook/blob/main/open_notebook/utils/encryption.py) handles this lookup, checking both standard environment variables and mounted secret files. If either source contains a value, the API marks authentication as enabled for all subsequent requests.

### The Authentication Status Endpoint

The FastAPI router in [`api/routers/auth.py`](https://github.com/lfnovo/open-notebook/blob/main/api/routers/auth.py) exposes a single meta-endpoint for checking authentication state. The `GET /auth/status` route returns a JSON object indicating whether protection is active:

```python
@router.get("/status")
async def get_auth_status():
    auth_enabled = bool(get_secret_from_env("OPEN_NOTEBOOK_PASSWORD"))
    return {
        "auth_enabled": auth_enabled,
        "message": "Authentication is required" if auth_enabled else "Authentication is disabled",
    }

```

This endpoint allows client applications to detect whether they must supply credentials before accessing protected resources.

## OAuth Support Status in Open Notebook

Despite queries about OAuth integration, **Open Notebook does not implement OAuth 2.0, JWT tokens, or any third-party identity providers**. A search through the codebase reveals only a placeholder comment in [`api/credentials_service.py`](https://github.com/lfnovo/open-notebook/blob/main/api/credentials_service.py) regarding Vertex AI's OAuth2 requirements for model discovery, but no actual authentication middleware or token verification logic exists. The absence of OAuth-related routers in `api/routers/` confirms that password-based protection remains the sole authentication method available.

## Securing Your Open Notebook Deployment

Implementing password protection requires setting the environment variable before launching the containerized service.

### Enabling Password Protection

To require authentication for all API endpoints, set the `OPEN_NOTEBOOK_PASSWORD` variable in your Docker Compose configuration:

```yaml
services:
  api:
    image: lfnovo/open-notebook:latest
    environment:
      - OPEN_NOTEBOOK_PASSWORD=SuperSecret123
    ports:
      - "5055:5055"

```

### Verifying Authentication Status

You can verify whether authentication is enabled by querying the status endpoint:

```bash
curl http://localhost:5055/auth/status

```

When a password is configured, the response returns:

```json
{"auth_enabled":true,"message":"Authentication is required"}

```

### Running Without Authentication

To disable authentication entirely and allow unrestricted API access, simply omit the `OPEN_NOTEBOOK_PASSWORD` variable:

```bash
docker run -p 5055:5055 lfnovo/open-notebook

```

This configuration runs the API freely without any credential checks, suitable for trusted local networks or development environments.

## Summary

- Open Notebook supports **only password-based authentication** via the `OPEN_NOTEBOOK_PASSWORD` environment variable or Docker secrets.
- The `GET /auth/status` endpoint in [`api/routers/auth.py`](https://github.com/lfnovo/open-notebook/blob/main/api/routers/auth.py) reports whether authentication is enabled.
- **OAuth 2.0 and JWT are not implemented** in the current codebase, with only a placeholder reference in [`api/credentials_service.py`](https://github.com/lfnovo/open-notebook/blob/main/api/credentials_service.py).
- If no password variable is set, the API runs completely open without authentication checks.
- The secret resolution logic resides in [`open_notebook/utils/encryption.py`](https://github.com/lfnovo/open-notebook/blob/main/open_notebook/utils/encryption.py) via the `get_secret_from_env` helper.

## Frequently Asked Questions

### Does Open Notebook support OAuth 2.0 authentication?

No, Open Notebook does not support OAuth 2.0 or JWT token authentication. The codebase contains only a placeholder comment in [`api/credentials_service.py`](https://github.com/lfnovo/open-notebook/blob/main/api/credentials_service.py) regarding Vertex AI OAuth requirements, but no actual OAuth flow implementation exists for API users. The only supported method is password-based protection using environment variables.

### How do I enable password protection in Open Notebook?

Set the `OPEN_NOTEBOOK_PASSWORD` environment variable before starting the service, or mount a Docker secret file and reference it via `OPEN_NOTEBOOK_PASSWORD_FILE`. The application automatically detects this variable through the `get_secret_from_env` function and enables authentication across the API.

### What happens if I don't set the OPEN_NOTEBOOK_PASSWORD variable?

If the environment variable is omitted, the API initializes with authentication disabled and runs without any credential requirements. The `GET /auth/status` endpoint will return `{"auth_enabled": false}`, indicating that the API is accessible without passwords.

### Where is the authentication logic implemented in the source code?

The authentication status endpoint is implemented in [`api/routers/auth.py`](https://github.com/lfnovo/open-notebook/blob/main/api/routers/auth.py), which imports the secret resolution helper from [`open_notebook/utils/encryption.py`](https://github.com/lfnovo/open-notebook/blob/main/open_notebook/utils/encryption.py). This utility function checks for both standard environment variables and Docker secret files to determine whether password protection should be active.