berry-13 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026
diff --git a/content/docs/configuration/authentication/OAuth2-OIDC/auth0.mdx b/content/docs/configuration/authentication/OAuth2-OIDC/auth0.mdx
@@ -123,12 +123,18 @@ OPENID_SCOPE=openid profile email offline_access
 # IMPORTANT: Your Auth0 API identifier (from Step 3)
 OPENID_AUDIENCE=https://api.librechat.ai
 
+# Sent as the audience on refresh-token requests so refreshed tokens keep it
+OPENID_REFRESH_AUDIENCE=https://api.librechat.ai
+
 # Security Settings (recommended)
 OPENID_USE_PKCE=true
 
 # Session Configuration (generate a secure random string)
 OPENID_SESSION_SECRET=your-secure-session-secret-32-chars-or-more
 
+# Required for the OpenID login button to appear
+ALLOW_SOCIAL_LOGIN=true
+
 # Maximum logout URL length before using logout_hint instead of id_token_hint (default: 2000)
 # OPENID_MAX_LOGOUT_URL_LENGTH=2000
 
@@ -179,6 +185,12 @@ When `OPENID_AUDIENCE` is configured:
       'The identifier of your Auth0 API. Required when using OPENID_REUSE_TOKENS=true with Auth0 to prevent opaque token issues. Comma-separated values are accepted for JWT validation; authorization requests use the first non-empty value.',
       'OPENID_AUDIENCE=https://api.librechat.ai',
     ],
+    [
+      'OPENID_REFRESH_AUDIENCE',
+      'string',
+      'Optional audience sent on refresh-token requests. Usually the same value as OPENID_AUDIENCE. Set it when Auth0 returns tokens for a different audience (or opaque tokens) after a refresh.',
+      'OPENID_REFRESH_AUDIENCE=https://api.librechat.ai',
+    ],
   ]}
 />
 
@@ -193,6 +205,7 @@ When `OPENID_AUDIENCE` is configured:
 1. Ensure `OPENID_AUDIENCE` is set to your Auth0 API identifier
 2. Verify the API was created in Auth0 and offline access is enabled
 3. Check that the audience value matches exactly
+4. Set `OPENID_REFRESH_AUDIENCE` to the same API identifier so refreshed access tokens keep the audience
 
 ### Invalid Token Errors
 

diff --git a/content/docs/configuration/authentication/OAuth2-OIDC/aws.mdx b/content/docs/configuration/authentication/OAuth2-OIDC/aws.mdx
@@ -108,6 +108,9 @@ OPENID_SESSION_SECRET=Any random string
 OPENID_SCOPE=openid profile email
 OPENID_CALLBACK_URL=/oauth/openid/callback
 
+# Required for the OpenID login button to appear
+ALLOW_SOCIAL_LOGIN=true
+
 # Optional: redirects the user to the end session endpoint after logging out
 OPENID_USE_END_SESSION_ENDPOINT=true
 # Maximum logout URL length before using logout_hint instead of id_token_hint (default: 2000)

diff --git a/content/docs/configuration/authentication/OAuth2-OIDC/index.mdx b/content/docs/configuration/authentication/OAuth2-OIDC/index.mdx
@@ -50,6 +50,18 @@ If you encounter issues with OpenID Connect authentication:
 5. **Validate Tokens**: Ensure your provider is issuing valid tokens with the expected claims
 6. **Ensure _nonce_ is generated**: Some identity providers generate `nonce` url parameter if it's missing in the request. Set `OPENID_GENERATE_NONCE=true` to force the openid-client to generate it.
 
+### Discovery Retries
+
+If your identity provider is unreachable when LibreChat starts, OpenID discovery can be retried. `OPENID_DISCOVERY_RETRY_ATTEMPTS` sets the number of attempts made before startup continues (0 to 100, default 1; `0` retries only in the background), and `OPENID_DISCOVERY_RETRY_DELAY_MS` sets the delay between attempts (default 5000). Values set under `registration.openidDiscovery` in `librechat.yaml` take precedence. See [registration](/docs/configuration/librechat_yaml/object_structure/registration) for those keys and for `oauthStateTtlMs`, which controls how long a started social login may take to reach its callback (default 10 minutes).
+
+### Profile Avatar Origins
+
+When fetching the user's profile avatar, LibreChat sends the access token only to the provider's issuer and userinfo origins. If the avatar is served from another origin that requires the token, add it to `OPENID_AVATAR_AUTHORIZED_ORIGINS` as a comma- or space-separated list of URLs.
+
+```bash filename=".env"
+OPENID_AVATAR_AUTHORIZED_ORIGINS=https://graph.example.com,https://photos.example.com
+```
+
 ### Admin Panel Redirects
 
 If the Admin Panel is hosted on a separate URL from LibreChat, set [`ADMIN_PANEL_URL`](/docs/features/admin_panel#librechat-redirect-url) in the LibreChat API environment. This tells LibreChat where to send admins after the admin OAuth or SSO callback completes.
diff --git a/content/docs/configuration/authentication/OAuth2-OIDC/keycloak.mdx b/content/docs/configuration/authentication/OAuth2-OIDC/keycloak.mdx
@@ -65,6 +65,9 @@ If you want to restrict access to users with specific roles, you can define role
   OPENID_REQUIRED_ROLE_TOKEN_KIND=(access|id) # that means, `access` or `id`
   OPENID_REQUIRED_ROLE_PARAMETER_PATH="realm_access.roles"
 
+  # Required for the OpenID login button to appear
+  ALLOW_SOCIAL_LOGIN=true
+
   # Optional: redirects the user to the end session endpoint after logging out
   OPENID_USE_END_SESSION_ENDPOINT=true
 

diff --git a/content/docs/configuration/authentication/OAuth2-OIDC/token-reuse.mdx b/content/docs/configuration/authentication/OAuth2-OIDC/token-reuse.mdx
@@ -111,10 +111,11 @@ OPENID_REUSE_MAX_SESSION_AGE_MS=900000  # 15 minutes in milliseconds
 
 # Required for Auth0 (use your API identifier)
 # OPENID_AUDIENCE=https://api.librechat.com
+# OPENID_REFRESH_AUDIENCE=https://api.librechat.com
 
 # Caching Configuration
 OPENID_JWKS_URL_CACHE_ENABLED=true
-OPENID_JWKS_URL_CACHE_TIME=600000  # 10 minutes in milliseconds
+OPENID_JWKS_URL_CACHE_TIME=600000  # 10 minutes in milliseconds (default: 60000, 1 minute)
 
 # Azure-specific Configuration
 OPENID_ON_BEHALF_FLOW_FOR_USERINFO_REQUIRED=true
@@ -132,10 +133,11 @@ OPENID_USE_END_SESSION_ENDPOINT=true
 ## Additional Configuration Options
 
 - `OPENID_AUDIENCE`: Audience value for JWT validation and authorization requests. **Required for Auth0** to receive JWT access tokens instead of opaque tokens. Comma-separated values are accepted for JWT validation; authorization requests use the first non-empty value.
+- `OPENID_REFRESH_AUDIENCE`: Optional audience sent on refresh-token requests, usually the same value as `OPENID_AUDIENCE`. Needed by providers such as Auth0 when a custom API must keep its audience across refreshes.
 - `OPENID_REUSE_MAX_SESSION_AGE_MS`: Maximum age a reused OpenID session token is served before LibreChat forces an IdP refresh (default: 900000 ms / 15 minutes). Accepts arithmetic expressions like `60 * 60 * 24 * 1000`. Increase it toward your IdP access-token lifetime if your provider revokes the previous access token whenever it refreshes.
 - `OPENID_REFRESH_BRIDGE_GRACE_MS`: Short recovery window for a rotated refresh token while LibreChat publishes the refreshed session (default: 60000 ms / 1 minute). It accepts arithmetic expressions. Increase it only when slow session persistence or cross-replica publication needs more time.
-- `OPENID_JWKS_URL_CACHE_ENABLED`: Enables caching of signing key verification results to prevent excessive HTTP requests to the JWKS endpoint
-- `OPENID_JWKS_URL_CACHE_TIME`: Cache duration in milliseconds (default: 600000 ms / 10 minutes)
+- `OPENID_JWKS_URL_CACHE_ENABLED`: Caches signing keys to prevent excessive HTTP requests to the JWKS endpoint. Caching is enabled when this is unset; any value other than `true` disables it.
+- `OPENID_JWKS_URL_CACHE_TIME`: Cache duration in milliseconds (default: 60000 ms / 1 minute)
 - `OPENID_ON_BEHALF_FLOW_FOR_USERINFO_REQUIRED`: Enables on-behalf-of flow for user info (Azure-specific)
 - `OPENID_ON_BEHALF_FLOW_USERINFO_SCOPE`: Scope for user info in on-behalf-of flow (Azure-specific)
 - `GRAPH_API_SCOPES`: Space-separated Microsoft Graph scopes requested when resolving `{{LIBRECHAT_GRAPH_ACCESS_TOKEN}}` in a YAML-defined MCP server. Defaults to `https://graph.microsoft.com/.default`; this is separate from the `OPENID_GRAPH_SCOPES` used for people and group search.

diff --git a/content/docs/configuration/authentication/ldap.mdx b/content/docs/configuration/authentication/ldap.mdx
@@ -72,7 +72,7 @@ and configure LibreChat to request login via username:
   options={[
     [
       'LDAP_LOGIN_USES_USERNAME',
-      'string',
+      'boolean',
       'Use username instead of email.',
       'LDAP_LOGIN_USES_USERNAME=true',
     ],
@@ -81,10 +81,15 @@ and configure LibreChat to request login via username:
 
 **Active Directory over SSL**
 
-To connect via SSL (ldaps://), such as a company using Windows AD, specify the path to the internal CA certificate.
-`LDAP_TLS_REJECT_UNAUTHORIZED` is optional;if not specified LibreChat will reject TLS/SSL connections if the LDAP server's certificate cannot be verified.
-set `LDAP_TLS_REJECT_UNAUTHORIZED` to false (not recommended for production environments)
-to allow Librechat to accept TLS/SSL connections even if the LDAP server's certificate cannot be verified,
+To connect via SSL (ldaps://), such as a company using Windows AD, specify the path to the internal CA certificate with `LDAP_CA_CERT_PATH`.
+
+`LDAP_TLS_REJECT_UNAUTHORIZED` is only applied when `LDAP_CA_CERT_PATH` is set. In that case, certificate verification is **off** unless you explicitly set `LDAP_TLS_REJECT_UNAUTHORIZED=true`. When `LDAP_CA_CERT_PATH` is not set, LibreChat passes no TLS options and the default Node.js behavior applies (the server certificate is checked against the system trust store).
+
+<Callout type="warning" title="Enable certificate verification">
+  If you set `LDAP_CA_CERT_PATH` without `LDAP_TLS_REJECT_UNAUTHORIZED=true`, LibreChat trusts any
+  certificate presented by the LDAP server, which exposes bind credentials and user passwords to
+  man-in-the-middle attacks. Always set `LDAP_TLS_REJECT_UNAUTHORIZED=true` in production.
+</Callout>
 
 <OptionTable
   options={[
@@ -96,8 +101,8 @@ to allow Librechat to accept TLS/SSL connections even if the LDAP server's certi
     ],
     [
       'LDAP_TLS_REJECT_UNAUTHORIZED',
-      'string',
-      'Disable TLS verification',
+      'boolean',
+      'Verify the LDAP server certificate against LDAP_CA_CERT_PATH. Must be true to enable verification; ignored when LDAP_CA_CERT_PATH is not set.',
       'LDAP_TLS_REJECT_UNAUTHORIZED=true',
     ],
   ]}
@@ -111,7 +116,7 @@ Enabling LDAP StartTLS allows LibreChat to upgrade an insecure connection to a s
     options={[
         [
             'LDAP_STARTTLS',
-            'string',
+            'boolean',
             'Enable LDAP StartTLS for upgrading the connection to TLS. Set to true to enable this feature.',
             'LDAP_STARTTLS=true',
         ],

diff --git a/content/docs/configuration/banner.mdx b/content/docs/configuration/banner.mdx
@@ -23,6 +23,12 @@ Run this command to create or update a banner:
 npm run update-banner
 ```
 
+With Docker, run the script inside the `api` container instead:
+
+```bash
+docker compose exec api npm run update-banner
+```
+
 You'll be guided through a few simple prompts:
 
 ```ansi
@@ -47,9 +53,9 @@ Is persistable (cannot be dismissed) (y/N):
 ```
 
 <Callout type="tip" title="What do these options mean?">
-  - **Display From/To**: When the banner should appear and disappear. Leave empty for "now" and "forever"
+  - **Display From/To**: When the banner should appear and disappear. Press Enter at the prompt to use "now" and "forever"
   - **Is public**: Show to visitors who aren't logged in (like on the login page)
-  - **Is persistable**: If yes, users can't dismiss the banner — use for important notices
+  - **Is persistable**: If yes, users can't dismiss the banner (use it for important notices)
 </Callout>
 
 <Callout type="warning" title="Running this again replaces the existing banner">
@@ -68,8 +74,16 @@ To change a banner, run `update-banner` again. To take one down before its `Disp
 npm run delete-banner
 ```
 
+With Docker, run `docker compose exec api npm run delete-banner`.
+
 You'll see the current banner and be asked to confirm before deleting.
 
+<Callout type="warning" title="Only an active banner can be deleted">
+
+`delete-banner` only finds a banner that is currently active: its `Display From` time must have passed, and its `Display To` time must be in the future or not set. A banner scheduled for a later date, or one whose `Display To` has already passed, is reported as "No banner found to delete" and stays in the database. To replace such a banner, run `update-banner` again.
+
+</Callout>
+
 Removing a banner this way is also how you take one down early: there is no "disable" flag. A banner otherwise disappears on its own once `Display To` passes, and one saved with no `Display To` stays up until you delete it.
 
 ---
@@ -100,6 +114,12 @@ Removing a banner this way is also how you take one down early: there is no "dis
   </Tabs.Tab>
 </Tabs>
 
+<Callout type="info" title="Empty date arguments still prompt">
+
+An empty string (`""`) for a date is treated as missing, so the script still asks for `Display From` and `Display To` interactively. Press Enter at each prompt to accept the default, or pass ISO dates (`yyyy-mm-ddTHH:MM:SSZ`) as the first two arguments to run the command without prompts. The message argument is also required to skip the message prompt, and the `isPublic` and `persistable` arguments must be given as `true` or `false` to skip theirs.
+
+</Callout>
+
 ---
 
 ## Date Format
@@ -110,4 +130,4 @@ Use this format for dates: `yyyy-mm-ddTHH:MM:SSZ`
 - `2025-12-25T09:00:00Z` → December 25, 2025 at 9:00 AM (UTC)
 - `2025-01-01T00:00:00Z` → January 1, 2025 at midnight (UTC)
 
-Leave the date empty to use the current time or no end date.
+When prompted, press Enter without typing a date to use the current time for `Display From`, or no end date for `Display To`.
diff --git a/content/docs/configuration/cdn/azure.mdx b/content/docs/configuration/cdn/azure.mdx
@@ -76,7 +76,7 @@ AZURE_CONTAINER_NAME=files
 
 - **AZURE_STORAGE_CONNECTION_STRING:** Set this if you are using Option A.
 - **AZURE_STORAGE_ACCOUNT_NAME:** Set this if you are using Option B (Managed Identity). Do not set both.
-- **AZURE_STORAGE_PUBLIC_ACCESS:** Set to `false` if you do not want your blobs to be publicly accessible by default. Set to `true` if you need public access (for example, for publicly viewable images).
+- **AZURE_STORAGE_PUBLIC_ACCESS:** Defaults to `true` when unset, which creates the container with public blob access. Set to `false` if you do not want your blobs to be publicly accessible, which is recommended unless you need public access (for example, for publicly viewable images).
 - **AZURE_CONTAINER_NAME:** This is the container name your application will use (e.g., `files`). The application will automatically create this container if it doesn’t exist.
 
 ## 4. Configure LibreChat to Use Azure Blob Storage
@@ -90,7 +90,7 @@ fileStrategy: "azure_blob"
 ```
 
 <Callout type="warning" title="Azure Blob Storage is object storage, not a CDN">
-  Azure Blob Storage stores and serves files directly from origin — it is not a CDN. Images and avatars are best served through a CDN for optimal performance and global delivery. Currently, [Firebase](/docs/configuration/cdn/firebase) is the only CDN-backed storage option.
+  Azure Blob Storage stores and serves files directly from origin, so it is not a CDN. Images and avatars are best served through a CDN for optimal performance and global delivery. [CloudFront](/docs/configuration/cdn/cloudfront) (S3-backed) and [Firebase](/docs/configuration/cdn/firebase) are the CDN-backed storage options.
 
   You can use `fileStrategies` to route only avatars and images to Firebase while keeping documents on Azure Blob Storage:
 

diff --git a/content/docs/configuration/cdn/s3.mdx b/content/docs/configuration/cdn/s3.mdx
@@ -104,7 +104,7 @@ AWS_ENDPOINT_URL=https://your_endpoint_url
 - **AWS_BUCKET_NAME:** The name of the S3 bucket you created.
 - **AWS_ENDPOINT_URL:** (Optional) The custom AWS endpoint URL. Required for S3-compatible services such as MinIO, Cloudflare R2, Hetzner Object Storage, Backblaze B2, and IDrive e2. Include the URL scheme, such as `https://a7g8.da.idrivee2-32.com`; values without `http://` or `https://` can cause an `Invalid URL` error when files are streamed.
 - **AWS_FORCE_PATH_STYLE:** (Optional) Set to `true` for providers that require path-style URLs (`endpoint/bucket/key`) rather than virtual-hosted-style (`bucket.endpoint/key`). Required for Hetzner Object Storage, MinIO, and similar providers whose SSL certificates don't cover bucket subdomains. Not needed for AWS S3 or Cloudflare R2. Default: `false`.
-- **S3_URL_EXPIRY_SECONDS:** (Optional) Lifetime of each presigned URL, in seconds. See the note on presigned URLs below for the provider-side caps that apply.
+- **S3_URL_EXPIRY_SECONDS:** (Optional) Lifetime of each presigned URL, in seconds. Default: 120 (2 minutes). Values above 604800 (7 days) are capped at 7 days, and an invalid or non-positive value falls back to 120. See the note on presigned URLs below for the provider-side caps that apply.
 - **S3_REFRESH_EXPIRY_MS:** (Optional) Regenerate a presigned URL once it reaches this age, in milliseconds, instead of using the default expiry-buffer logic. Unset by default. A value that is not a positive integer is ignored with a warning in the logs.
 
 If you are using **IRSA** on Kubernetes, you do **not** need to set `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` in your environment. The AWS SDK will automatically obtain temporary credentials via the service account assigned to your pod. Ensure that `AWS_REGION` and `AWS_BUCKET_NAME` are still provided.
@@ -133,6 +133,8 @@ fileStrategies:
   document: 's3'
 ```
 
+`fileStrategies` also accepts `default` (the fallback for any type without its own entry) and `skills` (skill files). See [fileStrategies](/docs/configuration/librechat_yaml/object_structure/config#filestrategies) for all keys.
+
 </Callout>
 
 ## Summary

diff --git a/content/docs/configuration/index.mdx b/content/docs/configuration/index.mdx
@@ -4,7 +4,7 @@ icon: BookOpen
 description: How LibreChat's configuration files work together and how to apply changes
 ---
 
-LibreChat uses four main configuration files. Each controls a different aspect of the application -- from environment variables to custom AI endpoints to Docker service overrides.
+LibreChat uses four main configuration files. Each controls a different aspect of the application, from environment variables to custom AI endpoints to Docker service overrides.
 
 ## Common Change Workflow
 
@@ -29,13 +29,13 @@ For example, to enable OpenRouter you add `OPENROUTER_KEY` to `.env`, add an Ope
   </FileTree.Folder>
 </FileTree>
 
-**`.env`** -- Server-level settings: API keys, database connection strings, feature flags, and authentication secrets. This is the primary configuration file for most deployments. See the [.env reference](/docs/configuration/dotenv) for all available variables.
+**`.env`**: Server-level settings: API keys, database connection strings, feature flags, and authentication secrets. This is the primary configuration file for most deployments. See the [.env reference](/docs/configuration/dotenv) for all available variables.
 
-**`librechat.yaml`** -- Custom AI endpoints, model settings, interface options, and advanced features like MCP servers and agents. This file is optional -- LibreChat works with defaults if it does not exist. See the [librechat.yaml guide](/docs/configuration/librechat_yaml) for setup instructions.
+**`librechat.yaml`**: Custom AI endpoints, model settings, interface options, and advanced features like MCP servers and agents. This file is optional. LibreChat works with defaults if it does not exist. See the [librechat.yaml guide](/docs/configuration/librechat_yaml) for setup instructions.
 
-**`docker-compose.yml`** -- Defines the Docker services (API server, database, search). Do not edit this file directly -- use an override file instead so your changes survive updates.
+**`docker-compose.yml`**: Defines the Docker services (`api`, `admin-panel`, `mongodb`, `meilisearch`, `vectordb`, and `rag_api`). Do not edit this file directly. Use an override file instead so your changes survive updates.
 
-**`docker-compose.override.yml`** -- Your local customizations to Docker services: volume mounts, port mappings, environment overrides. Docker Compose merges this with the main file automatically. See the [Docker override guide](/docs/configuration/docker_override).
+**`docker-compose.override.yml`**: Your local customizations to Docker services: volume mounts, port mappings, environment overrides. Docker Compose merges this with the main file automatically. See the [Docker override guide](/docs/configuration/docker_override).
 
 ## Applying Changes