How to set config that web auto page log out very soon

[liHai001]

Local deployment, it seems auto log out very soon when user has no behavior, how to set config that can auto log out for couple of days by default. Thanks

[newelski]

To adjust the auto‑logout (idle session expiration) in LibreChat, you can configure two environment variables:

• SESSION_EXPIRY: how long the session cookie remains valid (in milliseconds).
• REFRESH_TOKEN_EXPIRY: how long the refresh token remains valid (in milliseconds).

By default:

• SESSION_EXPIRY = 1000 * 60 * 15 (15 minutes → 900000)
• REFRESH_TOKEN_EXPIRY = (1000 * 60 * 60 * 24) * 7 (7 days → 604800000)

---

1. Using Docker Compose

If you’re deploying with Docker Compose, update your service definition for api in your docker-compose.yml (or supply a separate .env file):

services:
  api:
    # ... other settings ...
    env_file:
      - .env       # or define environment inline
    environment:
      # Session cookie valid for 2 days
      - SESSION_EXPIRY=172800000
      # Refresh token valid for 14 days
      - REFRESH_TOKEN_EXPIRY=1209600000

Then create or update a .env in the same folder:

# Session cookie valid for 2 days (2*24*60*60*1000)
SESSION_EXPIRY=172800000

# Refresh token valid for 14 days (14*24*60*60*1000)
REFRESH_TOKEN_EXPIRY=1209600000

After saving, restart your stack:

docker compose down
docker compose up -d

Your sessions will now remain active for up to 2 days of inactivity (until the cookie expires), and refresh tokens for 14 days.

---

2. Using NPM / Local Development

If you’re running LibreChat locally via NPM:

1. In your project root, create or edit a file named .env.

2. Add the timeout variables:

   # 2 days
   SESSION_EXPIRY=172800000
   # 14 days
   REFRESH_TOKEN_EXPIRY=1209600000

3. Restart backend and frontend:

   npm run backend
   npm run frontend

---

3. Handling Secure Cookies (HTTP vs HTTPS)

In production mode, LibreChat issues Secure cookies by default. Browsers will only send these over HTTPS. If you access your instance via plain HTTP (e.g. http://your-ip:3000), the secure cookie won’t be transmitted, causing immediate logouts.

• Solution A: Terminate TLS at a reverse proxy (Nginx, Caddy, Traefik) and serve over HTTPS.

• Solution B: For local testing without TLS, run the backend in development mode (cookies won’t be marked Secure):

  NODE_ENV=development npm run backend

• Solution C (Docker Override): In docker-compose.override.yml:

  services:
    api:
      command: npm run backend:dev

For details on this behavior, see the Automatic Logout discussion: [#3001] ([github.com](#3001))

---

4. Reference

Detailed documentation on session and token expiration can be found in the official LibreChat docs:

Session Expiry and Refresh Token
Default values: session expiry = 15 min, refresh token expiry = 7 days.
• SESSION_EXPIRY (ms)
• REFRESH_TOKEN_EXPIRY (ms)

https://www.librechat.ai/docs/configuration/authentication#session-expiry-and-refresh-token (librechat.ai)