/usr/bin/yopass-server

Usage: yopass-server [flags]

Flags:
      --address string                         listen address (default 0.0.0.0)
      --allow-custom-expiration[=true|false]   allow user-entered expiration durations within configured bounds
      --argon2[=true|false]                    use Argon2 for password key derivation when encrypting new secrets
      --asset-path string                      path to the assets folder (default "public")
      --cleanup-interval int                   file cleanup interval in seconds (default 60)
      --cors-allow-origin string               Access-Control-Allow-Origin (default "*")
      --database string                        database backend ('memcached' or 'redis') (default "memcached")
      --default-expiry string                  default expiry [1h, 1d, 1w]; custom durations require --allow-custom-expiration (default "1h")
      --default-onetime-secrets[=true|false]   check one-time download by default on the text and file forms (force-onetime-secrets takes precedence) (default true)
      --disable-features[=true|false]          disable features
      --disable-file-cleanup[=true|false]      disable the file store cleanup goroutine (use when S3 lifecycle rules handle expiration)
      --disable-one-click-link[=true|false]    hide the combined one-click link in the UI
      --disable-upload[=true|false]            disable the /file upload endpoints
      --file-store string                      file store backend for large files ('disk' or 's3'), defaults to database storage
      --file-store-path string                 base path for disk file store (default "/tmp/yopass-files")
      --file-store-s3-bucket string            S3 bucket name for file store
      --file-store-s3-endpoint string          S3 endpoint URL (for MinIO/compatible)
      --file-store-s3-prefix string            S3 key prefix for file store (default "yopass/")
      --file-store-s3-region string            S3 region (default "us-east-1")
      --file-transfer-timeout duration         maximum duration for streaming file uploads and downloads; include a unit, e.g. 30s, 5m, or 1h (0 uses request-timeout) (default 5m0s)
      --force-expiration string                force secrets, uploads, and requests to this duration; custom durations require --allow-custom-expiration
      --force-onetime-secrets[=true|false]     reject non onetime secrets from being created
      --health-check[=true|false]              Perform health check and exit
      --imprint-url string                     URL to imprint/legal notice page
      --log-level Level                        Log level (default info)
      --max-expiration string                  maximum custom expiration (integer s, m, h, d, w units) (default "90d")
      --max-length int                         max length of encrypted secret (default 10000)
      --memcached string                       memcached address (default "localhost:11211")
      --metrics-port int                       metrics server listen port (default -1)
      --min-expiration string                  minimum custom expiration (integer s, m, h, d, w units) (default "1m")
      --no-language-switcher[=true|false]      disable the language switcher in the UI
      --no-theme-switcher[=true|false]         hide the theme switcher and always use the light theme
      --port int                               listen port (default 1337)
      --prefetch-secret[=true|false]           Display information that the secret might be one time use (default true)
      --privacy-notice-url string              URL to privacy notice page
      --public-url string                      base URL of the public/read-only instance used in generated secret links (e.g. https://secrets.example.com)
      --read-only[=true|false]                 disable all secret creation endpoints (retrieval-only mode)
      --redis string                           Redis URL; add ?master_name=<name> to connect through Redis Sentinel (default "redis://localhost:6379/0")
      --request-timeout duration               maximum duration for non-file request reads and response writes; include a unit, e.g. 30s, 5m, or 1h (0 disables) (default 30s)
      --tls-cert string                        path to TLS certificate
      --tls-key string                         path to TLS key
      --trusted-proxies strings                trusted proxy IP addresses or CIDR blocks for X-Forwarded-For header validation

Business License — Authentication / OIDC (requires --license-key):
      --api-token strings                          static bearer token granting machine clients access to the --require-auth gated creation endpoints, formatted as name:secret (comma-separated for multiple; generate secrets with: openssl rand -hex 32)
      --frontend-url string                        frontend base URL for post-login redirect in split deployments (e.g. http://localhost:3000)
      --oidc-allowed-domains strings               restrict OIDC logins and authenticated access to these email domains (comma-separated, e.g. corp.example.com,example.com)
      --oidc-client-id string                      OIDC OAuth2 client ID
      --oidc-client-secret string                  OIDC OAuth2 client secret
      --oidc-issuer string                         OIDC issuer URL (e.g. https://accounts.google.com)
      --oidc-redirect-url string                   OIDC callback URL (e.g. https://yopass.example.com/auth/callback)
      --oidc-require-verified-email[=true|false]   require email_verified=true for OIDC logins; disable only when the provider controls email assertions and application access (default true)
      --oidc-session-key string                    64-byte hex-encoded session key for multi-instance deployments (generate with: openssl rand -hex 64)
      --require-auth[=true|false]                  require authentication to create secrets (needs --oidc-issuer and a valid license)

Business License — Branding & Theming (requires --license-key):
      --app-name string              Custom application name shown in the UI (default: Yopass)
      --hide-app-name[=true|false]   Hide the application name in the navbar, keeping the logo and browser tab title
      --license-key string           JWT license key for premium features (theming, custom branding)
      --logo-url string              URL to a logo image (e.g. /mylogo.svg for a file in the public directory)
      --max-file-size string         max file upload size (e.g. 10KB, 512KB, 1MB); capped at 1MB without a license key (default "512KB")
      --theme-custom-dark string     JSON object of CSS variables for a custom dark theme (e.g. '{"--color-primary":"oklch(...)"}')
      --theme-custom-light string    JSON object of CSS variables for a custom light theme (e.g. '{"--color-primary":"oklch(...)"}')
      --theme-dark string            DaisyUI theme name for dark mode (default "dim")
      --theme-light string           DaisyUI theme name for light mode (default "emerald")

Business License — Audit Logging (requires --license-key):
      --audit-log[=true|false]   enable structured audit logging to NDJSON (requires valid license)
      --audit-log-file string    file path for audit log output (default: stdout)

Business License — Secret Requests (requires --license-key):
      --disable-secret-requests[=true|false]   disable the secret request feature (enabled by default with a valid license)
      --max-request-note-length int            max characters in the optional, unencrypted note on a secret request (0 disables notes, max 10000) (default 1000)

Business License — Webhooks & Read Receipts (requires --license-key):
      --default-read-receipt[=true|false]    check read receipt by default on the text and file forms when read receipts are enabled
      --disable-read-receipts[=true|false]   disable the read receipt feature (enabled by default with a valid license)
      --webhook-secret string                HMAC-SHA256 key used to sign webhook payloads (X-Yopass-Signature header)
      --webhook-url string                   URL receiving webhook notifications for secret and request lifecycle events (created, viewed, fulfilled, expired); requires a valid license