docs: external authentication, RBAC, SSO

[mendonk]

• RBAC and SSO documentation
• Some refactoring of docs now that more options are available (add overview, combine JWT page with builtin Langflow page)
• Add keycloak example

Some additional changes for 1.11:

• More information on rate limiting
• Grant Langflow permission to manage Kubernetes Secrets

Summary by CodeRabbit

• Documentation
  • Added new guidance for authentication and authorization, including built-in auth, external auth, RBAC, JWT signing, login limits, signup settings, and security-related environment variables.
  • Added deployment notes for multi-worker rate limits and Kubernetes-based storage for global variables.
  • Expanded documentation with setup examples and API references for authorization and external authentication.
• Chores
  • Reorganized the docs sidebar and updated a redirect so the authentication docs are easier to find.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6a035a46-240c-4fe8-8940-89b4360aa283

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The PR adds and reorganizes documentation for authentication, authorization, external authentication, and JWT signing, updates sidebar and redirect navigation, adds a Kubernetes Secrets section for global variables, and documents rate-limit counter storage in multi-worker deployments.

Changes

Authentication documentation and navigation

Layer / File(s)	Summary
Navigation and overview entrypoints docs/docs/Develop/authentication-overview.mdx, docs/sidebars.js, docs/docusaurus.config.js	Adds a new authentication overview page, groups authentication docs under a sidebar category, and redirects /jwt-authentication to /api-keys-and-authentication.
Built-in auth and token signing docs/docs/Develop/api-keys-and-authentication.mdx, docs/docs/Deployment/deployment-multi-worker.mdx	Expands built-in authentication docs with signup, SSRF, rate limiting, JWT signing, token expiration, and multi-worker rate-limit counter storage guidance.
External authentication flow docs/docs/Develop/external-authentication.mdx	Adds the external authentication page with Keycloak setup, environment variables, JIT claim mapping, access ceilings, identity resolution, and deployment examples.
Authorization reference and enablement docs/docs/Develop/authorization.mdx	Adds the authorization page with RBAC behavior, environment variables, system roles, API reference, and enablement steps.

Global variables storage

Layer / File(s)	Summary
Kubernetes Secret storage docs/docs/Develop/configuration-global-variables.mdx	Adds Kubernetes Secret storage for global variables with RBAC setup, Deployment wiring, and verification steps.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• langflow-ai/langflow#13386: Updates the same multi-worker deployment doc with Redis-backed queue configuration, which overlaps with the new rate-limit counter storage note.

Suggested labels

documentation

Suggested reviewers

• erichare
• phact

🚥 Pre-merge checks | ✅ 9

✅ Passed checks (9 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main documentation changes around external authentication, RBAC, and SSO.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Coverage For New Implementations	✅ Passed	PR only changes docs/redirect/sidebar files; no code paths or test files were added or updated, so test coverage isn’t applicable.
Test Quality And Coverage	✅ Passed	This PR is docs-only; no implementation or test files were added/changed, so the test-quality check is not applicable.
Test File Naming And Structure	✅ Passed	Changed test files use the expected names/directories, and sampled backend/frontend tests have clear, descriptive cases with proper fixtures/setup.
Excessive Mock Usage Warning	✅ Passed	PR changes only docs/config/sidebar pages; no test files were added or modified, so the mock-usage warning is not applicable.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs-rbac-and-sso

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.

[coderabbitai]

Actionable comments posted: 7

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

docs/docs/Develop/api-keys-and-authentication.mdx (1)

758-760: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Remove the auto-authentication claim from the startup step.

This walkthrough sets LANGFLOW_AUTO_LOGIN=False, and the earlier section already says users must sign in when auto-login is off. Saying server startup "automatically authenticates you" conflicts with the next /login steps and makes the flow misleading.

Suggested fix

-Starting Langflow with a `.env` file automatically authenticates you as the superuser set in `LANGFLOW_SUPERUSER` and `LANGFLOW_SUPERUSER_PASSWORD`.
-If you don't explicitly set these variables, the default values are `langflow` and `langflow` for system auto-login.
+Starting Langflow with a `.env` file applies the configured superuser bootstrap credentials.
+When `LANGFLOW_AUTO_LOGIN=False`, you still sign in at `/login` with those credentials.
+If you don't explicitly set these variables, the default values are `langflow` and `langflow`.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/docs/Develop/api-keys-and-authentication.mdx` around lines 758 - 760,
Remove the auto-authentication claim from the startup guidance in the API
keys/authentication docs. In the affected paragraph, adjust the Langflow startup
wording so it no longer says that launching with a .env file automatically
authenticates as the superuser; instead, align it with the
LANGFLOW_AUTO_LOGIN=False flow and the later /login steps. Keep the mention of
LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD only as
credentials/configuration context, not as an automatic login behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/docs/Develop/authentication-overview.mdx`:
- Around line 12-20: The chooser list in authentication-overview is losing its
intended hierarchy because the descriptive paragraphs after each bullet are
flush-left, so they render as standalone paragraphs instead of nested bullet
content. Reformat the text under each bullet in the authentication overview
section so the descriptions stay indented beneath the corresponding items,
keeping the list scannable in MDX. While updating that section, also correct the
wording in the second bullet from “identify provider” to “identity provider.”

In `@docs/docs/Develop/authorization.mdx`:
- Around line 179-184: The “See also” section in the authorization docs still
links to the old JWT page, so update the JWT reference to point to the merged
section under api-keys-and-authentication instead of the legacy
/jwt-authentication URL. Use the existing “See also” list in the
authorization.mdx content to locate the link and make sure any internal docs
links now target the current JWT signing section so they resolve directly
without relying on redirects.

In `@docs/docs/Develop/configuration-global-variables.mdx`:
- Around line 172-173: The Secret naming guidance is inconsistent between the
prose and the example, so update the documentation in the global variables flow
to use the same Secret name convention everywhere. Make the wording in the
section that describes Kubernetes secrets align with the name produced by
encode_user_id(user_id) and the example Secret name used in the steps, so
readers can clearly identify the actual Secret to inspect or create.
- Around line 224-235: The Kubernetes Deployment example is structurally invalid
because `serviceAccountName` and `containers` are shown directly under `spec`
instead of under `spec.template.spec`. Update the YAML snippet in the
configuration docs so the `serviceAccountName` and `LANGFLOW_VARIABLE_STORE`
container environment block are nested inside the Pod spec path used by a
Deployment, and make sure the example is valid and ready to apply as written.
- Around line 254-265: The Secret verification step in the
configuration-global-variables docs is exposing full Secret `.data` values,
which conflicts with the warning and can leak credentials. Update the
verification example to check only the stored keys, using the same Secret name
pattern and context around the UUID lookup, so readers can confirm `credential_`
and generic variable names without printing values. Keep the surrounding
guidance in sync with the warning and the existing explanation of key prefixes.

In `@docs/docs/Develop/external-authentication.mdx`:
- Around line 168-170: The external-authentication guidance is telling readers
to use jwt.io with a live access token, which is unsafe. Update the relevant
wording in the documentation to avoid recommending third-party token paste;
instead, point readers to a local JWT decoder or explicitly instruct them to
inspect only redacted tokens, while keeping the existing `aud`, `iss`, and `exp`
validation guidance in the same section.
- Around line 88-97: The external-auth example is using
langflowai/langflow-nightly:latest without explanation, so update the
walkthrough to either use the stable Langflow image/tag in the documented
current release or add a clear note in the external authentication section
stating that this example requires nightly. Make the change in the docker run
example that follows the external auth settings so readers are not switched to
nightly implicitly.

---

Outside diff comments:
In `@docs/docs/Develop/api-keys-and-authentication.mdx`:
- Around line 758-760: Remove the auto-authentication claim from the startup
guidance in the API keys/authentication docs. In the affected paragraph, adjust
the Langflow startup wording so it no longer says that launching with a .env
file automatically authenticates as the superuser; instead, align it with the
LANGFLOW_AUTO_LOGIN=False flow and the later /login steps. Keep the mention of
LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD only as
credentials/configuration context, not as an automatic login behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 239650c0-0a96-407c-a65a-6fab6aa71a15

📥 Commits

Reviewing files that changed from the base of the PR and between c1c2d59 and 61a64eb.

📒 Files selected for processing (9)

• docs/docs/Deployment/deployment-multi-worker.mdx
• docs/docs/Develop/api-keys-and-authentication.mdx
• docs/docs/Develop/authentication-overview.mdx
• docs/docs/Develop/authorization.mdx
• docs/docs/Develop/configuration-global-variables.mdx
• docs/docs/Develop/external-authentication.mdx
• docs/docs/Develop/jwt-authentication.mdx
• docs/docusaurus.config.js
• docs/sidebars.js

💤 Files with no reviewable changes (1)

• docs/docs/Develop/jwt-authentication.mdx

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Indent the path descriptions under each bullet.

Lines 13, 16, and 19 are flush-left, so MDX renders them as standalone paragraphs instead of part of the chooser list. That breaks the scan pattern here, and Line 15 still says identify provider.

Suggested fix

-* To secure a Langflow server with user accounts and API keys using Langflow's built-in authentication, see [API keys and authentication](./api-keys-and-authentication).
-Built-in authentication is always available and is the default setting. Users log in with a username and password, and Langflow issues a short-lived JWT session token and validates Langflow API keys against its own database.
+* To secure a Langflow server with user accounts and API keys using Langflow's built-in authentication, see [API keys and authentication](./api-keys-and-authentication).
+  Built-in authentication is always available and is the default setting. Users log in with a username and password, and Langflow issues a short-lived JWT session token and validates Langflow API keys against its own database.
 
-* To connect Langflow to your company's SSO, OIDC, or identify provider, see [SSO and external authentication](./external-authentication).
-External authentication lets an upstream identity provider, OIDC proxy, or corporate SSO gateway handle login. Langflow accepts the token the proxy forwards, validates it against the identity provider's JWKS endpoint, and provisions a local user automatically.
+* To connect Langflow to your company's SSO, OIDC, or identity provider, see [SSO and external authentication](./external-authentication).
+  External authentication lets an upstream identity provider, OIDC proxy, or corporate SSO gateway handle login. Langflow accepts the token the proxy forwards, validates it against the identity provider's JWKS endpoint, and provisions a local user automatically.
 
-* To configure RBAC on your Langflow server, see [Authorization](./authorization).
-After a user is authenticated by any of the authentication paths, the authorization layer decides what the user can do.
-RBAC enforcement requires a registered authorization plugin.
+* To configure RBAC on your Langflow server, see [Authorization](./authorization).
+  After a user is authenticated by any of the authentication paths, the authorization layer decides what the user can do.
+  RBAC enforcement requires a registered authorization plugin.

As per coding guidelines, "keep paragraphs short and scannable."

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	* To secure a Langflow server with user accounts and API keys using Langflow's built-in authentication, see [API keys and authentication](./api-keys-and-authentication).
	Built-in authentication is always available and is the default setting. Users log in with a username and password, and Langflow issues a short-lived JWT session token and validates Langflow API keys against its own database.
	* To connect Langflow to your company's SSO, OIDC, or identify provider, see [SSO and external authentication](./external-authentication).
	External authentication lets an upstream identity provider, OIDC proxy, or corporate SSO gateway handle login. Langflow accepts the token the proxy forwards, validates it against the identity provider's JWKS endpoint, and provisions a local user automatically.
	* To configure RBAC on your Langflow server, see [Authorization](./authorization).
	After a user is authenticated by any of the authentication paths, the authorization layer decides what the user can do.
	RBAC enforcement requires a registered authorization plugin.
	* To secure a Langflow server with user accounts and API keys using Langflow's built-in authentication, see [API keys and authentication](./api-keys-and-authentication).
	Built-in authentication is always available and is the default setting. Users log in with a username and password, and Langflow issues a short-lived JWT session token and validates Langflow API keys against its own database.
	* To connect Langflow to your company's SSO, OIDC, or identity provider, see [SSO and external authentication](./external-authentication).
	External authentication lets an upstream identity provider, OIDC proxy, or corporate SSO gateway handle login. Langflow accepts the token the proxy forwards, validates it against the identity provider's JWKS endpoint, and provisions a local user automatically.
	* To configure RBAC on your Langflow server, see [Authorization](./authorization).
	After a user is authenticated by any of the authentication paths, the authorization layer decides what the user can do.
	RBAC enforcement requires a registered authorization plugin.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/docs/Develop/authentication-overview.mdx` around lines 12 - 20, The
chooser list in authentication-overview is losing its intended hierarchy because
the descriptive paragraphs after each bullet are flush-left, so they render as
standalone paragraphs instead of nested bullet content. Reformat the text under
each bullet in the authentication overview section so the descriptions stay
indented beneath the corresponding items, keeping the list scannable in MDX.
While updating that section, also correct the wording in the second bullet from
“identify provider” to “identity provider.”

Source: Coding guidelines

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Link current docs directly to the merged JWT section.

This page still points readers to /jwt-authentication, even though this PR moved JWT signing docs into api-keys-and-authentication. Using the current section URL avoids sending readers through a legacy redirect.

Suggested fix

-- [JWT authentication](/jwt-authentication)
+- [Configure JWT token signing](/api-keys-and-authentication#configure-jwt-token-signing)

As per coding guidelines, "Test internal links to ensure they are functional and reference the correct pages."

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	## See also
	- [API keys and authentication](/api-keys-and-authentication)
	- [External authentication](./external-authentication)
	- [JWT authentication](/jwt-authentication)
	- [Security](/security)
	## See also
	- [API keys and authentication](/api-keys-and-authentication)
	- [External authentication](./external-authentication)
	- [Configure JWT token signing](/api-keys-and-authentication#configure-jwt-token-signing)
	- [Security](/security)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/docs/Develop/authorization.mdx` around lines 179 - 184, The “See also”
section in the authorization docs still links to the old JWT page, so update the
JWT reference to point to the merged section under api-keys-and-authentication
instead of the legacy /jwt-authentication URL. Use the existing “See also” list
in the authorization.mdx content to locate the link and make sure any internal
docs links now target the current JWT signing section so they resolve directly
without relying on redirects.

Source: Coding guidelines

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Make the Secret name guidance consistent.

The prose says the Secret is named after the user's UUID, but the example uses uuid-YOUR_USER_ID, and the implementation derives the name via encode_user_id(user_id). That mismatch makes step 6/7 ambiguous about which Secret name readers should actually expect.

Also applies to: 252-257

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/docs/Develop/configuration-global-variables.mdx` around lines 172 - 173,
The Secret naming guidance is inconsistent between the prose and the example, so
update the documentation in the global variables flow to use the same Secret
name convention everywhere. Make the wording in the section that describes
Kubernetes secrets align with the name produced by encode_user_id(user_id) and
the example Secret name used in the steps, so readers can clearly identify the
actual Secret to inspect or create.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major

Correct the YAML structure for Kubernetes Deployment

The provided YAML fragment incorrectly places serviceAccountName and containers directly under spec. In a valid Kubernetes Deployment manifest, these fields must reside under spec.template.spec (the Pod spec). Placing them at the spec level will result in an invalid resource definition or failure to apply.

Suggested fix

spec:
  template:
    spec:
      serviceAccountName: langflow
      containers:
        - name: langflow
          image: langflowai/langflow:latest
          env:
            - name: LANGFLOW_VARIABLE_STORE
              value: "kubernetes"

Ensure all code examples are valid and ready for immediate use by the reader.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/docs/Develop/configuration-global-variables.mdx` around lines 224 - 235,
The Kubernetes Deployment example is structurally invalid because
`serviceAccountName` and `containers` are shown directly under `spec` instead of
under `spec.template.spec`. Update the YAML snippet in the configuration docs so
the `serviceAccountName` and `LANGFLOW_VARIABLE_STORE` container environment
block are nested inside the Pod spec path used by a Deployment, and make sure
the example is valid and ready to apply as written.

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Do not tell readers to print Secret .data here.

Line 257 dumps every stored Secret value, just base64-encoded, which conflicts with the warning in Lines 263-264 and unnecessarily exposes credentials during verification. If the goal is only to confirm the keys, show a key-only command instead.

Suggested fix

- kubectl get secret uuid-YOUR_USER_ID -n langflow -o jsonpath='{.data}' | python3 -m json.tool
+ kubectl get secret uuid-YOUR_USER_ID -n langflow -o go-template='{{range $k, $v := .data}}{{printf "%s\n" $k}}{{end}}'

As per coding guidelines, "Verify all code examples are tested and working before committing documentation."

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	7. Inspect the Secret's keys to confirm your variable was stored, replacing **YOUR_USER_ID** with the user's UUID:
	```bash
	kubectl get secret uuid-YOUR_USER_ID -n langflow -o jsonpath='{.data}' | python3 -m json.tool
	```
	Credential-type variables appear with a `credential_` prefix.
	Generic-type variables use the variable name directly as the key.
	:::warning
	Do not read or modify Secret values directly with `kubectl`. Editing Secrets outside of Langflow can cause variables to become unreadable.
	:::
	7. Inspect the Secret's keys to confirm your variable was stored, replacing **YOUR_USER_ID** with the user's UUID:

🧰 Tools

🪛 LanguageTool

[style] ~264-~264: This phrase is redundant. Consider using “outside”.
Context: ...irectly with kubectl. Editing Secrets outside of Langflow can cause variables to become ...

(OUTSIDE_OF)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/docs/Develop/configuration-global-variables.mdx` around lines 254 - 265,
The Secret verification step in the configuration-global-variables docs is
exposing full Secret `.data` values, which conflicts with the warning and can
leak credentials. Update the verification example to check only the stored keys,
using the same Secret name pattern and context around the UUID lookup, so
readers can confirm `credential_` and generic variable names without printing
values. Keep the surrounding guidance in sync with the warning and the existing
explanation of key prefixes.

Source: Coding guidelines

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Avoid switching readers onto nightly without saying why.

This walkthrough is the only auth example here that pulls langflowai/langflow-nightly:latest. If external auth is documented for the current release, this should stay on the stable image/tag; otherwise the page needs an explicit note that the example requires nightly.

Suggested fix

-    langflowai/langflow-nightly:latest
+    langflowai/langflow:latest

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	docker run -d --name langflow \
	--network container:keycloak \
	-e LANGFLOW_AUTO_LOGIN=False \
	-e LANGFLOW_EXTERNAL_AUTH_ENABLED=true \
	-e LANGFLOW_EXTERNAL_AUTH_PROVIDER=keycloak \
	-e LANGFLOW_EXTERNAL_AUTH_TOKEN_HEADER=Authorization \
	-e LANGFLOW_EXTERNAL_AUTH_JWKS_URL=http://127.0.0.1:8080/realms/langflow/protocol/openid-connect/certs \
	-e LANGFLOW_EXTERNAL_AUTH_ISSUER=http://localhost:8080/realms/langflow \
	-e LANGFLOW_EXTERNAL_AUTH_AUDIENCE=langflow-app \
	langflowai/langflow-nightly:latest
	docker run -d --name langflow \
	--network container:keycloak \
	-e LANGFLOW_AUTO_LOGIN=False \
	-e LANGFLOW_EXTERNAL_AUTH_ENABLED=true \
	-e LANGFLOW_EXTERNAL_AUTH_PROVIDER=keycloak \
	-e LANGFLOW_EXTERNAL_AUTH_TOKEN_HEADER=Authorization \
	-e LANGFLOW_EXTERNAL_AUTH_JWKS_URL=http://127.0.0.1:8080/realms/langflow/protocol/openid-connect/certs \
	-e LANGFLOW_EXTERNAL_AUTH_ISSUER=http://localhost:8080/realms/langflow \
	-e LANGFLOW_EXTERNAL_AUTH_AUDIENCE=langflow-app \
	langflowai/langflow:latest

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/docs/Develop/external-authentication.mdx` around lines 88 - 97, The
external-auth example is using langflowai/langflow-nightly:latest without
explanation, so update the walkthrough to either use the stable Langflow
image/tag in the documented current release or add a clear note in the external
authentication section stating that this example requires nightly. Make the
change in the docker run example that follows the external auth settings so
readers are not switched to nightly implicitly.

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Don't tell readers to paste a live access token into a third-party site.

The token in this flow is usable against Langflow. Recommend a local decoder, or explicitly tell readers to inspect only redacted tokens instead.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/docs/Develop/external-authentication.mdx` around lines 168 - 170, The
external-authentication guidance is telling readers to use jwt.io with a live
access token, which is unsafe. Update the relevant wording in the documentation
to avoid recommending third-party token paste; instead, point readers to a local
JWT decoder or explicitly instruct them to inspect only redacted tokens, while
keeping the existing `aud`, `iss`, and `exp` validation guidance in the same
section.

[github-actions]

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft