v1.5.2
← Back to Releases

v1.5.2

September 25, 2026

The v1.5.2 release builds on the single sign-on introduced in v1.5.0. A self-hosted instance can now turn email and password sign-in off entirely, so people get in only through the Google, Apple, or OpenID Connect provider you configure. User management then stays at your identity provider. Nothing changes unless you set the new option, and there are no database migrations. Upgrading is a straight image bump.

Provider-only sign-in #

Set ECONUMO_PASSWORD_LOGIN=false and Econumo stops accepting passwords. The sign-in and sign-up pages show only the provider buttons, without the or continue with divider. Settings no longer offers Change password or Set a password. The server also refuses these requests directly, so an old bookmark or API call can’t get around it. That covers password sign-in and registration, Forgot password, setting a password, and changing it.

Some things keep working with passwords off:

  • existing sessions
  • personal access tokens
  • the CLI
  • provider sign-in

ECONUMO_ALLOW_REGISTRATION keeps its meaning, but now it applies to providers only:

  • ECONUMO_PASSWORD_LOGIN=false + ECONUMO_ALLOW_REGISTRATION=true: anyone who can sign in at your provider gets an account on their first sign-in. This is “sign up through my SSO only”.
  • ECONUMO_PASSWORD_LOGIN=false + ECONUMO_ALLOW_REGISTRATION=false: only accounts that already exist can sign in.

Move existing users over before you flip the switch. Econumo never links a provider automatically to an account that has a password. With passwords off, that account can’t sign in to link one either. The server also refuses to start with ECONUMO_PASSWORD_LOGIN=false unless at least one provider is configured.

To switch an instance with existing password accounts over:

  1. Configure at least one provider (Google, Apple, or OIDC) and restart. Follow the OIDC setup guide.
  2. Have every existing user sign in with their password. Each user then links a provider under Settings → Profile → Sign-in methods.
  3. Set ECONUMO_PASSWORD_LOGIN=false and restart.

Someone who missed step 2 sees “An account with this email address already exists and can’t be linked automatically. Contact your administrator.” To let them in, turn ECONUMO_PASSWORD_LOGIN back on for a moment so they can link a provider, then turn it off again. Accounts created with the user:create command always have a password, so they need the same treatment. With passwords off, let new people sign up through the provider instead.

Note While passwords are off, a stored password no longer counts as a way to sign in. Settings won’t let you unlink an account’s last provider, even if the account also has a password.

More in this release #

  • The new messages for provider-only sign-in, including Password sign-in is disabled and the hint on an account’s last sign-in method, are translated into all 11 languages.

GitHub release #