Community Guides
Bypass Rules
Community bypass rules for common self hosted apps
This table compiles paths that need to be allowed for various apps to work with Pangolin authentication.
| App | Required Bypass Rules |
|---|---|
| Media Management | |
| Radarr | /api/* |
| Sonarr | /api/* |
| Lidarr | /api/* |
| Media Servers | |
| Jellyfin (iOS) | /system/info/public |
| Jellyfin (Roku) | /System/Info/Public/Users/AuthenticateByName/Users/Public/QuickConnect/Initiate/QuickConnect/Connect/Users/AuthenticateWithQuickConnect/Branding/Configuration |
| Audiobookshelf | Audiobookshelf also supports /audiobookshelf by default. Each rule should also be applied to this path./api/*/login/auth/*/feed/*/socket.io//status/logout/ping/public/*The following is needed for public shares and is optional for clients: /share/*/_nuxt/*.js/_nuxt/fonts/* |
| Management & Monitoring | |
| Tautulli | /api/* |
| Harbour | /api/* |
| Hoarder App | /api/* |
| Uptime Kuma Manager | /api/*/socket.io/* |
| Beszel | /api/beszel/agent-connect |
| MeshCentral | /api/*/meshrelay.ashx/agent.ashx |
| Security & Privacy | |
| AdGuard Home | /api/* |
| Ente Auth | *api* |
| Vaultwarden/Bitwarden | /api/*/identity/*/wl/*/notifications/hub required for websocket notifications enabled by default since v1.29.0 of Vaultwarden /icons/* For proper loading of Favicons (Optional) Always Deny - Path - /admin/* |
| Cloud & Sync | |
| Nextcloud | / (Main interface)/index.php/* (Core handler)/remote.php (Remote access)/status.php (Status checks)/ocs (Collaboration Services API)/apps/* (Applications)/remote.php/webdav/* (WebDAV endpoint)/remote.php/dav/* (CalDAV/CardDAV)/remote.php/caldav/* (Calendar sync)/remote.php/carddav/* (Contacts sync)/ocs/v1.php/* (API endpoints)/ocs/v2.php/* (API v2 endpoints)/login (Authentication)/.well-known/* (Service discovery)/.well-known/webfinger (WebFinger protocol)/s/* (Shared files/folders)/heartbeat (Session keep-alive)/ocs-provider/* (OCS capability discovery)/ocm-provider/* (Federated sharing discovery)/push/* (notify_push real-time notifications) |
| Onlyoffice | /cache/**/CommandService.ashx*/converter/**/doc/**/downloadas/*/downloadfile/**/fonts/*/healthcheck/methodology/**/plugins.json*/sdkjs/**/sdkjs-plugins/**/themes.json*/web-apps/* |
| Photo Management | |
| Ente Photos | *api* |
| Immich | /api/*/.well-known/immich |
| File Management | |
| Filebrowser | /static/*/share/* /api/public/dl/* /api/public/share/* |
| Notes & Knowledge Management | |
| Docmost | /share/*/api/*/assets/index*/*/icons/favicons-*Always Deny - Path - /login/* (optional) |
| Joplin Notes Server | /api/*/shares/*/css/*/images/*Always Deny - Path - /login/* (optional) |
| Erugo | /api/*/shares/*/build/*/get-logo |
| Memos | /api/*/assets/*/explore*/memos.api.v1.*/auth/callback*/auth/site.webmanifest/logo.webp/full-logo.webp/android-chrome-192x192.png |
| Linkding | /api/*/bookmarks/*Always Deny - Path - /admin/* |
| Communication | |
| Matrix/Synapse (Clients) | /_matrix/*/_synapse/client/* |
| Matrix/Synapse (Federation) | /_matrix/* |
| Notifications | |
| Gotify | /version/message/application/client/stream/plugin/health |
| Home Automation | |
| Home Assistant | /api/*/auth/*/frontend_latest/*/lovelace/*/static/*/hacsfiles/*/local/*/manifest.json/sw-modern.js |
| n8n | /webhook-test/*/webhook/webhook/*/webhook |
| Project Management | |
| Jetbrains Youtrack | /api/*/hub/api/* |
| Genealogy | |
| Gramps Web | /api/* |
| Analytics | |
| Liwan | /script.js/api/send |
| Umami | /script.js/api/send |
These rules are examples and may need to be adjusted based on your specific app configuration and version.
Was this page helpful?