Basic authentication
HTTP basic authentication requires a username and password before Caddy forwards a request to an application. Coolify can generate the required Caddy label and a bcrypt or supported Argon2id hash for standard applications.
HTTP basic authentication protects a route with one shared credential. It does not replace application accounts, role-based access, multi-factor authentication, or single sign-on.
Protect a resource
Choose the path that matches how the resource is deployed.
Automatic
Open the application settings
Open the application, select General, then find Security > Authentication.
Add the credentials
Choose HTTP Basic Authentication in Authentication, then enter a Username and Password. Save the application settings.
Coolify hashes the password and adds a caddy_<index>.basicauth.<username> label for each generated Caddy route.
Redeploy and verify
Redeploy the application. Open its domain in a private browser window and confirm that the browser requests the new credentials before loading the application.
Manual
Generate credentials
Generate a bcrypt hash with the Caddy CLI:
caddy hash-password --plaintext '<password>'Add the label
Open the application General page, find Container labels, then set Label management to Managed manually (edit labels yourself). Add one basicauth label matching the index Coolify already generated for you domain:
caddy_0.basicauth.<username>="<bcrypt-hash>"
caddy_0.encode=zstd gzip
caddy_0.handle.0_reverse_proxy={{upstreams 3000}}
caddy_0.handle=/*
caddy_0.header=-Server
caddy_0.try_files={path} /index.html /index.php
caddy_0=https://domain.com
caddy_ingress_network=coolifyRedeploy and verify
Redeploy the application. Open its domain in a private browser window and confirm that the browser requests the new credentials before loading the application.
Choose password hashing
For a standard application, open General > Security > Authentication, enable HTTP Basic Authentication, and find Password hashing.
| Setting | Default | Supported values |
|---|---|---|
| Algorithm | bcrypt | bcrypt, or argon2id with Caddy 2.11 or newer. |
| Cost for bcrypt | 10 | 4 to 14. |
| Memory for Argon2id | 65536 KiB (64 MiB) | API range: 8192 to 262144 KiB. The dashboard offers presets. |
| Iterations for Argon2id | 4 | 1 to 12. |
Argon2id is available only when Coolify detects a compatible Caddy proxy. Upgrade Caddy if the option is unavailable. When Coolify also generates Traefik labels, those labels use bcrypt even if Caddy uses Argon2id.
Higher costs use more server CPU or memory when checking credentials. Change the settings deliberately, save, redeploy the application, and verify authentication and request performance. Compose applications and services still require manually configured authentication labels.
The API fields are http_basic_auth_hash_algorithm, http_basic_auth_bcrypt_cost, http_basic_auth_argon2id_memory_cost, and http_basic_auth_argon2id_time_cost. Memory is expressed in KiB.