bryanwills · pull · Aug 6, 2026 · Aug 6, 2026 · Aug 6, 2026 · Aug 4, 2026
diff --git a/bookmarks/settings/dev.py b/bookmarks/settings/dev.py
@@ -19,9 +19,6 @@
     "127.0.0.1",
 ]
 
-# Allow access through ngrok
-CSRF_TRUSTED_ORIGINS = ["https://*.ngrok-free.app"]
-
 STATICFILES_DIRS = [
     # Resolve theme files from style source folder
     os.path.join(BASE_DIR, "bookmarks", "styles"),

diff --git a/docs/astro.config.mjs b/docs/astro.config.mjs
@@ -45,7 +45,6 @@ export default defineConfig({
           label: "Resources",
           items: [
             { label: "Community", slug: "community" },
-            { label: "Acknowledgements", slug: "acknowledgements" },
           ],
         },
       ],

diff --git a/docs/src/content/docs/acknowledgements.md b/docs/src/content/docs/acknowledgements.md
diff --git a/docs/src/content/docs/community.md b/docs/src/content/docs/community.md
@@ -67,3 +67,10 @@ This section lists community projects around using linkding. If you have a proje
 | [linkding-api](https://github.com/vbsampath/linkding-api) | A Javascript library implementing linkding REST API. | [vbsampath](https://github.com/vbsampath) |
 | [linkding-rs](https://github.com/zbrox/linkding-rs) | A Rust client library to interact with the linkding REST API with cross platform support to be easily used in Android or iOS apps. | [zbrox](https://github.com/zbrox) |
 
+## Self-Hosting Guides
+
+| Name | Description | Author |
+| ---- | ----------- | ------ |
+| [linkding on fly.io](https://github.com/fspoettel/linkding-on-fly) | Guide for hosting a linkding installation on [fly.io](https://fly.io). | [fspoettel](https://github.com/fspoettel) |
+| [linkding on railway.app](https://github.com/tianheg/linkding-on-railway) | Guide for hosting a linkding installation on [railway.app](https://railway.app/). | [tianheg](https://github.com/tianheg) |
+
diff --git a/docs/src/content/docs/managed-hosting.md b/docs/src/content/docs/managed-hosting.md
@@ -3,19 +3,14 @@ title: "Managed Hosting"
 description: "Managed hosting options for linkding"
 ---
 
-Self-hosting web applications still requires a lot of technical know-how and commitment to maintenance, in order to keep everything up-to-date and secure. This section is intended to provide simple alternatives in form of managed hosting solutions.
+This section lists third-party services and platforms for hosting linkding, split by how much of the operation and maintenance they take care of for you.
 
-## Fully Managed
+A _managed service_ is the least technical option where the provider essentially just runs the app for you in a manner that you would expect any online app to work: you just register, start using the app, get automatic updates when available. _Hosting platforms_ are more generic in that they allow deploying arbitrary apps, which have a built-in template for linkding that makes that process easier for less technical users. Application updates require a manual redeployment, and managing the app might involve more technical details.
 
-The following services provide fully managed hosting for linkding, including automatic updates and backups:
+| Provider                                                                                                                                              | Type             | Updates   | Backups                                    | Regions |
+|-------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|-----------|--------------------------------------------|---------|
+| [PikaPods.com](https://www.pikapods.com/) <br> [1-click setup](https://www.pikapods.com/pods?run=linkding) | Managed service  | Automatic | Automated backups to S3 compatible buckets | EU, US  |
+| [CloudBreak](https://cloudbreak.app/products/linkding/)                                                                                               | Managed service  | Automatic  | Unknown                                    | US      |
+| [Hostim.dev](https://hostim.dev/) <br> [1-click setup](https://console.hostim.dev/dashboard?preview=1&modal=1&template=linkding)                                                                                                               | Hosting platform | Manual    | Custom through SSH access                  | EU      |
 
-- [PikaPods.com](https://www.pikapods.com/) - Managed hosting for linkding, EU and US regions available. [1-click setup link](https://www.pikapods.com/pods?run=linkding) ([Disclosure](/acknowledgements#pikapods))
-- [CloudBreak](https://cloudbreak.app/products/linkding/?utm_medium=referral&utm_source=linkding-docs&utm_content=managed-hosting&rby=linkding-docs-managed-hosting) - Managed hosting for linkding, US regions available.
-
-## Self-Managed
-
-The following guides provide instructions for hosting a linkding installation on various platforms, however you are still responsible for updates and backups:
-
-- [linkding on fly.io](https://github.com/fspoettel/linkding-on-fly) - Guide for hosting a linkding installation on [fly.io](https://fly.io). By [fspoettel](https://github.com/fspoettel)
-- [CapRover](https://caprover.com/) - Linkding is included as a default one-click app
-- [linkding on railway.app](https://github.com/tianheg/linkding-on-railway) - Guide for hosting a linkding installation on [railway.app](https://railway.app/). By [tianheg](https://github.com/tianheg)
+_Disclosure: PikaPods has a revenue sharing agreement with this project, sharing some of their revenue from hosting linkding instances._
diff --git a/docs/src/content/docs/options.md b/docs/src/content/docs/options.md
@@ -117,6 +117,39 @@ For example, for Authelia, which passes the `Remote-User` HTTP header, the `LD_A
 By default, the logout redirects to the login URL, which means the user will be automatically authenticated again.
 Instead, you might want to configure the logout URL of the auth proxy here.
 
+:::note[Using REST API clients]
+
+If you intend to use any API client (e.g. the browser extension, a mobile app, or anything that requires you to configure an API token) you need to bypass the authentication proxy for API requests. These clients can not complete the authentication flow you would use when accessing linkding in the browser and authenticate with an API token instead. You must take care to not over-match your routes when doing this, as API calls are also made in-page by linkding and these should pass through the authentication proxy.
+
+<details>
+
+<summary>Example using Caddy and Authelia</summary>
+
+```
+linkding.example.com {
+  # Requests for /api/* with an API token may skip the authentication proxy.
+  @external_api_call {
+    path /api/*
+    header Authorization *
+  }
+  handle @external_api_call {
+    reverse_proxy linkding:9090
+  }
+
+  # otherwise pass all requests through the authentication proxy.
+  handle {
+    forward_auth authelia:9091 {
+      uri /api/authz/forward-auth
+      copy_headers Remote-User
+    }
+    reverse_proxy linkding:9090
+  }
+}
+```
+
+</details>
+:::
+
 ### `LD_ENABLE_OIDC`
 
 Values: `True`, `False` | Default = `False`

diff --git a/docs/src/content/docs/troubleshooting.md b/docs/src/content/docs/troubleshooting.md
@@ -11,6 +11,14 @@ If the `Host` header is modified by the reverse proxy then this check fails.
 
 To fix this, check the [reverse proxy setup documentation](/installation#reverse-proxy-setup) on how to configure header forwarding for your proxy server, or alternatively configure the  [`LD_CSRF_TRUSTED_ORIGINS` option](/options#ld_csrf_trusted_origins) to the URL from which you are accessing your linkding instance.
 
+## API clients fail to authenticate when using an authentication proxy
+
+When you have enabled authentication proxy support with the [`LD_ENABLE_AUTH_PROXY` option](/options#ld_enable_auth_proxy), API clients such as the browser extension or a mobile app may fail to connect, even though the API token is configured correctly. Depending on your setup, requests may be answered with a redirect to the login page of your auth proxy, or fail with a `401` or `403` error.
+
+The reason is that the auth proxy intercepts requests before they reach linkding, and API clients can not complete the browser-based authentication flow that the proxy expects. They authenticate with an API token instead.
+
+To fix this, configure your reverse proxy to let external API requests bypass the authentication proxy. See the *Using REST API clients* note in the [`LD_ENABLE_AUTH_PROXY` documentation](/options#ld_enable_auth_proxy).
+
 ## Automatically detected title and description are incorrect
 
 linkding automatically fetches the title and description of the web page from the metadata in the HTML `<head>`. By default, this happens on the server, which can return different results than what you see in your browser, for example, if a website uses JavaScript to dynamically change the title or description, or if a website requires login. Alternatively, both the browser extension and the bookmarklet can use the metadata directly from the page you are currently viewing in your browser. Note that for some websites this can give worse results, as not all websites correctly update the metadata in `<head>` while browsing the website (which is why fetching a fresh page on the server is still the default).