PerfLoad Multiuser New

One PerfLoad server, many people — each with their own private workspace. By default PerfLoad is open and single-user: anyone who can reach the server can use it. Multiuser mode adds sign-in, so a team can share one self-hosted PerfLoad and each person only sees their own runs, comparisons, reports, saved projects and API keys.

Single-user vs Multiuser

	Single-user (default)	Multiuser
Sign-in	None — open to anyone who can reach the server	Required: local email/password, OpenID Connect, or both
Whose data	Everything is shared	Each user only sees their own runs, comparisons, reports, projects and API keys
Saved projects	Stored in the browser	Stored per user on the server
API and MCP access	No token needed	Per-user API keys (`Authorization: Bearer pl_…`)
Administrators	n/a	Add and manage accounts, but cannot read other users' tests or results
Best for	A private machine or one person	A team, or any server others can reach

Nothing changes unless you turn it on. Existing Docker installs keep working as single-user, and you can switch authentication off again to restore the original behavior — your data volume stays compatible.

Sign-in options

Local email and password — an administrator adds people, and each receives a one-time link to choose a password. Self-registration is off by default.
OpenID Connect (SSO) — Google, Microsoft Entra ID, Okta, Keycloak, Auth0, or any standards-compliant provider. You supply your own identity-provider credentials; there is no central PerfLoad sign-in service.

Turn it on

Set environment variables on the container. The first administrator is required:

docker run -d --name perfload \
  -p 3000:3000 \
  -v perfload-runs:/app/runs \
  -e PERFLOAD_AUTH_ENABLED=true \
  -e PERFLOAD_AUTH_PROVIDERS=local \
  -e PERFLOAD_ADMIN_EMAIL=you@example.com \
  perfload/perfload-runner:latest

No password is set on the command line or logged. PerfLoad writes a one-time token to .admin-setup-token in the data volume. Read it with docker exec perfload cat /app/runs/.admin-setup-token, open /login.html, choose I have a setup or invitation link, paste the token and choose a password. The token works once.

Existing runs are assigned to the administrator the first time you enable authentication and stay private to them.

Key settings

Variable	Meaning
`PERFLOAD_AUTH_ENABLED`	Default `false`. Set `true` to turn Multiuser on.
`PERFLOAD_AUTH_PROVIDERS`	`local`, `oidc` or `local,oidc`
`PERFLOAD_ADMIN_EMAIL`	Required. The first administrator; owns any existing data.
`PERFLOAD_ALLOW_REGISTRATION`	Default `false`. Admins can toggle it on the Users page.
`PERFLOAD_SESSION_TIMEOUT`	Session length in seconds. Default `86400`.
`OIDC_ISSUER`, `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET`, `OIDC_REDIRECT_URI`	From your identity provider, when using SSO.

API keys for scripts, CI and AI tools

Signed-in users create personal API keys from Account & API keys in the account menu (optionally with an expiry). A key is shown once, only reaches its owner's data, and can be revoked at any time. These keys also work as tokens for PerfLoad MCP.

curl -H "Authorization: Bearer $PERFLOAD_API_KEY" http://localhost:3000/runs

Running it behind HTTPS

For anything beyond a private machine, put PerfLoad behind a reverse proxy with HTTPS and set PERFLOAD_TRUST_PROXY=true. See the installation guide for running PerfLoad with Docker.