Authorization modes

Hosted via Brokerr

Hosted OAuth is the recommended mode for AniList and TMDB and the only current Letterboxd mode. The central gateway keeps provider application secrets; the self-hosted instance receives the authorized user’s token bundle through a short-lived authenticated handoff.

Hosted mode does not give the gateway access to the Brokerr database, profiles, Plex libraries, or target sync data. It handles authorization and supported token refresh only.

Direct / custom

AniList and TMDB can use operator-owned provider application credentials. Those secrets and tokens are encrypted in the local Brokerr database. The redirect URI and provider app registration are the operator’s responsibility.

Custom fields are shown only when Direct/custom is selected. Disconnecting the account removes user credentials but preserves custom application settings so the instance can be reauthorized.

Plex connection

Plex is a source and uses a Plex PIN/account flow rather than the hosted Brokerr OAuth gateway. The resulting Plex token is encrypted locally and used for server discovery, selected server access, account watchlist, and optional account history.

Disconnect and refresh

Disconnect removes the account credential set and identity from the provider instance. Profiles remain configured but cannot run until reconnection.

Letterboxd access tokens are automatically refreshed through the hosted gateway when approaching expiry or after an eligible authorization failure. AniList and TMDB credentials do not use the same hosted refresh flow.