From f0844f5cf107c222eacfd51d5b37be0c96b93dd5 Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Fri, 7 Aug 2026 15:38:36 -0700
Subject: [PATCH] Update index.md

---
 docs/installation/index.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/installation/index.md b/docs/installation/index.md
index 5b52ed3ff..053d5cf73 100644
--- a/docs/installation/index.md
+++ b/docs/installation/index.md
@@ -39,6 +39,10 @@ If you are seeing errors about host validation, check the homepage logs and ensu
 
 This can be disabled by setting `HOMEPAGE_ALLOWED_HOSTS` to `*` but this is not recommended. Public deployments must rely on a reverse proxy (and/or VPN) that enforces authentication, TLS, and unexpected Host headers; the built-in host check is a best-effort guard for local setups and is not a substitute for edge protections.
 
+!!! note
+
+    The NextAuth routes (`/api/auth/*`) and sign-in pages (`/auth/*`) are exempt from this check so that authentication continues to work, they do not access the API proxy.
+
 ### Security & Authentication
 
 Public deployments of Homepage should be secured via a reverse proxy, VPN, or similar. As of version 2.0, Homepage supports a simple authorization gate with a password or OIDC. When enabled, Homepage will use password login by default unless OIDC variables are provided.