# Dashboard authentication with usersFile

**URL:** <https://community.traefik.io/t/dashboard-authentication-with-usersfile/29864>\
**Category:** Traefik v3 (latest)\
**Tags:** middleware, docker\
**Created:** [May 11, 2026, 7:01am UTC](https://community.traefik.io/t/dashboard-authentication-with-usersfile/29864 "2026-05-11T07:01:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![HeSitated](https://avatars.discourse-cdn.com/v4/letter/h/f475e1/32.png) [@HeSitated](https://community.traefik.io/u/HeSitated)\
**Post date:** [May 11, 2026, 7:01am UTC](https://community.traefik.io/t/dashboard-authentication-with-usersfile/29864/1 "2026-05-11T07:01:21Z")

</div>

I've got traefik running and want to use a userFile for authentication.

Without authentication it all works, but as soon as I add the usersFile label, I get the popup to enter my name and the password but that is it....

```dockerfile
services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    environment:
      - CLOUDFLARE_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /etc/localtime:/etc/localtime
      - ./config/traefik.yml:/etc/traefik/traefik.yml:ro
      - ./certs:/etc/traefik/certs
      - ./letsencrypt:/letsencrypt
      - ./config/users:/etc/traefik/users
    labels:
      - "traefik.enable=true"
      # Dashboard route
      - "traefik.http.routers.dashboard.rule=Host(`traefik.mydomain.eu`)"
      - "traefik.http.routers.dashboard.entrypoints=dashboard"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.tls.certresolver=cloudflare"
      - "traefik.http.routers.dashboard.service=api@internal"
# # Basic authentication for dashboard
# - "traefik.http.middlewares.dashboard-auth.basicauth.usersFile=/etc/traefik/users"
# - "traefik.http.routers.dashboard.middlewares=dashboard-auth"

```

My configuration:

```auto
# Global configuration
global:
  checkNewVersion: false
  sendAnonymousUsage: false

# Entry points - the ports Traefik listens on
entryPoints:
  web:
    address: :80
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true
    observability:
      accessLogs: false
      metrics: false
      tracing: false
  dashboard:
    address: ":8080"
  websecure:
    address: ':443'
    http:
      tls:
        certResolver: cloudflare
        domains:
          - main: mydomain.eu
            sans:
              - "*.mydomain.eu"
api:
  dashboard: true # Enable the web dashboard
  insecure: false # Allow dashboard access without authentication (development only!)# Where Traefik finds service information

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock" # Docker socket
    exposedByDefault: false # Only expose services with traefik.enable=true
    network: traefik_proxy # Default network for services# Logging

log:
  level: DEBUG #INFO

certificatesResolvers:
  cloudflare:
    acme:
      storage: /etc/traefik/certs/acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"
        delayBeforeCheck: 60  

```

My userfile (./config/users):

```bash
test:$$2y$$05$$Fvx/6e4DniUe7b60gejbTuhPI1TJx0GOFdiJUX6mnl03D9zX7W6bu

```

So as soon as I uncomment the last 2 lines in the compose.yaml it goes wrong.

What am i doing wrong?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [May 11, 2026, 7:06am UTC](https://community.traefik.io/t/dashboard-authentication-with-usersfile/29864/2 "2026-05-11T07:06:48Z")

</div>

What’s your issue? What "goes wrong"?

Maybe enable Traefik debug log ([doc](https://doc.traefik.io/traefik/v3.4/observability/logs/#level)) and check for auth related lines.

---

<div class="post-metadata">

**Author:** ![HeSitated](https://avatars.discourse-cdn.com/v4/letter/h/f475e1/32.png) [@HeSitated](https://community.traefik.io/u/HeSitated)\
**Post date:** [May 11, 2026, 2:36pm UTC](https://community.traefik.io/t/dashboard-authentication-with-usersfile/29864/3 "2026-05-11T14:36:07Z")

</div>

The only thing the logging shows is:  
```  
traefik | 2026-05-11T16:23:35+02:00 DBG [github.com/traefik/traefik/v3/pkg/middlewares/auth/basic\_auth.go:91](http://github.com/traefik/traefik/v3/pkg/middlewares/auth/basic_auth.go:91) \> Authentication failed middlewareName=dashboard-auth@docker middlewareType=BasicAuth  
```

But that is not very helpfull. 😉

This is the command that i used to create the user test:

```bash
echo $(htpasswd -nbB test test) | sed -e s/\\$/\\$\\$/g

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [May 11, 2026, 8:27pm UTC](https://community.traefik.io/t/dashboard-authentication-with-usersfile/29864/4 "2026-05-11T20:27:19Z")

</div>

Try without using sed, as Traefik is reading a plain file, and no pre-processor like compose is changing the content.

---

<div class="post-metadata">

**Author:** ![HeSitated](https://avatars.discourse-cdn.com/v4/letter/h/f475e1/32.png) [@HeSitated](https://community.traefik.io/u/HeSitated)\
**Post date:** [May 12, 2026, 2:19pm UTC](https://community.traefik.io/t/dashboard-authentication-with-usersfile/29864/5 "2026-05-12T14:19:47Z")

</div>

Thnxs! That was indeed the solution!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [May 15, 2026, 2:20pm UTC](https://community.traefik.io/t/dashboard-authentication-with-usersfile/29864/6 "2026-05-15T14:20:42Z")

</div>

Closed on May 15, 2026, 2:20pm UTC

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.