Lychee

Users can sign in with a local username and password, with WebAuthn for passwordless login using a security key or device biometrics, or through OAuth providers. Bundled providers include Google, GitHub, Apple, Microsoft, Amazon, Facebook, Mastodon, Keycloak, Authentik, Authelia, Nextcloud, Kanidm, and Pocket ID. Admins can disable self-registration and invite users with generated links instead.

Yes. The php artisan lychee:sync command imports a folder on the server recursively, creating an album for each directory and subdirectory. It supports importing into a specific album, skipping duplicates, importing via symlink instead of copying, and deleting files that no longer exist in the source folder. Regular browser uploads also support drag and drop and chunked uploads for large files.

Lychee exposes a REST API under /api/v2, and each instance serves its own OpenAPI documentation at /docs/api. For scripts and external tools you create a personal API token under Settings then Profile, and send it as an Authorization: Bearer header. Token-authenticated requests bypass CSRF checks, while session-based requests need the usual CSRF token.

Lychee requires PHP 8.4 or newer with the GD, EXIF, PDO, mbstring, and related extensions, plus MySQL, MariaDB, PostgreSQL, or SQLite. The official Docker image runs FrankenPHP and the minimal compose file bundles MariaDB, so a single command starts a working gallery. Production installs should set APP_URL and APP_KEY and sit behind a TLS-terminating reverse proxy such as nginx, Traefik, or Caddy.

The Supporter Edition is the same MIT-licensed codebase unlocked with a licence key obtained through GitHub Sponsors. It adds library and usage statistics, user groups, photo watermarking, AES-encrypted share links, white-labelling, per-user upload quotas, multi-admin support, per-album timeline settings, album tag display, a contact form, personal favourites, custom renaming rules, and a webshop for selling photos.