NPM uses JWT authentication. Enter your NPM login credentials (email + password). The system will automatically log in and obtain tokens for API calls.

NPM API URL

http:// or https:// - must include /api at the end

NPM Login Email

NPM Login Password

---

SSL Certificate Mode

SSL Mode Per-Customer Let's Encrypt Certificate Wildcard Certificate (pre-configured in NPM)

Choose how SSL certificates are assigned to customer proxy hosts.

Wildcard Certificate

-- Select a certificate --

Select the wildcard certificate (e.g. *.example.com) already uploaded in NPM.

Save NPM Settings Test Connection

Management Image

Signal Image

Relay Image

Dashboard Image

Save Image Settings

---

Pull Latest Images from Docker Hub

Downloads the latest versions of all configured NetBird images. After pulling, use Monitoring to update customer containers.

Pull from Docker Hub

---

Automatic Updates

Automatically checks for new NetBird images daily at the chosen time.

Enable automatic update check

Daily check time

Automatically update customer containers after check

When enabled, all customer containers are automatically recreated after a new image is found (services briefly restart). When disabled, only the images are pulled — updating customers stays a manual step.

Last automatic check: -

Save Automation

---

Automatic Restart of Unreachable Containers

Some customers only regain access to their NetBird web UI after a container restart. When enabled, the scheduler periodically checks whether each customer's dashboard actually responds and restarts their containers if it doesn't, logging the action in the customer's log.

Automatically restart unreachable customer containers

Cooldown between restarts (minutes)

Save Automation

---

NetBird Client Auto-Updates (all customers)

Controls the "Automatic Updates" setting inside every customer's own NetBird dashboard (Settings > Clients). Set the default here, then push it to all customers at once. Individual customers can still be overridden from their detail page.

Client version Disabled Latest Specific version

Force automatic updates

Save Default Apply to All Customers

Branding Settings

Company / Application Name

Displayed on login page and navbar

Subtitle

Shown below the title on the login page

Default Language English Deutsch

Default language for users without a preference

Logo Preview

Default icon (no logo uploaded)

Upload Logo (PNG, JPG, SVG, max 500KB)

Upload

Remove Logo

Save Branding

Azure AD / Entra ID Integration

Enable Azure AD SSO

Tenant ID

Client ID (Application ID)

Client Secret

Allowed Group Object ID (optional)

If set, only Azure AD members of this group can log in.

Save Azure AD Settings

Windows DNS Integration

Enable Windows DNS Integration

Automatically create/delete DNS A-records when deploying customers.

DNS Server Address

DNS Zone

Username (NTLM)

Password

A-Record Target IP

IP address that customer A-records will point to (usually your NPM server IP).

Save DNS Settings Test Connection

LDAP / Active Directory Authentication

Enable LDAP / AD Authentication

Allow Active Directory users to log in. Local admin accounts always work as fallback.

LDAP Server

Port

Use SSL/TLS (LDAPS)

Bind DN (Service Account)

Bind Password

Base DN

User Filter

Use {username} as placeholder for the login name.

Group Restriction DN (optional)

If set, only members of this group can log in via LDAP.

Save LDAP Settings Test Connection

Git Repository Settings

Repository URL

Used for version checks and one-click updates via Gitea API.

Branch

main

Access Token (optional)

Save Git Settings

Change Admin Password

Current Password

New Password (min 12 chars)

Confirm New Password

Change Password