🔗 docs: Repair Dead Docs Routes and Close Verified Reference Gaps

content/docs/configuration/authentication/SAML/auth0.mdx

@@ -27,12 +27,18 @@ description: Learn how to configure LibreChat to use Auth0 for user authenticati
    - **Settings (JSON Format)**: Use the following configuration:
         ```json
         {
+            "audience": "https://your-librechat-domain.com",
             "mappings": {
                 "email": "email",
                 "name": "username"
             }
         }
         ```
+        <Callout type="warning" title="Audience must match SAML_ISSUER">
+        Set `audience` to the same string you will use for `SAML_ISSUER` in Step 4.
+        Leave it out and Auth0 asserts its own default audience, which will not match
+        what LibreChat sends, and the login fails with an audience mismatch.
+        </Callout>
         <Callout type="note" title="note">
         If your application requires additional attributes such as `given_name`,
         `family_name`, `username` or `picture`, ensure these mappings are properly
@@ -48,10 +54,24 @@ description: Learn how to configure LibreChat to use Auth0 for user authenticati
 
 1. Once SAML is enabled, go back to the `SAML2 Web App` settings.
 2. Go to the `Usage` tab.
-3. Click on `Identity Provider Certificate: Download Atuh0 certificate`.
-4. Use the `Issuer` to `SAML_ISSUER`
-5. Use the `Identity Provider Login URL` to `SAML_ENTRY_POINT`.
-6. Copy the donwloaded cert file to your project folder
+3. Click on `Identity Provider Certificate: Download Auth0 certificate`.
+4. Use the `Identity Provider Login URL` for `SAML_ENTRY_POINT`.
+5. Use the `Issuer` for `SAML_IDP_ISSUER` (optional, see the callout below).
+6. Copy the downloaded cert file to your project folder.
+
+<Callout type="warning" title="SAML_ISSUER is yours, not Auth0's">
+
+`SAML_ISSUER` is the entity ID **LibreChat sends about itself** in its authentication requests, not a value you copy out of Auth0. You choose it, and it is the same string you enter on the Auth0 side as the **Audience**. Your LibreChat base URL is the conventional choice:
+
+```bash filename=".env"
+SAML_ISSUER=https://your-librechat-domain.com
+```
+
+Auth0's own `Issuer` value goes in the separate `SAML_IDP_ISSUER` variable, which LibreChat uses to check that an assertion really came from your identity provider.
+
+LibreChat does not publish a SAML metadata document, so there is no metadata URL to hand to Auth0. Configure Auth0 by hand with the Audience above and the callback URL below.
+
+</Callout>
 
 ![auth0-4](/images/docs/configuration/authentication/SAML/auth0/4a.png)
 
@@ -61,7 +81,12 @@ Open the `.env` file in your project folder and add the following variables:
 
   ```bash filename=".env"
   SAML_ENTRY_POINT=https://dev-xxxxx.us.auth0.com/samlp/aaaaaa
-  SAML_ISSUER=urn:dev-xxxxx.us.auth0.com
+
+  # Your own entity ID, sent to Auth0. Must match the Audience you set in Auth0.
+  SAML_ISSUER=https://your-librechat-domain.com
+  # Auth0's Issuer, used to verify incoming assertions (optional)
+  SAML_IDP_ISSUER=urn:dev-xxxxx.us.auth0.com
+
   SAML_CERT=dev-xxxxx.pem
   SAML_CALLBACK_URL=/oauth/saml/callback
   SAML_SESSION_SECRET=[JustGenerateARandomSessionSecret]
@@ -74,7 +99,7 @@ Open the `.env` file in your project folder and add the following variables:
   SAML_PICTURE_CLAIM=
   SAML_NAME_CLAIM=
 
-  # Logint buttion settings (optional)
+  # Login button settings (optional)
   SAML_BUTTON_LABEL=
   SAML_IMAGE_URL=
 

content/docs/configuration/banner.mdx

@@ -52,6 +52,14 @@ Is persistable (cannot be dismissed) (y/N):
   - **Is persistable**: If yes, users can't dismiss the banner — use for important notices
 </Callout>
 
+<Callout type="warning" title="Running this again replaces the existing banner">
+
+There is only ever one banner. `update-banner` looks for an existing banner and overwrites it in place, creating one only when none exists, so you cannot queue up a second banner for a later date, and you cannot have two scheduled windows overlap. Running the command again discards the previous banner's message and schedule.
+
+To change a banner, run `update-banner` again. To take one down before its `Display To` time, use `delete-banner` below.
+
+</Callout>
+
 ---
 
 ## Deleting a Banner
@@ -62,6 +70,8 @@ npm run delete-banner
 
 You'll see the current banner and be asked to confirm before deleting.
 
+Removing a banner this way is also how you take one down early: there is no "disable" flag. A banner otherwise disappears on its own once `Display To` passes, and one saved with no `Display To` stays up until you delete it.
+
 ---
 
 ## Example Banners

content/docs/configuration/cdn/azure.mdx

@@ -17,6 +17,12 @@ description: This document provides instructions for setting up Azure Blob Stora
 
 Azure Blob Storage offers scalable, secure object storage for files in LibreChat. Follow these steps to configure your Azure Blob Storage.
 
+### What uses this
+
+Setting a file strategy changes where LibreChat puts every file it stores, rather than enabling a particular feature. That covers user and agent avatars, files uploaded in chat, images returned by the image generation tools, and files produced by the Code Interpreter.
+
+The default strategy writes all of that to the API container's filesystem. The standard Docker Compose deployment bind-mounts `./images` and `./uploads` to the host, so on a single-instance compose setup those files already survive recreating the container. What local storage cannot do is share files across instances, and it does lose them on any deployment that leaves those paths on the container's writable layer, such as Kubernetes without a persistent volume. Configure Azure Blob Storage (or another provider under [CDN](/docs/configuration/cdn)) when you run more than one instance, or when nothing persistent is mounted behind those paths.
+
 ## 1. Create an Azure Storage Account
 
 1. **Sign in to Azure:**

content/docs/configuration/cdn/s3.mdx

@@ -104,6 +104,8 @@ AWS_ENDPOINT_URL=https://your_endpoint_url
 - **AWS_BUCKET_NAME:** The name of the S3 bucket you created.
 - **AWS_ENDPOINT_URL:** (Optional) The custom AWS endpoint URL. Required for S3-compatible services such as MinIO, Cloudflare R2, Hetzner Object Storage, Backblaze B2, and IDrive e2. Include the URL scheme, such as `https://a7g8.da.idrivee2-32.com`; values without `http://` or `https://` can cause an `Invalid URL` error when files are streamed.
 - **AWS_FORCE_PATH_STYLE:** (Optional) Set to `true` for providers that require path-style URLs (`endpoint/bucket/key`) rather than virtual-hosted-style (`bucket.endpoint/key`). Required for Hetzner Object Storage, MinIO, and similar providers whose SSL certificates don't cover bucket subdomains. Not needed for AWS S3 or Cloudflare R2. Default: `false`.
+- **S3_URL_EXPIRY_SECONDS:** (Optional) Lifetime of each presigned URL, in seconds. See the note on presigned URLs below for the provider-side caps that apply.
+- **S3_REFRESH_EXPIRY_MS:** (Optional) Regenerate a presigned URL once it reaches this age, in milliseconds, instead of using the default expiry-buffer logic. Unset by default. A value that is not a positive integer is ignored with a warning in the logs.
 
 If you are using **IRSA** on Kubernetes, you do **not** need to set `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` in your environment. The AWS SDK will automatically obtain temporary credentials via the service account assigned to your pod. Ensure that `AWS_REGION` and `AWS_BUCKET_NAME` are still provided.
 

content/docs/configuration/librechat_yaml/ai_endpoints/ollama.mdx

@@ -52,7 +52,7 @@ If `llama3` keeps generating without stopping, add an `addParams` block with the
         default: [
           "llama3"
         ]
-        fetch: false # fetching list of models is not supported
+        fetch: false # pinned to the list above; set true to discover models from the server
       titleConvo: true
       titleModel: "current_model"
       summarize: false
@@ -78,14 +78,47 @@ If you only run `llama3` with Ollama, setting `stop` at the config level via `ad
           "llama3:latest",
           "mistral"
           ]
-        fetch: false # fetching list of models is not supported
+        fetch: false # pinned to the list above; set true to discover models from the server
       titleConvo: true
       titleModel: "current_model"
       modelDisplayLabel: "Ollama"
 ```
 
-Set the stop sequences in conversation parameters (and save them as a preset):
+Set the stop sequences in conversation parameters (and save them as a preset). Open a conversation on the Ollama endpoint, open the right-hand parameters panel, and add each sequence under **Stop Sequences**:
 
-![image](https://github.com/danny-avila/LibreChat/assets/110412045/57460b8c-308a-4d21-9dfe-f48a2ac85099)
+![LibreChat conversation parameters panel with four llama3 stop sequences entered in the Stop Sequences field](https://github.com/danny-avila/LibreChat/assets/110412045/57460b8c-308a-4d21-9dfe-f48a2ac85099)
 
 </Callout>
+
+## Troubleshooting
+
+### Ollama does not appear, or the model list is empty
+
+Work through these in order:
+
+1. **Check the endpoint is reachable from LibreChat, not from your shell.** If LibreChat runs in Docker, `localhost` is the API container itself, not your host. Use `http://host.docker.internal:11434/v1/` on Docker Desktop, or the host's LAN address on Linux where `host.docker.internal` may be unavailable. Running LibreChat outside Docker is the only case where `http://localhost:11434/v1/` is correct.
+2. **Confirm Ollama is listening beyond loopback.** By default Ollama binds to `127.0.0.1`, which a container cannot reach. Set `OLLAMA_HOST=0.0.0.0` in Ollama's own environment and restart it.
+
+   <Callout type="warning" title="Binding to 0.0.0.0 exposes Ollama on every interface">
+   Ollama's API is unauthenticated. Binding it to `0.0.0.0` on a machine with a LAN or public interface hands model access, and the ability to pull and delete models, to anyone who can reach port 11434. Prefer binding to just the address the LibreChat container actually reaches, which is the gateway of its compose network (`docker network inspect <network>` reports it), and firewall port 11434 so nothing else can reach it.
+   </Callout>
+3. **Know what the endpoint name changes.** LibreChat reaches for Ollama's native `/api/tags` only when the endpoint `name` starts with `ollama`, case-insensitively. Any other name, or a failure of that native call, falls through to the generic OpenAI-compatible `/v1/models` request. Current Ollama versions answer that one too at the `/v1/` base URL above, so a renamed endpoint usually still returns a model list. The prefix matters when you specifically need the native tags route, and a hosted proxy that serves `/v1/models` but not `/api/tags` is better off without it.
+4. **Set `apiKey` to any non-empty placeholder.** Ollama ignores the value, but a custom endpoint with no `apiKey` is dropped at config load.
+5. **Read the API logs.** `docker compose logs api` reports the connection error and the URL it actually tried.
+
+### Using a remote or hosted Ollama server
+
+Nothing is local-specific except the URL: point `baseURL` at the remote server's OpenAI-compatible path and put the credential in `apiKey` instead of the placeholder. Name it whatever you like: model fetching falls back to the OpenAI-compatible `/v1/models` route, which is usually what a hosted proxy exposes.
+
+`apiKey` is only ever sent as `Authorization: Bearer <key>`, and only when your `headers` block has not already set an `Authorization` header. If your hosted proxy expects a different scheme, such as `X-API-Key` or Basic auth, put the real credential in `headers`: an `Authorization` entry there replaces the Bearer fallback, and any other header is sent alongside it. `apiKey` still has to be non-empty either way, because an endpoint without one is dropped at config load.
+
+```yaml filename="excerpt of librechat.yaml"
+- name: "Ollama"
+  apiKey: "unused"
+  baseURL: "https://ollama.example.com/v1/"
+  headers:
+    X-API-Key: "${OLLAMA_PROXY_KEY}"
+  models:
+    default: ["llama3:latest"]
+    fetch: true
+```

content/docs/configuration/librechat_yaml/index.mdx

@@ -177,7 +177,11 @@ For detailed field-level documentation, see the reference pages below.
   <Cards.Card title="AI Endpoints" href="/docs/configuration/librechat_yaml/ai_endpoints" arrow>
     Compatible AI providers and example endpoint configurations
   </Cards.Card>
-  <Cards.Card title="Object Structure" href="/docs/configuration/librechat_yaml/object_structure" arrow>
+  <Cards.Card
+    title="Object Structure"
+    href="/docs/configuration/librechat_yaml/object_structure/config"
+    arrow
+  >
     Complete field reference for every librechat.yaml option
   </Cards.Card>
 </Cards>

content/docs/configuration/librechat_yaml/object_structure/custom_params.mdx

@@ -19,6 +19,37 @@ endpoints:
 
 Your "Google Gemini" endpoint will now display parameters for Google API when you create a new agent or preset.
 
+#### Accepted Values
+
+`defaultParamsEndpoint` selects which built-in parameter set the endpoint's panel renders. These are the values that resolve to one:
+
+<OptionTable
+  options={[
+    ['custom', 'String', 'OpenAI parameter set. This is the schema default, and what an endpoint with no `provider` falls back to.', 'Default'],
+    ['openAI', 'String', 'OpenAI parameter set.', ''],
+    ['azureOpenAI', 'String', 'OpenAI parameter set.', ''],
+    ['anthropic', 'String', 'Anthropic parameter set.', ''],
+    ['google', 'String', 'Google parameter set.', ''],
+    ['openrouter', 'String', 'OpenRouter parameter set. Lowercase, unlike the others.', ''],
+  ]}
+/>
+
+Note the casing: `openAI` and `azureOpenAI` are camelCase, but `openrouter` is all lowercase.
+
+<Callout type="info" title="A provider setting supplies this value for you">
+
+If the custom endpoint sets `provider`, LibreChat fills `defaultParamsEndpoint` in from it, so the effective default is the provider's parameter set rather than `custom`. That substitution happens only when you leave the field out or leave it at `custom`; any other value you set explicitly wins. A `provider: 'anthropic'` endpoint therefore starts on the Anthropic parameter set without you writing `defaultParamsEndpoint` at all.
+
+</Callout>
+
+The values `assistants`, `azureAssistants`, `agents`, and `bedrock` are also recognized when LibreChat resolves conversation and preset schemas, but none of them maps to a parameter set a custom endpoint can render, so setting one leaves the panel empty.
+
+<Callout type="warning" title="Unrecognized values fail silently">
+
+The field is a free-form string, not a closed enum, so a value outside this list passes configuration validation. It simply matches no parameter set, and the endpoint's panel renders with **no parameters at all** rather than reporting an error. If your parameter panel is unexpectedly empty, check this value first.
+
+</Callout>
+
 ### Overriding Parameter Definitions
 
 On top of that, you can also fine tune the parameters provided for your custom endpoint. For example, the `temperature` parameter for google endpoint is a slide with range from 0.0 to 1.0, and default of 1.0, you can update the `librechat.yaml` file to override these values:

content/docs/configuration/librechat_yaml/object_structure/speech.mdx

@@ -272,9 +272,9 @@ When using an object instead of a boolean:
       'browser',
     ],
     ['languageSTT', 'String', 'Default language for STT.', ''],
-    ['autoTranscribeAudio', 'Boolean', 'Automatically transcribe audio messages.', ''],
-    ['decibelValue', 'Number', 'Decibel threshold for voice detection.', ''],
-    ['autoSendText', 'Number', 'Delay in ms before auto-sending transcribed text (0 to disable).', ''],
+    ['autoTranscribeAudio', 'Boolean', 'Keep the microphone listening instead of stopping at the first pause. With an external engine it also turns on silence detection based on `decibelValue`.', ''],
+    ['decibelValue', 'Number', 'Decibel threshold for silence detection. Range -100 to -30, default -45.', ''],
+    ['autoSendText', 'Number', 'Seconds to wait after transcription before auto-sending. `0` sends immediately; `-1` disables auto-send.', ''],
   ]}
 />
 

content/docs/configuration/librechat_yaml/object_structure/transactions.mdx

@@ -8,6 +8,14 @@ description: Configure transaction recording for token usage in LibreChat
 
 The `transactions` object controls whether token usage records are saved to the database in LibreChat. This allows administrators to enable or disable transaction tracking independently from the balance system.
 
+<Callout type="info" title="This setting only controls storage, not display">
+
+`transactions` decides whether usage records are **written to the database**. It does not surface token counts anywhere in the app, so turning it on alone will not make token information appear in the UI.
+
+To *see* token usage, use `interface.contextUsage`, which draws the in-conversation context gauge and is on by default. `interface.contextCost` is a separate setting, off by default, that adds cost figures to that gauge; leave it off if you want token counts without exposing pricing. See [Token Usage](/docs/configuration/token_usage#viewing-context-usage-and-cost). To enforce per-user credit limits, see [Balance](/docs/configuration/librechat_yaml/object_structure/balance).
+
+</Callout>
+
 **Fields under `transactions`:**
 
 - `enabled`

content/docs/configuration/pre_configured_ai/openai.mdx

@@ -15,6 +15,18 @@ To get your OpenAI API key, you need to:
 OPENAI_API_KEY=user_provided
 ```
 
+<Callout type="info" title="Where users enter their own key">
+
+With `user_provided`, you supply no key at all: each user enters their own from the chat UI. Open the endpoint menu, and next to **OpenAI** there is a gear icon labelled **Set API Key**. Clicking it opens a dialog with a field for the key and a dropdown for how long it should be kept: 30 minutes, 2 hours, 12 hours (the default), 1 day, 7 days, 30 days, or never expire.
+
+The key is encrypted and stored server-side against that user's account, so it is entered once rather than per conversation, and it is never shared with other users. The same dialog has a **Revoke** action, plus **Revoke All** to clear every key that user has stored.
+
+If the endpoint menu is hidden, for example because a model spec disables `modelSelect`, the same dialog is reachable from **Settings** under **Data controls**, in the **API keys** section.
+
+Until a user sets a key, the endpoint is visible but unusable for them.
+
+</Callout>
+
 - You can determine which models you would like to have available with `OPENAI_MODELS`
   - When `OPENAI_API_KEY` is set to `user_provided` → only the models put in this list will be available
     - ⚠️New models won't automatically show up; you'll need to add them to this list first