Security Forms, not for local addresses

Basic and Forms both need a username and a password below. The API key bypasses whichever you pick.

Behind a reverse proxy, "Disabled for Local Addresses" needs the trusted proxies below, or every request looks remote.

API key - for the HTTP API

Send as the X-Api-Key header (preferred) or ?apikey=, which is convenient but can land in proxy/access logs. See GET /api/v1 for the endpoint list.

Revokes the current key straight away. Use this if it has leaked.

Logging Info, writing a file

Debug is the level to reach for while something is behaving oddly.

Currently IST +0530.

How this works

Debug records every step of every scan: which torrents were inspected or skipped and why, what each detector saw, how the profile judged it, and the air-date decision behind a requeue. Useful while something is behaving oddly, noisy the rest of the time.

A container with no timezone set runs on UTC, so its logs read hours away from your own clock with nothing in the file saying which is which. You can set it here, or with TZ=America/Los_Angeles in docker-compose. Every timestamp carries its UTC offset either way.

The file rolls over at midnight, gets renamed with the date and gzipped, and is deleted once it is older than the retention below.

Credentials are redacted from every log, so a file here is safe to attach to a GitHub issue.

Log files - download for a bug report

FileSizeModified
protectarr.log 865 B 2026-11-06 19:42:25 Download
protectarr.log.2026-11-05.gz (compressed) 805 B 2026-11-06 19:42:09 Download
protectarr.log.2026-11-04.gz (compressed) 144 B 2026-11-05 17:50:22 Download
protectarr.log.2026-11-03.gz (compressed) 724 B 2026-11-04 15:31:49 Download
protectarr.log.2026-11-01.gz (compressed) 491 B 2026-11-03 18:32:59 Download
protectarr.log.2026-10-31.gz (compressed) 834 B 2026-11-01 00:01:41 Download

Download all as .zip 6 file(s), 3.77 KB total.