Mobile App: Getting Your Self-hosted Instance Connected
Mobile App: Getting Your Self-hosted Instance Connected
Nov 10, 2026 · @Gloria Folaron
Applies to: Leantime Mobile 1.0.0 and newer, on iPhone and Android. Two-factor after SSO needs 1.1.0 or newer.
Before you start
The app works with self-hosted Leantime when three things are true. If any one is missing, the app will show one of the messages below.
- Leantime 3.9.5 or newer. Check Settings → About in your Leantime. Older versions can't sign the app in.
- The AdvancedAuth plugin, installed and turned on. It handles mobile sign-in. Your Leantime admin can set this up. If it was set up before and stopped working, the admin should check that it's still turned on and that its license is current.
- Your server must be reachable from your phone, at the same address you use in a browser, including any port or folder (for example
https://leantime.example.com:8090orhttps://example.com/leantime). If you only reach Leantime on your office network or VPN, the app only works on that network too.
One quick test before anything else: open your Leantime address in the phone's browser. If it loads and you can sign in there, the server side is fine and the problem is one of the specific cases below. If it doesn't load, start with the third point.
Signing in with SSO
If you sign in to Leantime on the web with your company login (such as Okta, Microsoft Entra, Google Workspace or Keycloak), the app can use it too. Tap Sign in with SSO on the app's sign-in screen. The button only shows when your server is set up for it.
Your server needs:
- Leantime 3.10.2 or newer, with mobile sign-in turned on (the AdvancedAuth plugin from the list above).
- SSO set up with OpenID Connect (OIDC). The app supports one company login per server. SAML logins don't work in the app yet.
If your account uses two-factor codes, the app asks for your code after the company login. This needs Leantime 3.13.0 or newer and app version 1.1.0 or newer. With older versions, the app can't ask for your code. Update the app from the App Store or Google Play first, then ask your admin about the server.
For your admin: register https://<your Leantime address>/oidc/callback as the redirect address with your login provider. The app uses the same address as the web login, so there is nothing extra to add. If a sign-in wall sits in front of Leantime, let /oidc and /status through it (see the table below).
If you see this message
Find the sentence the app showed you. Most of these clear up with one check on your side; the last column is for your Leantime admin when they don't.
The app says | What's usually going on | Worth trying | For your admin |
|---|---|---|---|
Mobile access isn't available on this Leantime instance yet. It needs some setup on the server. Ask your Leantime admin. | Your server is Leantime, but mobile sign-in isn't switched on there. The address is fine. | Nothing on the phone. Pass the sentence along. | Install the AdvancedAuth plugin and turn it on. If it was on before, check it's still enabled and its license is current. |
This Leantime instance is older than the app supports. Ask your admin to update Leantime. | The server is below Leantime 3.9.5. | Settings → About in Leantime shows the version. | Update to 3.9.5 or newer. |
That URL responded, but it doesn't look like Leantime. Double-check the address. | Something else answered at that address: a different site, a holding page, or a sign-in wall in front of Leantime. | Open the address in the phone's browser. If you land on Leantime's login page, copy that address exactly, folder included. If a company login or a "checking your browser" page comes first, see the next row. | If a sign-in wall is in front, let the app's paths through it: |
Something in front of your server is asking for a sign-in the app can't complete. | A gatekeeper (Cloudflare Access, Authelia, basic auth, a bot check) answers before Leantime. The app can't fill in that form. | In the phone's browser, notice what appears first. If it isn't Leantime's own login, this is it. | Exempt the paths above from the gatekeeper, or give phones a route that reaches Leantime directly. |
Your phone doesn't trust this server's certificate. | The certificate is self-signed or from a private authority. iOS stops the connection before the app can talk to Leantime. | The phone's browser shows a warning for the same address. | Use a certificate from a public authority such as Let's Encrypt. If it must stay private, install the authority's certificate on each phone and trust it under Settings → General → About → Certificate Trust Settings. |
We couldn't reach that address. Check the URL, including any port, and that the server is reachable from your phone. | Nothing answered: the name didn't resolve, the connection was refused, or it timed out. | Try the exact address in the phone's browser on the same network. Check the port if you use one. Away from the office? Connect to the VPN first. | Make sure the address, port, and firewall allow connections from outside, or let people know the app works only on the internal network. |
You signed in, but the server is rejecting the app's requests. | Sign-in worked, then every request after it failed. The proxy is dropping the app's sign-in token. Not an account problem. | Nothing on the phone. Pass the sentence along. | The proxy or PHP setup drops the |
Too many sign-in attempts right now. Wait a minute and try again. | The server limits sign-ins per minute, and an office behind one address can hit it together. | Wait a minute, then try once. | Nothing, unless it happens often; then raise the limit. |
We reached {server}, but couldn't start mobile sign-in there. Double-check the URL. If it's correct, ask your Leantime admin. | The server is reachable, but didn't answer sign-in the way the app expects. Usually the plugin is missing or off; sometimes a sign-in wall or a proxy setting. | Run the three checks at the top. The phone-browser test tells you if the server is reachable at all. | Confirm the plugin is on, then check the two proxy rows above. |
Proxy note for admins. On Apache with PHP-FPM, add SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 to the site config, or set CGIPassAuth On. On Nginx, make sure proxy_set_header Authorization $http_authorization; is present and nothing strips the header on the way to PHP.
Problems the app can't name
These don't have their own message. They show up as one of the sentences above, usually "couldn't reach" or "doesn't look like Leantime".
What's going on | How to tell | What to do |
|---|---|---|
Wrong tab on the Connect screen | You typed a full address into the Cloud workspace box, or a Cloud workspace name into the Self-Hosted box | Cloud: type only the part before |
The address redirects somewhere else | In the browser the address bar changes after loading ( | Use the address the browser ends up on, not the one you typed |
Your account has no password | You normally sign in with a company login (LDAP, OIDC, Google, Microsoft) and never set a Leantime password | Tap Sign in with SSO on the app's sign-in screen (see Signing in with SSO above). If there's no button, ask your admin to set up mobile SSO or to set a password for you |
Two-factor code keeps failing | The code is right but the app says it didn't match | The server's clock is off. Codes depend on the time. Ask your admin to set the server time correctly (NTP) |
Server only reachable at the office | Works on office Wi-Fi, fails on mobile data | Connect to the office VPN first, or ask your admin whether the server can be reached from outside |
App worked, then stopped after a server change | Nothing changed on the phone | The plugin was turned off, its license lapsed, or a proxy setting changed. Start with the first message entry above |
Still stuck?
Email mobile@leantime.io with these five things to speed up your support:
- The exact sentence the app showed.
- Your Leantime version (Settings → About).
- Whether the same address loads in the phone's browser, on the same network.
- Whether anything sits in front of Leantime: a reverse proxy, a VPN, a company sign-in page.
- A screenshot of the Connect or sign-in screen with the message visible. Cover your email address if you prefer.
Updated on: 10/11/2026
Thank you!