Every Jellyfin admin knows the ritual: a friend asks for an account, you create one by hand, you guess which libraries they should see, you send them a password over some chat app, and a week later you realize half of them can download your whole library. Sharing the admin account is worse, but doing it all manually does not scale either.
The Registration plugin for Jellyfin replaces that ritual with a public page on your own server address. Visitors fill in a form, you decide who gets in, and every account is created disabled, hidden from the sign-in screen and with the minimal rights you define once. This tutorial walks through a setup where invite codes control who can request an account, approval mode keeps you in the loop, and default access settings make sure new users never start with more than they need.
Prerequisites
- Jellyfin Server 12.2 or newer, on Linux, Windows or Docker.
- Your server reachable over HTTPS by the people who will register, directly or through a reverse proxy.
- A MediaLab Works account with a license that covers the plugin: an active subscription, a lifetime license within its update window, the Jellyfin bundle, or the free 30-day trial.
- Optional but recommended: an SMTP server configured in the plugin if you want e-mail confirmations and decision messages, and a Telegram bot if you want notifications there.
Step 1 — Install the plugin
The smooth path is your private plugin repository, because Jellyfin then installs and updates the plugin by itself.
- In your MediaLab Works account open Licenses → Jellyfin plugin repository and click Create address. The address contains a token, so treat it as a secret.
- In Jellyfin go to Dashboard → Plugins → Repositories, click +, name it (for example MediaLab Works), paste the address and save.
- Open Dashboard → Plugins → Catalog, find Registration by MediaLab, click Install and restart Jellyfin.
If you prefer manual installation, download the zip from Account → Licenses, extract it into a new folder Registration by MediaLab_x.y.z.0 inside the plugins folder (/var/lib/jellyfin/plugins/ on a Linux package install, /config/plugins/ in the official Docker image, %ProgramData%\Jellyfin\Server\plugins\ on Windows) and restart Jellyfin.
Step 2 — Activate the license
Open the plugin page in Dashboard → Plugins → Registration by MediaLab and click Open License page. Paste your key and click Activate with key; the license is bound to this server and shown as Active. Without a key you can start the 30-day free trial from the same page. The license is checked once a day and at every Jellyfin start, and without internet the plugin keeps working for 7 days after the last successful check.
Step 3 — Open the sign-up page
Go to Dashboard → Registration. After installation registration is closed, so nothing opens by itself. In the General tab:
- Pick the mode: manual approval (the default), invite code only, or automatic.
- Switch on Registration open.
- Optionally set an opening and closing date, so the page closes itself after your invite round.
- Enter the public address of your server; it is used for the links in e-mails.
The public page lives at https://<your server>/Registration/Page and is available in English and Romanian, built for phones first: username checked as you type, name, e-mail, phone number in international format, and a password with a strength meter. The Send access tab gives you the link and a QR code ready to send.
While you are signed in to Jellyfin as an administrator in the same browser, opening the page gives you the form directly, without a code, and the request is marked as a test. Use that to check the flow before you send the link to anyone.
Step 4 — Work with invite codes
In the Invitations tab you find the current invite code and an optional family code.
- The invite code is single-use and renews itself after use: every new person gets a fresh code, so one leaked code does not open the door to everyone.
- The family code is meant for people living in the same home, so a household can register without you issuing a code per person.
Set the mode to invite code only if you want nothing to happen without a code, or keep approval mode and use codes as an extra filter. Either way, send the page link together with the code; the Send access tab has both ready to copy.
Step 5 — Choose approval mode
With manual approval (the default), each request waits for you under Dashboard → Registration → Requests. You see pending and processed requests, can search them, approve or reject one by one or in bulk, and export the list as CSV.
This is the safe default: even if a bot slips past the anti-bot checks, nothing becomes an account without you. The account itself is created disabled at request time, so approval only enables it. E-mail confirmation can be switched on separately in the same area if you want applicants to prove their address.
Step 6 — Set default access for new accounts
This is the part that saves you the most work later. In the Default access tab you define what every approved account gets:
- Libraries: all, or only the ones you choose. For a mixed server, hand out only the libraries a new person should see.
- Simultaneous streams and remote bitrate limits, if you want them.
- Automatic disabling after a number of days, useful for trial access.
New accounts are created with minimal rights: no administration, no downloads, no sync, no deletion, and they do not appear on the sign-in screen. Think of it as a template user you configure once and reuse for everyone, except you never have to copy permissions by hand.
In the Form tab you can also set the default country, allowed countries, username and password rules, and the privacy text shown on the page.
Step 7 — Keep the bots out
The Anti-bot tab is where you tighten the public page:
- Proof-of-work runs in the browser, and the form uses signed one-time tokens and a hidden trap field.
- Cloudflare Turnstile is optional and off by default; it only activates if you enter your own keys.
- Rate limits apply per IP and network.
- Data-center, commercial VPN and Tor addresses are refused, and disposable e-mail domains are rejected.
- Duplicate-account rules enforce one account per person: the same device, phone number or browser and network are blocked or flagged, rule by rule.
You can also restrict visitor countries here. Country information comes from the CF-IPCountry header when you are behind Cloudflare, and the network type from a local ASN database, with no online lookups.
Step 8 — Notifications and the sign-in link
In the Notifications tab, enable the Jellyfin activity log, e-mail (through your SMTP server) and Telegram, as you prefer. Admin e-mail notifications are off by default; the e-mail to the applicant can carry the confirmation, the decision and the access message you compose, which may include a generated password.
While registration is open, the plugin can add a Create an account link and a QR code to the Jellyfin sign-in screen. That is done through the login disclaimer text (Branding → Login disclaimer), without modifying files.
Tips and troubleshooting
- "Registration is closed": switch on Registration open in the General tab and check the opening and closing dates.
- "Not available from this network": the visitor is on a data-center, VPN or Tor address. Turn that rule off in Anti-bot only if you really need to.
- Behind Cloudflare or a reverse proxy: make sure the real visitor address reaches Jellyfin (Jellyfin's Known proxies setting). Otherwise all visitors share one address and hit the rate limits.
- TVs: the form supports Jellyfin's native Quick Connect, so a TV code can be entered in the form and the TV signs in once the account becomes active. This is verified at API level but not tested on real TV apps, so try it with your own device first.
- Data retention: pending requests expire after 7 days and the disabled account is deleted; rejected, expired or deleted requests are purged after 30 days. Passwords are not stored by the plugin; Jellyfin handles them.
- Updates: with a lifetime license whose update window has ended, keep to your private repository so Jellyfin does not install a version your license does not cover. If it happens, use Roll back to x.y.z on the License page.
Conclusion
A public sign-up page is only safe when it is boring: codes that renew themselves, approval before anything is enabled, and default rights that never exceed what a new viewer needs. Registration gives you exactly that, and it removes the manual account creation from your evenings. When you are ready for the next step, the plugin works with Cashier to sell paid subscriptions to your server.
Start on the product page, follow the user guide for the exact tabs, and check the changelog before updating. More self-hosting material is in our knowledge base, and if something does not work, contact us.