Self-hosting Tambo

Tambo Cloud is the hosted platform behind Tambo AI. Self-hosting gives you full control over your data, infrastructure, and authentication.

Architecture

Tambo consists of three services:

The web service serves the dashboard UI and communicates with the API. The API handles all client requests, manages threads, and orchestrates LLM calls. PostgreSQL stores all persistent data including projects, threads, messages, and user accounts.

Authentication model

Tambo supports two mutually exclusive authentication modes:

• OAuth (Google and/or GitHub) — used when any OAuth provider is configured
• Email login (via Resend magic links) — only active when no OAuth providers are configured

You must configure at least one mode. See Authentication setup for details.

Security considerations

These apply regardless of your deployment method (Docker Compose or Kubernetes):

1. Change all default passwords — use strong, unique values for every secret
2. Use HTTPS — always use TLS in production
3. Restrict database access — don't expose the PostgreSQL port publicly
4. Use secrets management — consider Docker secrets, Kubernetes secrets, or a vault
5. Set ALLOWED_LOGIN_DOMAIN — restrict access to your organization's email domain

In this section