Files
Dan Hopkins d787d0ce43 fix: only count failed attempts against auth rate limit (#7707)
* fix: only count failed attempts against auth rate limit

Add skipSuccessfulRequests: true to authRateLimiter so that successful
logins do not consume quota. This fixes breakage for API clients
(actual-cli, actual-mcp, custom scripts) that re-authenticate per
operation — they always provide the correct password, so they should
never be rate-limited.

Brute-force attackers generate repeated failures and still hit the wall.

Fixes #7706

* Update upcoming-release-notes/7706.md

Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>

* fix: rename release note to match PR number

---------

Co-authored-by: Matt Fiddaman <github@m.fiddaman.uk>
2026-05-04 22:27:18 +00:00
..
2026-05-03 17:41:17 +00:00

This is the main project to run Actual, a local-first personal finance tool. It comes with the latest version of Actual, and a server to persist changes and make data available across all devices.

Getting Started

Actual is a local-first personal finance tool. It is 100% free and open-source, written in NodeJS, it has a synchronization element so that all your changes can move between devices without any heavy lifting.

If you are interested in contributing, or want to know how development works, see our contributing document we would love to have you.

Want to say thanks? Click the at the top of the page.

Using the CLI tool

Node.js v22 or higher is required for the @actual-app/sync-server npm package

Install globally with npm:

npm install --location=global @actual-app/sync-server

After installing, you can execute actual-server commands directly in your terminal.

Usage

actual-server [options]

Available options

Command Description
-h or --help Print this list and exit.
-v or --version Print this version and exit.
--config Path to the config file.
--reset-password Reset your password

Examples

Run with default configuration

actual-server

Run with custom configuration

actual-server --config ./config.json

Reset your password

actual-server --reset-password

Documentation

We have a wide range of documentation on how to use Actual. This is all available in our Community Documentation, including topics on installing, Budgeting, Account Management, Tips & Tricks and some documentation for developers.

Feature Requests

Current feature requests can be seen here. Vote for your favorite requests by reacting 👍 to the top comment of the request.

To add new feature requests, open a new Issue of the "Feature Request" type.