Emby & Jellyseerr

[Bstuart01 3]

Hello,

I am running Emby with per-user device restrictions enabled. Human users are intentionally locked down to only approved devices and this works correctly for all normal clients.

However, Jellyseerr cannot authenticate when using a device-restricted user, even when the Jellyseerr device is explicitly allowed in the user’s device list.

What I am seeing:

When a restricted user attempts to log in via Jellyseerr
Authentication succeeds
Immediately followed by
User is not allowed access from this device
HTTP 403 returned

Logs:

2025-12-18 11:29:54.286 Info UserService-0HNHUBVRPRF5T:00000001: http/1.1 POST https://host2:1717/Users/AuthenticateByName. Source Ip: host4, Accept=application/json, Connection=keep-alive, Host=host2:1717, User-Agent=axios/1.10.0, Accept-Encoding=gzip, compress, deflate, br, Content-Type=application/json, Content-Length=30, X-Emby-Authorization=MediaBrowser Client="Jellyseerr", Device="Jellyseerr", DeviceId="Qk9UX2plbGx5c2VlcnJfR2FycmV0dA==", Version="2.7.3", X-Forwarded-For=172.18.0.1
2025-12-18 11:29:54.287 Info UserManager: Authentication request for Garrett has succeeded.
2025-12-18 11:29:54.287 Error UserService-0HNHUBVRPRF5T:00000001: User is not allowed access from this device.
2025-12-18 11:29:54.287 Info UserService-0HNHUBVRPRF5T:00000001: http/1.1 Response 403 to host4. Time: 1ms. POST https://host2:1717/Users/AuthenticateByName. Headers: Content-Type=text/plain, Date=Thu, 18 Dec 2025 18:29:53 GMT, Server=UPnP/1.0 DLNADOC/1.50, Content-Length=133, Cross-Origin-Resource-Policy=cross-origin, Private-Network-Access-Name=Stuflix-2025, Private-Network-Access-Id=7a1cbddef9cc4f92b2684d366ba6a35b
2025-12-18 11:29:54.291 Info UserService-0HNHUBVRPRF5T:00000002: http/1.1 POST https://host2:1717/Users/AuthenticateByName. Source Ip: host5, Accept=application/json, Connection=keep-alive, Host=host2:1717, User-Agent=axios/1.10.0, Accept-Encoding=gzip, compress, deflate, br, Content-Type=application/json, Content-Length=30, X-Emby-Authorization=MediaBrowser Client="Jellyseerr", Device="Jellyseerr", DeviceId="Qk9UX2plbGx5c2VlcnJfR2FycmV0dA==", Version="2.7.3"
2025-12-18 11:29:54.292 Info UserManager: Authentication request for Garrett has succeeded.
2025-12-18 11:29:54.292 Error UserService-0HNHUBVRPRF5T:00000002: User is not allowed access from this device.
2025-12-18 11:29:54.292 Info UserService-0HNHUBVRPRF5T:00000002: http/1.1 Response 403 to host5. Time: 1ms. POST https://host2:1717/Users/AuthenticateByName. Headers: Content-Type=text/plain, Date=Thu, 18 Dec 2025 18:29:53 GMT, Server=UPnP/1.0 DLNADOC/1.50, Content-Length=133, Cross-Origin-Resource-Policy=cross-origin, Private-Network-Access-Name=Stuflix-2025, Private-Network-Access-Id=7a1cbddef9cc4f92b2684d366ba6a35b

In the Emby UI, multiple Jellyseerr devices appear under the user, I explicitly allow all those devices however the login still fails.

If I temporarily allow all devices for the user Jellyseerr works immediately
 

Questions:

Is this behavior expected when using device-restricted users with service clients like Jellyseerr?
Is there a recommended way to allow Jellyseerr under a device-restricted user?
Could I add an IP allow override as it appears all Jellyseerr requests come from the Docker IP?

Thanks for your time in advance, much appreciated! 

[Luke 42077]

HI, I don't know what jellyseer is doing but my first question to the developer would be whether or not it's reporting a consistent device id with every request.  If you've already allowed the device for that user and it's still getting rejected, then that's unusual.

Curious why do you use device access in the first place? It's one of those features I feel like we should have never added, but we did and now we're stuck with it.

[Neminem 1518]

@Bstuart01

Do you see Jellyseerr under devices.

I rename them to something I can identify under user device access.

Now I can give access to that device here.

Hope this helps

[Bstuart01 3]

19 hours ago, Luke said:

HI, I don't know what jellyseer is doing but my first question to the developer would be whether or not it's reporting a consistent device id with every request.  If you've already allowed the device for that user and it's still getting rejected, then that's unusual.

Curious why do you use device access in the first place? It's one of those features I feel like we should have never added, but we did and now we're stuck with it.

Hey Luke,

Thanks for the response. I can reach out to the dev but it looks like the DeviceId is different upon each login. Here's the logs showing the same Chrome browser attempting logins from one users that has device restrictions enabled, the second attempt is a user that doesn't have device restrcitions. Again, same device but coming across as a unique DeviceId. 

To answer your other question, I use device restriction for certian family members that like to share with other they shouldn't. Or in situations where family members login to Emby from an Airbnb and forget to logout. If there's a better way I'm all ears but this has worked pretty well and thankful for the feature. 

Let me know your thoughts and if there's anything I can do from the Emby side with the Jellyseerr. I'll also reach out to the dev or community on the Jellyseerr side too but that seems to be a bit lacking. 
 

DeviceId="Qk9UX2plbGx5c2VlcnJfR2FycmV0dA==", Version="2.7.3", X-Forwarded-For=172.18.0.1
2025-12-19 08:45:18.045 Info UserManager: Authentication request for Garrett has succeeded.
2025-12-19 08:45:18.046 Error UserService-0HNHUBVRPRSMH:00000001: User is not allowed access from this device.

DeviceId="Qk9UX2plbGx5c2VlcnJfU3RhZ2luZw==", Version="2.7.3", X-Forwarded-For=172.18.0.1
2025-12-19 08:45:26.350 Info UserManager: Authentication request for Staging has succeeded.
2025-12-19 08:45:26.350 Info SessionManager: Creating new access token for user 19 Staging

[Bstuart01 3]

9 hours ago, Neminem said:

@Bstuart01

Do you see Jellyseerr under devices.

I rename them to something I can identify under user device access.

Now I can give access to that device here.

Hope this helps

Hey @Neminem

 

Thanks for the response! I have allowed all Jellyseerr devices for the restricted user but it's still not working. I've updated the device name on a few of them but for most they just say 'Jellyseerr - Jellyseerr'. All of them are enabled for the user that's having issues though.

Does it work for you? Looks like you have the same setup with device restriction.

From the logs below it looks like it's a unique device ID each time but if it's working for you, there's hope! I'm running Emby 4.9.2.8 and Jellyseerr 2.7.3 for context. 

Thanks again for your time! 
 

DeviceId="Qk9UX2plbGx5c2VlcnJfR2FycmV0dA==", Version="2.7.3", X-Forwarded-For=172.18.0.1
2025-12-19 08:45:18.045 Info UserManager: Authentication request for Garrett has succeeded.
2025-12-19 08:45:18.046 Error UserService-0HNHUBVRPRSMH:00000001: User is not allowed access from this device.

DeviceId="Qk9UX2plbGx5c2VlcnJfU3RhZ2luZw==", Version="2.7.3", X-Forwarded-For=172.18.0.1
2025-12-19 08:45:26.350 Info UserManager: Authentication request for Staging has succeeded.
2025-12-19 08:45:26.350 Info SessionManager: Creating new access token for user 19 Staging