Parameter · Connections and Authentication / Authentication
authentication_timeout
Sets the maximum allowed time to complete client authentication.
- Default:
1min - Type: integer (s)
- Range: 1s … 10min
- Applies: Reload
In plain words
How long a new connection may take to complete the login handshake (send the startup packet, answer the password challenge, finish SSL). If it takes longer, the server closes the connection.
This protects the server from clients that connect and then never finish logging in, each holding a process.
For DBAs and operators
The timer starts when the backend begins processing the new connection and covers the startup packet, the SSL/GSS handshake and the whole authentication exchange (including waiting for an LDAP/RADIUS server or a user typing a password into psql). Strictly, the limit is applied twice: once while the backend waits for the startup packet (including SSL/GSS negotiation), where expiry ends the process silently, and again for the authentication exchange, where the log shows FATAL: canceling authentication due to timeout. So a slow or hostile client can hold a process for nearly twice the value.
A connection that is in the authentication exchange already has its own backend process and has taken one of the max_connections slots; floods of half-finished logins show up as many short-lived backends. With log_connections you can see where they stall (log_connections = 'authentication' etc. in PostgreSQL 18, which also has 'setup_durations' to time each phase).
Raise it only when an external auth provider is legitimately slow (LDAP over WAN, OAuth device flow); lower it (10–20 s) on internet-exposed servers. Range 1 s – 10 min.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().