diff --git a/Dockerfile b/Dockerfile
index f9c46117..816bdd3c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -57,7 +57,7 @@ WORKDIR /app
 # Copy compiled frontend and server from build stages
 COPY --from=build-client /client/dist /app/client/dist
 COPY --from=build-server /server /app
-COPY --from=build-server /usr/local/lib/nusqlite3 /usr/local/lib/nusqlite3
+COPY --from=build-server ${NUSQLITE3_PATH} ${NUSQLITE3_PATH}
 
 EXPOSE 80
 
diff --git a/client/components/app/ConfigSideNav.vue b/client/components/app/ConfigSideNav.vue
index 50fa7a06..32e7e694 100644
--- a/client/components/app/ConfigSideNav.vue
+++ b/client/components/app/ConfigSideNav.vue
@@ -70,6 +70,11 @@ export default {
           title: this.$strings.HeaderUsers,
           path: '/config/users'
         },
+        {
+          id: 'config-api-keys',
+          title: this.$strings.HeaderApiKeys,
+          path: '/config/api-keys'
+        },
         {
           id: 'config-sessions',
           title: this.$strings.HeaderListeningSessions,
diff --git a/client/components/app/LazyBookshelf.vue b/client/components/app/LazyBookshelf.vue
index 61331fb9..854b61b2 100644
--- a/client/components/app/LazyBookshelf.vue
+++ b/client/components/app/LazyBookshelf.vue
@@ -778,10 +778,6 @@ export default {
     windowResize() {
       this.executeRebuild()
     },
-    socketInit() {
-      // Server settings are set on socket init
-      this.executeRebuild()
-    },
     initListeners() {
       window.addEventListener('resize', this.windowResize)
 
@@ -794,7 +790,6 @@ export default {
       })
 
       this.$eventBus.$on('bookshelf_clear_selection', this.clearSelectedEntities)
-      this.$eventBus.$on('socket_init', this.socketInit)
       this.$eventBus.$on('user-settings', this.settingsUpdated)
 
       if (this.$root.socket) {
@@ -826,7 +821,6 @@ export default {
       }
 
       this.$eventBus.$off('bookshelf_clear_selection', this.clearSelectedEntities)
-      this.$eventBus.$off('socket_init', this.socketInit)
       this.$eventBus.$off('user-settings', this.settingsUpdated)
 
       if (this.$root.socket) {
diff --git a/client/components/app/SideRail.vue b/client/components/app/SideRail.vue
index 2b05ef36..5f364201 100644
--- a/client/components/app/SideRail.vue
+++ b/client/components/app/SideRail.vue
@@ -116,7 +116,7 @@
     </div>
 
     <div class="w-full h-12 px-1 py-2 border-t border-black/20 bg-bg absolute left-0" :style="{ bottom: streamLibraryItem ? '224px' : '65px' }">
-      <p class="underline font-mono text-xs text-center text-gray-300 leading-3 mb-1" @click="clickChangelog">v{{ $config.version }}</p>
+      <p class="underline font-mono text-xs text-center text-gray-300 leading-3 mb-1 cursor-pointer" @click="clickChangelog">v{{ $config.version }}</p>
       <a v-if="hasUpdate" :href="githubTagUrl" target="_blank" class="text-warning text-xxs text-center block leading-3">Update</a>
       <p v-else class="text-xxs text-gray-400 leading-3 text-center italic">{{ Source }}</p>
     </div>
diff --git a/client/components/cards/AuthorCard.vue b/client/components/cards/AuthorCard.vue
index 82645c57..05347393 100644
--- a/client/components/cards/AuthorCard.vue
+++ b/client/components/cards/AuthorCard.vue
@@ -71,9 +71,6 @@ export default {
     coverHeight() {
       return this.cardHeight
     },
-    userToken() {
-      return this.store.getters['user/getToken']
-    },
     _author() {
       return this.author || {}
     },
diff --git a/client/components/cards/BookMatchCard.vue b/client/components/cards/BookMatchCard.vue
index 87aa0a71..09b963c5 100644
--- a/client/components/cards/BookMatchCard.vue
+++ b/client/components/cards/BookMatchCard.vue
@@ -13,9 +13,17 @@
           <div class="grow" />
           <p class="text-sm md:text-base">{{ book.publishedYear }}</p>
         </div>
-        <p v-if="book.author" class="text-gray-300 text-xs md:text-sm">{{ $getString('LabelByAuthor', [book.author]) }}</p>
-        <p v-if="book.narrator" class="text-gray-400 text-xs">{{ $strings.LabelNarrators }}: {{ book.narrator }}</p>
-        <p v-if="book.duration" class="text-gray-400 text-xs">{{ $strings.LabelDuration }}: {{ $elapsedPrettyExtended(bookDuration, false) }} {{ bookDurationComparison }}</p>
+
+        <div class="flex items-center">
+          <div>
+            <p v-if="book.author" class="text-gray-300 text-xs md:text-sm">{{ $getString('LabelByAuthor', [book.author]) }}</p>
+            <p v-if="book.narrator" class="text-gray-400 text-xs">{{ $strings.LabelNarrators }}: {{ book.narrator }}</p>
+            <p v-if="book.duration" class="text-gray-400 text-xs">{{ $strings.LabelDuration }}: {{ $elapsedPrettyExtended(bookDuration, false) }} {{ bookDurationComparison }}</p>
+          </div>
+          <div class="grow" />
+          <div v-if="book.matchConfidence" class="rounded-full px-2 py-1 text-xs whitespace-nowrap text-white" :class="book.matchConfidence > 0.95 ? 'bg-success/80' : 'bg-info/80'">{{ $strings.LabelMatchConfidence }}: {{ (book.matchConfidence * 100).toFixed(0) }}%</div>
+        </div>
+
         <div v-if="book.series?.length" class="flex py-1 -mx-1">
           <div v-for="(series, index) in book.series" :key="index" class="bg-white/10 rounded-full px-1 py-0.5 mx-1">
             <p class="leading-3 text-xs text-gray-400">
diff --git a/client/components/cards/LazyBookCard.vue b/client/components/cards/LazyBookCard.vue
index 35c959fa..955e18d9 100644
--- a/client/components/cards/LazyBookCard.vue
+++ b/client/components/cards/LazyBookCard.vue
@@ -101,7 +101,8 @@
         <!-- Podcast Episode # -->
         <div cy-id="podcastEpisodeNumber" v-if="recentEpisodeNumber !== null && !isHovering && !isSelectionMode && !processing" class="absolute rounded-lg bg-black/90 box-shadow-md z-10" :style="{ top: 0.375 + 'em', right: 0.375 + 'em', padding: `${0.1}em ${0.25}em` }">
           <p :style="{ fontSize: 0.8 + 'em' }">
-            Episode<span v-if="recentEpisodeNumber"> #{{ recentEpisodeNumber }}</span>
+            Episode
+            <span v-if="recentEpisodeNumber">#{{ recentEpisodeNumber }}</span>
           </p>
         </div>
 
@@ -198,7 +199,10 @@ export default {
       return this.store.getters['user/getSizeMultiplier']
     },
     dateFormat() {
-      return this.store.state.serverSettings.dateFormat
+      return this.store.getters['getServerSetting']('dateFormat')
+    },
+    timeFormat() {
+      return this.store.getters['getServerSetting']('timeFormat')
     },
     _libraryItem() {
       return this.libraryItem || {}
@@ -345,6 +349,10 @@ export default {
         if (this.mediaMetadata.publishedYear) return this.$getString('LabelPublishedDate', [this.mediaMetadata.publishedYear])
         return '\u00A0'
       }
+      if (this.orderBy === 'progress') {
+        if (!this.userProgressLastUpdated) return '\u00A0'
+        return this.$getString('LabelLastProgressDate', [this.$formatDatetime(this.userProgressLastUpdated, this.dateFormat, this.timeFormat)])
+      }
       return null
     },
     episodeProgress() {
@@ -377,6 +385,10 @@ export default {
       let progressPercent = this.itemIsFinished ? 1 : this.booksInSeries ? this.seriesProgressPercent : this.useEBookProgress ? this.userProgress?.ebookProgress || 0 : this.userProgress?.progress || 0
       return Math.max(Math.min(1, progressPercent), 0)
     },
+    userProgressLastUpdated() {
+      if (!this.userProgress) return null
+      return this.userProgress.lastUpdate
+    },
     itemIsFinished() {
       if (this.booksInSeries) return this.seriesIsFinished
       return this.userProgress ? !!this.userProgress.isFinished : false
diff --git a/client/components/cards/LazySeriesCard.vue b/client/components/cards/LazySeriesCard.vue
index 3532095b..34cea7e2 100644
--- a/client/components/cards/LazySeriesCard.vue
+++ b/client/components/cards/LazySeriesCard.vue
@@ -71,7 +71,7 @@ export default {
       return this.height * this.sizeMultiplier
     },
     dateFormat() {
-      return this.store.state.serverSettings.dateFormat
+      return this.store.getters['getServerSetting']('dateFormat')
     },
     labelFontSize() {
       if (this.width < 160) return 0.75
diff --git a/client/components/controls/LibraryFilterSelect.vue b/client/components/controls/LibraryFilterSelect.vue
index f5eec41a..62a9b803 100644
--- a/client/components/controls/LibraryFilterSelect.vue
+++ b/client/components/controls/LibraryFilterSelect.vue
@@ -94,6 +94,9 @@ export default {
     userIsAdminOrUp() {
       return this.$store.getters['user/getIsAdminOrUp']
     },
+    userCanAccessExplicitContent() {
+      return this.$store.getters['user/getUserCanAccessExplicitContent']
+    },
     libraryMediaType() {
       return this.$store.getters['libraries/getCurrentLibraryMediaType']
     },
@@ -239,6 +242,15 @@ export default {
           sublist: false
         }
       ]
+
+      if (this.userCanAccessExplicitContent) {
+        items.push({
+          text: this.$strings.LabelExplicit,
+          value: 'explicit',
+          sublist: false
+        })
+      }
+
       if (this.userIsAdminOrUp) {
         items.push({
           text: this.$strings.LabelShareOpen,
@@ -249,7 +261,7 @@ export default {
       return items
     },
     podcastItems() {
-      return [
+      const items = [
         {
           text: this.$strings.LabelAll,
           value: 'all'
@@ -283,6 +295,16 @@ export default {
           sublist: false
         }
       ]
+
+      if (this.userCanAccessExplicitContent) {
+        items.push({
+          text: this.$strings.LabelExplicit,
+          value: 'explicit',
+          sublist: false
+        })
+      }
+
+      return items
     },
     selectItems() {
       if (this.isSeries) return this.seriesItems
diff --git a/client/components/controls/LibrarySortSelect.vue b/client/components/controls/LibrarySortSelect.vue
index 7e83928f..536c93f1 100644
--- a/client/components/controls/LibrarySortSelect.vue
+++ b/client/components/controls/LibrarySortSelect.vue
@@ -7,7 +7,7 @@
       </span>
     </button>
 
-    <ul v-show="showMenu" class="absolute z-10 mt-1 w-full bg-bg border border-black-200 shadow-lg max-h-96 rounded-md py-1 ring-1 ring-black/5 overflow-auto focus:outline-hidden text-sm" role="menu">
+    <ul v-show="showMenu" class="librarySortMenu absolute z-10 mt-1 w-full bg-bg border border-black-200 shadow-lg max-h-96 rounded-md py-1 ring-1 ring-black/5 overflow-auto focus:outline-hidden text-sm" role="menu">
       <template v-for="item in selectItems">
         <li :key="item.value" class="select-none relative py-2 pr-9 cursor-pointer hover:bg-white/5" :class="item.value === selected ? 'bg-white/5 text-yellow-400' : 'text-gray-200 hover:text-white'" role="menuitem" @click="clickedOption(item.value)">
           <div class="flex items-center">
@@ -130,6 +130,10 @@ export default {
           text: this.$strings.LabelFileModified,
           value: 'mtimeMs'
         },
+        {
+          text: this.$strings.LabelLibrarySortByProgress,
+          value: 'progress'
+        },
         {
           text: this.$strings.LabelRandomly,
           value: 'random'
@@ -191,3 +195,9 @@ export default {
   }
 }
 </script>
+
+<style scoped>
+.librarySortMenu {
+  max-height: calc(100vh - 125px);
+}
+</style>
\ No newline at end of file
diff --git a/client/components/covers/AuthorImage.vue b/client/components/covers/AuthorImage.vue
index e320e552..084492b0 100644
--- a/client/components/covers/AuthorImage.vue
+++ b/client/components/covers/AuthorImage.vue
@@ -39,9 +39,6 @@ export default {
     }
   },
   computed: {
-    userToken() {
-      return this.$store.getters['user/getToken']
-    },
     _author() {
       return this.author || {}
     },
diff --git a/client/components/modals/AccountModal.vue b/client/components/modals/AccountModal.vue
index 71ac8155..6f4b7b67 100644
--- a/client/components/modals/AccountModal.vue
+++ b/client/components/modals/AccountModal.vue
@@ -309,9 +309,9 @@ export default {
           } else {
             console.log('Account updated', data.user)
 
-            if (data.user.id === this.user.id && data.user.token !== this.user.token) {
-              console.log('Current user token was updated')
-              this.$store.commit('user/setUserToken', data.user.token)
+            if (data.user.id === this.user.id && data.user.accessToken !== this.user.accessToken) {
+              console.log('Current user access token was updated')
+              this.$store.commit('user/setAccessToken', data.user.accessToken)
             }
 
             this.$toast.success(this.$strings.ToastAccountUpdateSuccess)
@@ -351,9 +351,6 @@ export default {
           this.$toast.error(errMsg || 'Failed to create account')
         })
     },
-    toggleActive() {
-      this.newUser.isActive = !this.newUser.isActive
-    },
     userTypeUpdated(type) {
       this.newUser.permissions = {
         download: type !== 'guest',
diff --git a/client/components/modals/ApiKeyCreatedModal.vue b/client/components/modals/ApiKeyCreatedModal.vue
new file mode 100644
index 00000000..96442a17
--- /dev/null
+++ b/client/components/modals/ApiKeyCreatedModal.vue
@@ -0,0 +1,60 @@
+<template>
+  <modals-modal ref="modal" v-model="show" name="api-key-created" :width="800" :height="'unset'" persistent>
+    <template #outer>
+      <div class="absolute top-0 left-0 p-5 w-2/3 overflow-hidden">
+        <p class="text-3xl text-white truncate">{{ title }}</p>
+      </div>
+    </template>
+    <form @submit.prevent="submitForm">
+      <div class="px-4 w-full text-sm py-6 rounded-lg bg-bg shadow-lg border border-black-300 overflow-y-auto overflow-x-hidden" style="min-height: 200px; max-height: 80vh">
+        <div class="w-full p-8">
+          <p class="text-lg text-white mb-4">{{ $getString('LabelApiKeyCreated', [apiKeyName]) }}</p>
+
+          <p class="text-lg text-white mb-4">{{ $strings.LabelApiKeyCreatedDescription }}</p>
+
+          <ui-text-input label="API Key" :value="apiKeyKey" readonly show-copy />
+
+          <div class="flex justify-end mt-4">
+            <ui-btn color="bg-primary" @click="show = false">{{ $strings.ButtonClose }}</ui-btn>
+          </div>
+        </div>
+      </div>
+    </form>
+  </modals-modal>
+</template>
+
+<script>
+export default {
+  props: {
+    value: Boolean,
+    apiKey: {
+      type: Object,
+      default: () => null
+    }
+  },
+  data() {
+    return {}
+  },
+  computed: {
+    show: {
+      get() {
+        return this.value
+      },
+      set(val) {
+        this.$emit('input', val)
+      }
+    },
+    title() {
+      return this.$strings.HeaderNewApiKey
+    },
+    apiKeyName() {
+      return this.apiKey?.name || ''
+    },
+    apiKeyKey() {
+      return this.apiKey?.apiKey || ''
+    }
+  },
+  methods: {},
+  mounted() {}
+}
+</script>
diff --git a/client/components/modals/ApiKeyModal.vue b/client/components/modals/ApiKeyModal.vue
new file mode 100644
index 00000000..b347abd0
--- /dev/null
+++ b/client/components/modals/ApiKeyModal.vue
@@ -0,0 +1,198 @@
+<template>
+  <modals-modal ref="modal" v-model="show" name="api-key" :width="800" :height="'unset'" :processing="processing">
+    <template #outer>
+      <div class="absolute top-0 left-0 p-5 w-2/3 overflow-hidden">
+        <p class="text-3xl text-white truncate">{{ title }}</p>
+      </div>
+    </template>
+    <form @submit.prevent="submitForm">
+      <div class="px-4 w-full text-sm py-6 rounded-lg bg-bg shadow-lg border border-black-300 overflow-y-auto overflow-x-hidden" style="min-height: 400px; max-height: 80vh">
+        <div class="w-full p-8">
+          <div class="flex py-2">
+            <div class="w-1/2 px-2">
+              <ui-text-input-with-label v-model.trim="newApiKey.name" :readonly="!isNew" :label="$strings.LabelName" />
+            </div>
+            <div v-if="isNew" class="w-1/2 px-2">
+              <ui-text-input-with-label v-model.trim="newApiKey.expiresIn" :label="$strings.LabelExpiresInSeconds" type="number" :min="0" />
+            </div>
+          </div>
+          <div class="flex items-center pt-4 pb-2 gap-2">
+            <div class="flex items-center px-2">
+              <p class="px-3 font-semibold" id="user-enabled-toggle">{{ $strings.LabelEnable }}</p>
+              <ui-toggle-switch :disabled="isExpired && !apiKey.isActive" labeledBy="user-enabled-toggle" v-model="newApiKey.isActive" />
+            </div>
+            <div v-if="isExpired" class="px-2">
+              <p class="text-sm text-error">{{ $strings.LabelExpired }}</p>
+            </div>
+          </div>
+
+          <div class="w-full border-t border-b border-black-200 py-4 px-3 mt-4">
+            <p class="text-lg mb-2 font-semibold">{{ $strings.LabelApiKeyUser }}</p>
+            <p class="text-sm mb-2 text-gray-400">{{ $strings.LabelApiKeyUserDescription }}</p>
+            <ui-select-input v-model="newApiKey.userId" :disabled="isExpired && !apiKey.isActive" :items="userItems" :placeholder="$strings.LabelSelectUser" :label="$strings.LabelApiKeyUser" label-hidden />
+          </div>
+
+          <div class="flex pt-4 px-2">
+            <div class="grow" />
+            <ui-btn color="bg-success" type="submit">{{ $strings.ButtonSubmit }}</ui-btn>
+          </div>
+        </div>
+      </div>
+    </form>
+  </modals-modal>
+</template>
+
+<script>
+export default {
+  props: {
+    value: Boolean,
+    apiKey: {
+      type: Object,
+      default: () => null
+    },
+    users: {
+      type: Array,
+      default: () => []
+    }
+  },
+  data() {
+    return {
+      processing: false,
+      newApiKey: {},
+      isNew: true
+    }
+  },
+  watch: {
+    show: {
+      handler(newVal) {
+        if (newVal) {
+          this.init()
+        }
+      }
+    }
+  },
+  computed: {
+    show: {
+      get() {
+        return this.value
+      },
+      set(val) {
+        this.$emit('input', val)
+      }
+    },
+    title() {
+      return this.isNew ? this.$strings.HeaderNewApiKey : this.$strings.HeaderUpdateApiKey
+    },
+    userItems() {
+      return this.users
+        .filter((u) => {
+          // Only show root user if the current user is root
+          return u.type !== 'root' || this.$store.getters['user/getIsRoot']
+        })
+        .map((u) => ({ text: u.username, value: u.id, subtext: u.type }))
+    },
+    isExpired() {
+      if (!this.apiKey || !this.apiKey.expiresAt) return false
+
+      return new Date(this.apiKey.expiresAt).getTime() < Date.now()
+    }
+  },
+  methods: {
+    submitForm() {
+      if (!this.newApiKey.name) {
+        this.$toast.error(this.$strings.ToastNameRequired)
+        return
+      }
+
+      if (!this.newApiKey.userId) {
+        this.$toast.error(this.$strings.ToastNewApiKeyUserError)
+        return
+      }
+
+      if (this.isNew) {
+        this.submitCreateApiKey()
+      } else {
+        this.submitUpdateApiKey()
+      }
+    },
+    submitUpdateApiKey() {
+      if (this.newApiKey.isActive === this.apiKey.isActive && this.newApiKey.userId === this.apiKey.userId) {
+        this.$toast.info(this.$strings.ToastNoUpdatesNecessary)
+        this.show = false
+        return
+      }
+
+      const apiKey = {
+        isActive: this.newApiKey.isActive,
+        userId: this.newApiKey.userId
+      }
+
+      this.processing = true
+      this.$axios
+        .$patch(`/api/api-keys/${this.apiKey.id}`, apiKey)
+        .then((data) => {
+          this.processing = false
+          if (data.error) {
+            this.$toast.error(`${this.$strings.ToastFailedToUpdate}: ${data.error}`)
+          } else {
+            this.show = false
+            this.$emit('updated', data.apiKey)
+          }
+        })
+        .catch((error) => {
+          this.processing = false
+          console.error('Failed to update apiKey', error)
+          var errMsg = error.response ? error.response.data || '' : ''
+          this.$toast.error(errMsg || this.$strings.ToastFailedToUpdate)
+        })
+    },
+    submitCreateApiKey() {
+      const apiKey = { ...this.newApiKey }
+
+      if (this.newApiKey.expiresIn) {
+        apiKey.expiresIn = parseInt(this.newApiKey.expiresIn)
+      } else {
+        delete apiKey.expiresIn
+      }
+
+      this.processing = true
+      this.$axios
+        .$post('/api/api-keys', apiKey)
+        .then((data) => {
+          this.processing = false
+          if (data.error) {
+            this.$toast.error(this.$strings.ToastFailedToCreate + ': ' + data.error)
+          } else {
+            this.show = false
+            this.$emit('created', data.apiKey)
+          }
+        })
+        .catch((error) => {
+          this.processing = false
+          console.error('Failed to create apiKey', error)
+          var errMsg = error.response ? error.response.data || '' : ''
+          this.$toast.error(errMsg || this.$strings.ToastFailedToCreate)
+        })
+    },
+    init() {
+      this.isNew = !this.apiKey
+
+      if (this.apiKey) {
+        this.newApiKey = {
+          name: this.apiKey.name,
+          isActive: this.apiKey.isActive,
+          userId: this.apiKey.userId
+        }
+      } else {
+        this.newApiKey = {
+          name: null,
+          expiresIn: null,
+          isActive: true,
+          userId: null
+        }
+      }
+    }
+  },
+  mounted() {}
+}
+</script>
diff --git a/client/components/modals/BookmarksModal.vue b/client/components/modals/BookmarksModal.vue
index de8c72b7..d84a8ed8 100644
--- a/client/components/modals/BookmarksModal.vue
+++ b/client/components/modals/BookmarksModal.vue
@@ -79,10 +79,10 @@ export default {
       return !this.bookmarks.find((bm) => Math.abs(this.currentTime - bm.time) < 1)
     },
     dateFormat() {
-      return this.$store.state.serverSettings.dateFormat
+      return this.$store.getters['getServerSetting']('dateFormat')
     },
     timeFormat() {
-      return this.$store.state.serverSettings.timeFormat
+      return this.$store.getters['getServerSetting']('timeFormat')
     }
   },
   methods: {
diff --git a/client/components/modals/ListeningSessionModal.vue b/client/components/modals/ListeningSessionModal.vue
index a2469836..0a6b556e 100644
--- a/client/components/modals/ListeningSessionModal.vue
+++ b/client/components/modals/ListeningSessionModal.vue
@@ -81,7 +81,7 @@
         </div>
         <div class="w-full md:w-1/3">
           <p v-if="!isMediaItemShareSession" class="font-semibold uppercase text-xs text-gray-400 tracking-wide mb-2 mt-6 md:mt-0">{{ $strings.LabelUser }}</p>
-          <p v-if="!isMediaItemShareSession" class="mb-1 text-xs">{{ _session.userId }}</p>
+          <p v-if="!isMediaItemShareSession" class="mb-1 text-xs">{{ username }}</p>
 
           <p class="font-semibold uppercase text-xs text-gray-400 tracking-wide mt-6 mb-2">{{ $strings.LabelMediaPlayer }}</p>
           <p class="mb-1">{{ playMethodName }}</p>
@@ -132,6 +132,9 @@ export default {
     _session() {
       return this.session || {}
     },
+    username() {
+      return this._session.user?.username || this._session.userId || ''
+    },
     deviceInfo() {
       return this._session.deviceInfo || {}
     },
@@ -159,10 +162,10 @@ export default {
       return 'Unknown'
     },
     dateFormat() {
-      return this.$store.state.serverSettings.dateFormat
+      return this.$store.getters['getServerSetting']('dateFormat')
     },
     timeFormat() {
-      return this.$store.state.serverSettings.timeFormat
+      return this.$store.getters['getServerSetting']('timeFormat')
     },
     isOpenSession() {
       return !!this._session.open
diff --git a/client/components/modals/Modal.vue b/client/components/modals/Modal.vue
index a7d9c0ae..31ea1e61 100644
--- a/client/components/modals/Modal.vue
+++ b/client/components/modals/Modal.vue
@@ -23,7 +23,7 @@ export default {
     processing: Boolean,
     persistent: {
       type: Boolean,
-      default: true
+      default: false
     },
     width: {
       type: [String, Number],
@@ -99,7 +99,7 @@ export default {
         this.preventClickoutside = false
         return
       }
-      if (this.processing && this.persistent) return
+      if (this.processing || this.persistent) return
       if (ev.srcElement && ev.srcElement.classList.contains('modal-bg')) {
         this.show = false
       }
diff --git a/client/components/modals/ShareModal.vue b/client/components/modals/ShareModal.vue
index 24994b22..bd0c9acf 100644
--- a/client/components/modals/ShareModal.vue
+++ b/client/components/modals/ShareModal.vue
@@ -144,7 +144,7 @@ export default {
     expirationDateString() {
       if (!this.expireDurationSeconds) return this.$strings.LabelPermanent
       const dateMs = Date.now() + this.expireDurationSeconds * 1000
-      return this.$formatDatetime(dateMs, this.$store.state.serverSettings.dateFormat, this.$store.state.serverSettings.timeFormat)
+      return this.$formatDatetime(dateMs, this.$store.getters['getServerSetting']('dateFormat'), this.$store.getters['getServerSetting']('timeFormat'))
     }
   },
   methods: {
diff --git a/client/components/modals/changelog/ViewModal.vue b/client/components/modals/changelog/ViewModal.vue
index 1b332a1d..939ee71d 100644
--- a/client/components/modals/changelog/ViewModal.vue
+++ b/client/components/modals/changelog/ViewModal.vue
@@ -40,7 +40,7 @@ export default {
       }
     },
     dateFormat() {
-      return this.$store.state.serverSettings.dateFormat
+      return this.$store.getters['getServerSetting']('dateFormat')
     },
     releasesToShow() {
       return this.versionData?.releasesToShow || []
diff --git a/client/components/modals/item/tabs/Files.vue b/client/components/modals/item/tabs/Files.vue
index 7be286fe..15c44261 100644
--- a/client/components/modals/item/tabs/Files.vue
+++ b/client/components/modals/item/tabs/Files.vue
@@ -29,9 +29,6 @@ export default {
     media() {
       return this.libraryItem.media || {}
     },
-    userToken() {
-      return this.$store.getters['user/getToken']
-    },
     userCanUpdate() {
       return this.$store.getters['user/getUserCanUpdate']
     },
diff --git a/client/components/modals/podcast/EpisodeFeed.vue b/client/components/modals/podcast/EpisodeFeed.vue
index 7ec14ccd..6b99cee7 100644
--- a/client/components/modals/podcast/EpisodeFeed.vue
+++ b/client/components/modals/podcast/EpisodeFeed.vue
@@ -35,7 +35,14 @@
               <widgets-podcast-type-indicator :type="episode.episodeType" />
             </div>
             <p v-if="episode.subtitle" class="mb-1 text-sm text-gray-300 line-clamp-2">{{ episode.subtitle }}</p>
-            <p class="text-xs text-gray-300">Published {{ episode.publishedAt ? $dateDistanceFromNow(episode.publishedAt) : 'Unknown' }}</p>
+            <div class="flex items-center space-x-2">
+              <!-- published -->
+              <p class="text-xs text-gray-300 w-40">Published {{ episode.publishedAt ? $dateDistanceFromNow(episode.publishedAt) : 'Unknown' }}</p>
+              <!-- duration -->
+              <p v-if="episode.durationSeconds && !isNaN(episode.durationSeconds)" class="text-xs text-gray-300 min-w-28">{{ $strings.LabelDuration }}: {{ $elapsedPretty(episode.durationSeconds) }}</p>
+              <!-- size -->
+              <p v-if="episode.enclosure?.length && !isNaN(episode.enclosure.length) && Number(episode.enclosure.length) > 0" class="text-xs text-gray-300">{{ $strings.LabelSize }}: {{ $bytesPretty(Number(episode.enclosure.length)) }}</p>
+            </div>
           </div>
         </div>
       </div>
diff --git a/client/components/modals/podcast/RemoveEpisode.vue b/client/components/modals/podcast/RemoveEpisode.vue
index 38dd71cf..b2cebe84 100644
--- a/client/components/modals/podcast/RemoveEpisode.vue
+++ b/client/components/modals/podcast/RemoveEpisode.vue
@@ -11,7 +11,7 @@
           {{ $getString('MessageConfirmRemoveEpisode', [episodeTitle]) }}
         </p>
         <p v-else class="text-lg text-gray-200 mb-4">{{ $getString('MessageConfirmRemoveEpisodes', [episodes.length]) }}</p>
-        <p class="text-xs font-semibold text-warning/90">Note: This does not delete the audio file unless toggling "Hard delete file"</p>
+        <p class="text-xs font-semibold text-warning/90">{{ $strings.MessageConfirmRemoveEpisodeNote }}</p>
       </div>
       <div class="flex justify-between items-center pt-4">
         <ui-checkbox v-model="hardDeleteFile" :label="$strings.LabelHardDeleteFile" check-color="error" checkbox-bg="bg" small label-class="text-base text-gray-200 pl-3" />
diff --git a/client/components/modals/podcast/ViewEpisode.vue b/client/components/modals/podcast/ViewEpisode.vue
index 5a520ef4..2502a5ea 100644
--- a/client/components/modals/podcast/ViewEpisode.vue
+++ b/client/components/modals/podcast/ViewEpisode.vue
@@ -16,7 +16,7 @@
         </div>
       </div>
       <p dir="auto" class="text-lg font-semibold mb-6">{{ title }}</p>
-      <div v-if="description" dir="auto" class="default-style less-spacing" v-html="description" />
+      <div v-if="description" dir="auto" class="default-style less-spacing" @click="handleDescriptionClick" v-html="description" />
       <p v-else class="mb-2">{{ $strings.MessageNoDescription }}</p>
 
       <div class="w-full h-px bg-white/5 my-4" />
@@ -34,6 +34,12 @@
             {{ audioFileSize }}
           </p>
         </div>
+        <div class="grow">
+          <p class="font-semibold text-xs mb-1">{{ $strings.LabelDuration }}</p>
+          <p class="mb-2 text-xs">
+            {{ audioFileDuration }}
+          </p>
+        </div>
       </div>
     </div>
   </modals-modal>
@@ -68,7 +74,7 @@ export default {
       return this.episode.title || 'No Episode Title'
     },
     description() {
-      return this.episode.description || ''
+      return this.parseDescription(this.episode.description || '')
     },
     media() {
       return this.libraryItem?.media || {}
@@ -90,11 +96,49 @@ export default {
 
       return this.$bytesPretty(size)
     },
+    audioFileDuration() {
+      const duration = this.episode.duration || 0
+      return this.$elapsedPretty(duration)
+    },
     bookCoverAspectRatio() {
       return this.$store.getters['libraries/getBookCoverAspectRatio']
     }
   },
-  methods: {},
+  methods: {
+    handleDescriptionClick(e) {
+      if (e.target.matches('span.time-marker')) {
+        const time = parseInt(e.target.dataset.time)
+        if (!isNaN(time)) {
+          this.$eventBus.$emit('play-item', {
+            episodeId: this.episodeId,
+            libraryItemId: this.libraryItem.id,
+            startTime: time
+          })
+        }
+        e.preventDefault()
+      }
+    },
+    parseDescription(description) {
+      const timeMarkerLinkRegex = /<a href="#([^"]*?\b\d{1,2}:\d{1,2}(?::\d{1,2})?)">(.*?)<\/a>/g
+      const timeMarkerRegex = /\b\d{1,2}:\d{1,2}(?::\d{1,2})?\b/g
+
+      function convertToSeconds(time) {
+        const timeParts = time.split(':').map(Number)
+        return timeParts.reduce((acc, part, index) => acc * 60 + part, 0)
+      }
+
+      return description
+        .replace(timeMarkerLinkRegex, (match, href, displayTime) => {
+          const time = displayTime.match(timeMarkerRegex)[0]
+          const seekTimeInSeconds = convertToSeconds(time)
+          return `<span class="time-marker cursor-pointer text-blue-400 hover:text-blue-300" data-time="${seekTimeInSeconds}">${displayTime}</span>`
+        })
+        .replace(timeMarkerRegex, (match) => {
+          const seekTimeInSeconds = convertToSeconds(match)
+          return `<span class="time-marker cursor-pointer text-blue-400 hover:text-blue-300" data-time="${seekTimeInSeconds}">${match}</span>`
+        })
+    }
+  },
   mounted() {}
 }
 </script>
diff --git a/client/components/player/PlayerUi.vue b/client/components/player/PlayerUi.vue
index 82d53552..f929943c 100644
--- a/client/components/player/PlayerUi.vue
+++ b/client/components/player/PlayerUi.vue
@@ -129,9 +129,6 @@ export default {
         return `${hoursRounded}h`
       }
     },
-    token() {
-      return this.$store.getters['user/getToken']
-    },
     timeRemaining() {
       if (this.useChapterTrack && this.currentChapter) {
         var currChapTime = this.currentTime - this.currentChapter.start
diff --git a/client/components/readers/ComicReader.vue b/client/components/readers/ComicReader.vue
index 28d79bf2..fce26939 100644
--- a/client/components/readers/ComicReader.vue
+++ b/client/components/readers/ComicReader.vue
@@ -104,9 +104,6 @@ export default {
     }
   },
   computed: {
-    userToken() {
-      return this.$store.getters['user/getToken']
-    },
     libraryItemId() {
       return this.libraryItem?.id
     },
@@ -234,10 +231,7 @@ export default {
     async extract() {
       this.loading = true
       var buff = await this.$axios.$get(this.ebookUrl, {
-        responseType: 'blob',
-        headers: {
-          Authorization: `Bearer ${this.userToken}`
-        }
+        responseType: 'blob'
       })
       const archive = await Archive.open(buff)
       const originalFilesObject = await archive.getFilesObject()
diff --git a/client/components/readers/EpubReader.vue b/client/components/readers/EpubReader.vue
index 350d8596..a4c51539 100644
--- a/client/components/readers/EpubReader.vue
+++ b/client/components/readers/EpubReader.vue
@@ -57,9 +57,6 @@ export default {
     }
   },
   computed: {
-    userToken() {
-      return this.$store.getters['user/getToken']
-    },
     /** @returns {string} */
     libraryItemId() {
       return this.libraryItem?.id
@@ -97,27 +94,37 @@ export default {
     },
     ebookUrl() {
       if (this.fileId) {
-        return `${this.$config.routerBasePath}/api/items/${this.libraryItemId}/ebook/${this.fileId}`
+        return `/api/items/${this.libraryItemId}/ebook/${this.fileId}`
       }
-      return `${this.$config.routerBasePath}/api/items/${this.libraryItemId}/ebook`
+      return `/api/items/${this.libraryItemId}/ebook`
     },
     themeRules() {
-      const isDark = this.ereaderSettings.theme === 'dark'
-      const fontColor = isDark ? '#fff' : '#000'
-      const backgroundColor = isDark ? 'rgb(35 35 35)' : 'rgb(255, 255, 255)'
+      const theme = this.ereaderSettings.theme
+      const isDark = theme === 'dark'
+      const isSepia = theme === 'sepia'
+
+      const fontColor = isDark
+        ? '#fff'
+        : isSepia
+        ? '#5b4636'
+        : '#000'
+
+      const backgroundColor = isDark
+        ? 'rgb(35 35 35)'
+        : isSepia
+        ? 'rgb(244, 236, 216)'
+        : 'rgb(255, 255, 255)'
 
       const lineSpacing = this.ereaderSettings.lineSpacing / 100
-
-      const fontScale = this.ereaderSettings.fontScale / 100
-
-      const textStroke = this.ereaderSettings.textStroke / 100
+      const fontScale   = this.ereaderSettings.fontScale   / 100
+      const textStroke  = this.ereaderSettings.textStroke  / 100
 
       return {
         '*': {
           color: `${fontColor}!important`,
           'background-color': `${backgroundColor}!important`,
-          'line-height': lineSpacing * fontScale + 'rem!important',
-          '-webkit-text-stroke': textStroke + 'px ' + fontColor + '!important'
+          'line-height': `${lineSpacing * fontScale}rem!important`,
+          '-webkit-text-stroke': `${textStroke}px ${fontColor}!important`
         },
         a: {
           color: `${fontColor}!important`
@@ -309,14 +316,24 @@ export default {
       /** @type {EpubReader} */
       const reader = this
 
+      // Use axios to make request because we have token refresh logic in interceptor
+      const customRequest = async (url) => {
+        try {
+          return this.$axios.$get(url, {
+            responseType: 'arraybuffer'
+          })
+        } catch (error) {
+          console.error('EpubReader.initEpub customRequest failed:', error)
+          throw error
+        }
+      }
+
       /** @type {ePub.Book} */
       reader.book = new ePub(reader.ebookUrl, {
         width: this.readerWidth,
         height: this.readerHeight - 50,
         openAs: 'epub',
-        requestHeaders: {
-          Authorization: `Bearer ${this.userToken}`
-        }
+        requestMethod: customRequest
       })
 
       /** @type {ePub.Rendition} */
@@ -337,29 +354,33 @@ export default {
         this.applyTheme()
       })
 
-      reader.book.ready.then(() => {
-        // set up event listeners
-        reader.rendition.on('relocated', reader.relocated)
-        reader.rendition.on('keydown', reader.keyUp)
+      reader.book.ready
+        .then(() => {
+          // set up event listeners
+          reader.rendition.on('relocated', reader.relocated)
+          reader.rendition.on('keydown', reader.keyUp)
 
-        reader.rendition.on('touchstart', (event) => {
-          this.$emit('touchstart', event)
-        })
-        reader.rendition.on('touchend', (event) => {
-          this.$emit('touchend', event)
-        })
-
-        // load ebook cfi locations
-        const savedLocations = this.loadLocations()
-        if (savedLocations) {
-          reader.book.locations.load(savedLocations)
-        } else {
-          reader.book.locations.generate().then(() => {
-            this.checkSaveLocations(reader.book.locations.save())
+          reader.rendition.on('touchstart', (event) => {
+            this.$emit('touchstart', event)
           })
-        }
-        this.getChapters()
-      })
+          reader.rendition.on('touchend', (event) => {
+            this.$emit('touchend', event)
+          })
+
+          // load ebook cfi locations
+          const savedLocations = this.loadLocations()
+          if (savedLocations) {
+            reader.book.locations.load(savedLocations)
+          } else {
+            reader.book.locations.generate().then(() => {
+              this.checkSaveLocations(reader.book.locations.save())
+            })
+          }
+          this.getChapters()
+        })
+        .catch((error) => {
+          console.error('EpubReader.initEpub failed:', error)
+        })
     },
     getChapters() {
       // Load the list of chapters in the book. See https://github.com/futurepress/epub.js/issues/759
diff --git a/client/components/readers/MobiReader.vue b/client/components/readers/MobiReader.vue
index 3e784f77..459ae55b 100644
--- a/client/components/readers/MobiReader.vue
+++ b/client/components/readers/MobiReader.vue
@@ -26,9 +26,6 @@ export default {
     return {}
   },
   computed: {
-    userToken() {
-      return this.$store.getters['user/getToken']
-    },
     libraryItemId() {
       return this.libraryItem?.id
     },
@@ -96,11 +93,8 @@ export default {
     },
     async initMobi() {
       // Fetch mobi file as blob
-      var buff = await this.$axios.$get(this.ebookUrl, {
-        responseType: 'blob',
-        headers: {
-          Authorization: `Bearer ${this.userToken}`
-        }
+      const buff = await this.$axios.$get(this.ebookUrl, {
+        responseType: 'blob'
       })
       var reader = new FileReader()
       reader.onload = async (event) => {
diff --git a/client/components/readers/PdfReader.vue b/client/components/readers/PdfReader.vue
index c05f459c..d9459d76 100644
--- a/client/components/readers/PdfReader.vue
+++ b/client/components/readers/PdfReader.vue
@@ -55,7 +55,8 @@ export default {
       loadedRatio: 0,
       page: 1,
       numPages: 0,
-      pdfDocInitParams: null
+      pdfDocInitParams: null,
+      isRefreshing: false
     }
   },
   computed: {
@@ -152,7 +153,34 @@ export default {
       this.page++
       this.updateProgress()
     },
-    error(err) {
+    async refreshToken() {
+      if (this.isRefreshing) return
+      this.isRefreshing = true
+      const newAccessToken = await this.$store.dispatch('user/refreshToken').catch((error) => {
+        console.error('Failed to refresh token', error)
+        return null
+      })
+      if (!newAccessToken) {
+        // Redirect to login on failed refresh
+        this.$router.push('/login')
+        return
+      }
+
+      // Force Vue to re-render the PDF component by creating a new object
+      this.pdfDocInitParams = {
+        url: this.ebookUrl,
+        httpHeaders: {
+          Authorization: `Bearer ${newAccessToken}`
+        }
+      }
+      this.isRefreshing = false
+    },
+    async error(err) {
+      if (err && err.status === 401) {
+        console.log('Received 401 error, refreshing token')
+        await this.refreshToken()
+        return
+      }
       console.error(err)
     },
     resize() {
diff --git a/client/components/readers/Reader.vue b/client/components/readers/Reader.vue
index c2e5986e..9063479d 100644
--- a/client/components/readers/Reader.vue
+++ b/client/components/readers/Reader.vue
@@ -1,5 +1,5 @@
 <template>
-  <div v-if="show" id="reader" :data-theme="ereaderTheme" class="group absolute top-0 left-0 w-full z-60 data-[theme=dark]:bg-primary data-[theme=dark]:text-white data-[theme=light]:bg-white data-[theme=light]:text-black" :class="{ 'reader-player-open': !!streamLibraryItem }">
+  <div v-if="show" id="reader" :data-theme="ereaderTheme" class="group absolute top-0 left-0 w-full z-60 data-[theme=dark]:bg-primary data-[theme=dark]:text-white data-[theme=light]:bg-white data-[theme=light]:text-black data-[theme=sepia]:bg-[rgb(244,236,216)] data-[theme=sepia]:text-[#5b4636]" :class="{ 'reader-player-open': !!streamLibraryItem }">
     <div class="absolute top-4 left-4 z-20 flex items-center">
       <button v-if="isEpub" @click="toggleToC" type="button" aria-label="Table of contents menu" class="inline-flex opacity-80 hover:opacity-100">
         <span class="material-symbols text-2xl">menu</span>
@@ -27,7 +27,12 @@
 
     <!-- TOC side nav -->
     <div v-if="tocOpen" class="w-full h-full overflow-y-scroll absolute inset-0 bg-black/20 z-20" @click.stop.prevent="toggleToC"></div>
-    <div v-if="isEpub" class="w-96 h-full max-h-full absolute top-0 left-0 shadow-xl transition-transform z-30 group-data-[theme=dark]:bg-primary group-data-[theme=dark]:text-white group-data-[theme=light]:bg-white group-data-[theme=light]:text-black" :class="tocOpen ? 'translate-x-0' : '-translate-x-96'" @click.stop.prevent>
+    <div
+      v-if="isEpub"
+      class="w-96 h-full max-h-full absolute top-0 left-0 shadow-xl transition-transform z-30 group-data-[theme=dark]:bg-primary group-data-[theme=dark]:text-white group-data-[theme=light]:bg-white group-data-[theme=light]:text-black group-data-[theme=sepia]:bg-[rgb(244,236,216)] group-data-[theme=sepia]:text-[#5b4636]"
+      :class="tocOpen ? 'translate-x-0' : '-translate-x-96'"
+      @click.stop.prevent
+    >
       <div class="flex flex-col p-4 h-full">
         <div class="flex items-center mb-2">
           <button @click.stop.prevent="toggleToC" type="button" aria-label="Close table of contents" class="inline-flex opacity-80 hover:opacity-100">
@@ -37,7 +42,7 @@
           <p class="text-lg font-semibold ml-2">{{ $strings.HeaderTableOfContents }}</p>
         </div>
         <form @submit.prevent="searchBook" @click.stop.prevent>
-          <ui-text-input clearable ref="input" @clear="searchBook" v-model="searchQuery" :placeholder="$strings.PlaceholderSearch" class="h-8 w-full text-sm flex mb-2" />
+          <ui-text-input clearable ref="input" @clear="searchBook" v-model="searchQuery" :placeholder="$strings.PlaceholderSearch" custom-input-class="text-inherit !bg-inherit" class="h-8 w-full text-sm flex mb-2" />
         </form>
 
         <div class="overflow-y-auto">
@@ -181,6 +186,10 @@ export default {
             text: this.$strings.LabelThemeDark,
             value: 'dark'
           },
+          {
+            text: this.$strings.LabelThemeSepia,
+            value: 'sepia'
+          },
           {
             text: this.$strings.LabelThemeLight,
             value: 'light'
@@ -266,9 +275,6 @@ export default {
     isComic() {
       return this.ebookFormat == 'cbz' || this.ebookFormat == 'cbr'
     },
-    userToken() {
-      return this.$store.getters['user/getToken']
-    },
     keepProgress() {
       return this.$store.state.ereaderKeepProgress
     },
diff --git a/client/components/tables/ApiKeysTable.vue b/client/components/tables/ApiKeysTable.vue
new file mode 100644
index 00000000..feab4e68
--- /dev/null
+++ b/client/components/tables/ApiKeysTable.vue
@@ -0,0 +1,177 @@
+<template>
+  <div>
+    <div class="text-center">
+      <table v-if="apiKeys.length > 0" id="api-keys">
+        <tr>
+          <th>{{ $strings.LabelName }}</th>
+          <th class="w-44">{{ $strings.LabelApiKeyUser }}</th>
+          <th class="w-32">{{ $strings.LabelExpiresAt }}</th>
+          <th class="w-32">{{ $strings.LabelCreatedAt }}</th>
+          <th class="w-32"></th>
+        </tr>
+        <tr v-for="apiKey in apiKeys" :key="apiKey.id" :class="apiKey.isActive ? '' : 'bg-error/10!'">
+          <td>
+            <div class="flex items-center">
+              <p class="pl-2 truncate">{{ apiKey.name }}</p>
+            </div>
+          </td>
+          <td class="text-xs">
+            <nuxt-link v-if="apiKey.user" :to="`/config/users/${apiKey.user.id}`" class="text-xs hover:underline">
+              {{ apiKey.user.username }}
+            </nuxt-link>
+            <p v-else class="text-xs">Error</p>
+          </td>
+          <td class="text-xs">
+            <p v-if="apiKey.expiresAt" class="text-xs" :title="apiKey.expiresAt">{{ getExpiresAtText(apiKey) }}</p>
+            <p v-else class="text-xs">{{ $strings.LabelExpiresNever }}</p>
+          </td>
+          <td class="text-xs font-mono">
+            <ui-tooltip direction="top" :text="$formatJsDatetime(new Date(apiKey.createdAt), dateFormat, timeFormat)">
+              {{ $formatJsDate(new Date(apiKey.createdAt), dateFormat) }}
+            </ui-tooltip>
+          </td>
+          <td class="py-0">
+            <div class="w-full flex justify-left">
+              <div class="h-8 w-8 flex items-center justify-center text-white/50 hover:text-white/100 cursor-pointer" @click.stop="editApiKey(apiKey)">
+                <button type="button" :aria-label="$strings.ButtonEdit" class="material-symbols text-base">edit</button>
+              </div>
+              <div class="h-8 w-8 flex items-center justify-center text-white/50 hover:text-error cursor-pointer" @click.stop="deleteApiKeyClick(apiKey)">
+                <button type="button" :aria-label="$strings.ButtonDelete" class="material-symbols text-base">delete</button>
+              </div>
+            </div>
+          </td>
+        </tr>
+      </table>
+      <p v-else class="text-base text-gray-300 py-4">{{ $strings.LabelNoApiKeys }}</p>
+    </div>
+  </div>
+</template>
+
+<script>
+export default {
+  data() {
+    return {
+      apiKeys: [],
+      isDeletingApiKey: false
+    }
+  },
+  computed: {
+    dateFormat() {
+      return this.$store.state.serverSettings.dateFormat
+    },
+    timeFormat() {
+      return this.$store.state.serverSettings.timeFormat
+    }
+  },
+  methods: {
+    getExpiresAtText(apiKey) {
+      if (new Date(apiKey.expiresAt).getTime() < Date.now()) {
+        return this.$strings.LabelExpired
+      }
+      return this.$formatJsDatetime(new Date(apiKey.expiresAt), this.dateFormat, this.timeFormat)
+    },
+    deleteApiKeyClick(apiKey) {
+      if (this.isDeletingApiKey) return
+
+      const payload = {
+        message: this.$getString('MessageConfirmDeleteApiKey', [apiKey.name]),
+        callback: (confirmed) => {
+          if (confirmed) {
+            this.deleteApiKey(apiKey)
+          }
+        },
+        type: 'yesNo'
+      }
+      this.$store.commit('globals/setConfirmPrompt', payload)
+    },
+    deleteApiKey(apiKey) {
+      this.isDeletingApiKey = true
+      this.$axios
+        .$delete(`/api/api-keys/${apiKey.id}`)
+        .then((data) => {
+          if (data.error) {
+            this.$toast.error(data.error)
+          } else {
+            this.removeApiKey(apiKey.id)
+            this.$emit('numApiKeys', this.apiKeys.length)
+          }
+        })
+        .catch((error) => {
+          console.error('Failed to delete apiKey', error)
+          this.$toast.error(this.$strings.ToastFailedToDelete)
+        })
+        .finally(() => {
+          this.isDeletingApiKey = false
+        })
+    },
+    editApiKey(apiKey) {
+      this.$emit('edit', apiKey)
+    },
+    addApiKey(apiKey) {
+      this.apiKeys.push(apiKey)
+    },
+    removeApiKey(apiKeyId) {
+      this.apiKeys = this.apiKeys.filter((a) => a.id !== apiKeyId)
+    },
+    updateApiKey(apiKey) {
+      this.apiKeys = this.apiKeys.map((a) => (a.id === apiKey.id ? apiKey : a))
+    },
+    loadApiKeys() {
+      this.$axios
+        .$get('/api/api-keys')
+        .then((res) => {
+          this.apiKeys = res.apiKeys.sort((a, b) => {
+            return a.createdAt - b.createdAt
+          })
+          this.$emit('numApiKeys', this.apiKeys.length)
+        })
+        .catch((error) => {
+          console.error('Failed to load apiKeys', error)
+        })
+    }
+  },
+  mounted() {
+    this.loadApiKeys()
+  }
+}
+</script>
+
+<style>
+#api-keys {
+  table-layout: fixed;
+  border-collapse: collapse;
+  border: 1px solid #474747;
+  width: 100%;
+}
+
+#api-keys td,
+#api-keys th {
+  /* border: 1px solid #2e2e2e; */
+  padding: 8px 8px;
+  text-align: left;
+}
+
+#api-keys td.py-0 {
+  padding: 0px 8px;
+}
+
+#api-keys tr:nth-child(even) {
+  background-color: #373838;
+}
+
+#api-keys tr:nth-child(odd) {
+  background-color: #2f2f2f;
+}
+
+#api-keys tr:hover {
+  background-color: #444;
+}
+
+#api-keys th {
+  font-size: 0.8rem;
+  font-weight: 600;
+  padding-top: 5px;
+  padding-bottom: 5px;
+  background-color: #272727;
+}
+</style>
diff --git a/client/components/tables/BackupsTable.vue b/client/components/tables/BackupsTable.vue
index 769c8d25..f769abdb 100644
--- a/client/components/tables/BackupsTable.vue
+++ b/client/components/tables/BackupsTable.vue
@@ -78,10 +78,10 @@ export default {
       return this.$store.getters['user/getToken']
     },
     dateFormat() {
-      return this.$store.state.serverSettings.dateFormat
+      return this.$store.getters['getServerSetting']('dateFormat')
     },
     timeFormat() {
-      return this.$store.state.serverSettings.timeFormat
+      return this.$store.getters['getServerSetting']('timeFormat')
     }
   },
   methods: {
diff --git a/client/components/tables/EbookFilesTable.vue b/client/components/tables/EbookFilesTable.vue
index cc968acd..3ce9d30f 100644
--- a/client/components/tables/EbookFilesTable.vue
+++ b/client/components/tables/EbookFilesTable.vue
@@ -49,9 +49,6 @@ export default {
     libraryItemId() {
       return this.libraryItem.id
     },
-    userToken() {
-      return this.$store.getters['user/getToken']
-    },
     userCanDownload() {
       return this.$store.getters['user/getUserCanDownload']
     },
diff --git a/client/components/tables/LibraryFilesTable.vue b/client/components/tables/LibraryFilesTable.vue
index 9be7e249..6f6e74b8 100644
--- a/client/components/tables/LibraryFilesTable.vue
+++ b/client/components/tables/LibraryFilesTable.vue
@@ -53,9 +53,6 @@ export default {
     libraryItemId() {
       return this.libraryItem.id
     },
-    userToken() {
-      return this.$store.getters['user/getToken']
-    },
     userCanDownload() {
       return this.$store.getters['user/getUserCanDownload']
     },
diff --git a/client/components/tables/UsersTable.vue b/client/components/tables/UsersTable.vue
index 20f41228..c7171018 100644
--- a/client/components/tables/UsersTable.vue
+++ b/client/components/tables/UsersTable.vue
@@ -76,10 +76,10 @@ export default {
       return usermap
     },
     dateFormat() {
-      return this.$store.state.serverSettings.dateFormat
+      return this.$store.getters['getServerSetting']('dateFormat')
     },
     timeFormat() {
-      return this.$store.state.serverSettings.timeFormat
+      return this.$store.getters['getServerSetting']('timeFormat')
     }
   },
   methods: {
diff --git a/client/components/tables/podcast/LazyEpisodeRow.vue b/client/components/tables/podcast/LazyEpisodeRow.vue
index ae99e6d3..ee189961 100644
--- a/client/components/tables/podcast/LazyEpisodeRow.vue
+++ b/client/components/tables/podcast/LazyEpisodeRow.vue
@@ -112,7 +112,7 @@ export default {
       return this.episode?.publishedAt
     },
     dateFormat() {
-      return this.store.state.serverSettings.dateFormat
+      return this.store.getters['getServerSetting']('dateFormat')
     },
     itemProgress() {
       return this.store.getters['user/getUserMediaProgress'](this.libraryItemId, this.episodeId)
diff --git a/client/components/tables/podcast/LazyEpisodesTable.vue b/client/components/tables/podcast/LazyEpisodesTable.vue
index b23cc560..d23ee3d3 100644
--- a/client/components/tables/podcast/LazyEpisodesTable.vue
+++ b/client/components/tables/podcast/LazyEpisodesTable.vue
@@ -239,10 +239,10 @@ export default {
       })
     },
     dateFormat() {
-      return this.$store.state.serverSettings.dateFormat
+      return this.$store.getters['getServerSetting']('dateFormat')
     },
     timeFormat() {
-      return this.$store.state.serverSettings.timeFormat
+      return this.$store.getters['getServerSetting']('timeFormat')
     }
   },
   methods: {
diff --git a/client/components/ui/MultiSelectQueryInput.vue b/client/components/ui/MultiSelectQueryInput.vue
index 6de16bf2..18abc66e 100644
--- a/client/components/ui/MultiSelectQueryInput.vue
+++ b/client/components/ui/MultiSelectQueryInput.vue
@@ -85,9 +85,6 @@ export default {
         this.$emit('input', val)
       }
     },
-    userToken() {
-      return this.$store.getters['user/getToken']
-    },
     wrapperClass() {
       var classes = []
       if (this.disabled) classes.push('bg-black-300')
diff --git a/client/components/ui/SelectInput.vue b/client/components/ui/SelectInput.vue
index 9e0961c1..f38414ac 100644
--- a/client/components/ui/SelectInput.vue
+++ b/client/components/ui/SelectInput.vue
@@ -1,9 +1,9 @@
 <template>
   <div class="relative w-full">
-    <p v-if="label" class="text-sm font-semibold px-1" :class="disabled ? 'text-gray-300' : ''">{{ label }}</p>
+    <p v-if="label && !labelHidden" class="text-sm font-semibold px-1" :class="disabled ? 'text-gray-300' : ''">{{ label }}</p>
     <button ref="buttonWrapper" type="button" :aria-label="longLabel" :disabled="disabled" class="relative w-full border rounded-sm shadow-xs pl-3 pr-8 py-2 text-left sm:text-sm" :class="buttonClass" aria-haspopup="listbox" aria-expanded="true" @click.stop.prevent="clickShowMenu">
       <span class="flex items-center">
-        <span class="block truncate font-sans" :class="{ 'font-semibold': selectedSubtext, 'text-sm': small }">{{ selectedText }}</span>
+        <span class="block truncate font-sans" :class="{ 'font-semibold': selectedSubtext, 'text-sm': small, 'text-gray-400': !selectedText }">{{ selectedText || placeholder }}</span>
         <span v-if="selectedSubtext">:&nbsp;</span>
         <span v-if="selectedSubtext" class="font-normal block truncate font-sans text-sm text-gray-400">{{ selectedSubtext }}</span>
       </span>
@@ -36,10 +36,15 @@ export default {
       type: String,
       default: ''
     },
+    labelHidden: Boolean,
     items: {
       type: Array,
       default: () => []
     },
+    placeholder: {
+      type: String,
+      default: ''
+    },
     disabled: Boolean,
     small: Boolean,
     menuMaxHeight: {
diff --git a/client/components/ui/TextInputWithLabel.vue b/client/components/ui/TextInputWithLabel.vue
index 3d1c8209..81c5516b 100644
--- a/client/components/ui/TextInputWithLabel.vue
+++ b/client/components/ui/TextInputWithLabel.vue
@@ -6,7 +6,7 @@
         <em v-if="note" class="font-normal text-xs pl-2">{{ note }}</em>
       </label>
     </slot>
-    <ui-text-input :placeholder="placeholder || label" :inputId="identifier" ref="input" v-model="inputValue" :disabled="disabled" :readonly="readonly" :type="type" :show-copy="showCopy" class="w-full" :class="inputClass" :trim-whitespace="trimWhitespace" @blur="inputBlurred" />
+    <ui-text-input :placeholder="placeholder || label" :inputId="identifier" ref="input" v-model="inputValue" :disabled="disabled" :readonly="readonly" :type="type" :min="min" :show-copy="showCopy" class="w-full" :class="inputClass" :trim-whitespace="trimWhitespace" @blur="inputBlurred" />
   </div>
 </template>
 
@@ -21,6 +21,7 @@ export default {
       type: String,
       default: 'text'
     },
+    min: [String, Number],
     readonly: Boolean,
     disabled: Boolean,
     inputClass: String,
diff --git a/client/components/widgets/CronExpressionBuilder.vue b/client/components/widgets/CronExpressionBuilder.vue
index 77b5a54c..600ed81a 100644
--- a/client/components/widgets/CronExpressionBuilder.vue
+++ b/client/components/widgets/CronExpressionBuilder.vue
@@ -85,7 +85,7 @@ export default {
     nextRun() {
       if (!this.cronExpression) return ''
       const parsed = this.$getNextScheduledDate(this.cronExpression)
-      return this.$formatJsDatetime(parsed, this.$store.state.serverSettings.dateFormat, this.$store.state.serverSettings.timeFormat) || ''
+      return this.$formatJsDatetime(parsed, this.$store.getters['getServerSetting']('dateFormat'), this.$store.getters['getServerSetting']('timeFormat')) || ''
     },
     description() {
       if ((this.selectedInterval !== 'custom' || !this.selectedWeekdays.length) && this.selectedInterval !== 'daily') return ''
diff --git a/client/cypress/tests/components/cards/LazySeriesCard.cy.js b/client/cypress/tests/components/cards/LazySeriesCard.cy.js
index 346259d2..12eec692 100644
--- a/client/cypress/tests/components/cards/LazySeriesCard.cy.js
+++ b/client/cypress/tests/components/cards/LazySeriesCard.cy.js
@@ -40,6 +40,7 @@ describe('LazySeriesCard', () => {
     },
     $store: {
       getters: {
+        getServerSetting: () => 'MM/dd/yyyy',
         'user/getUserCanUpdate': true,
         'user/getUserMediaProgress': (id) => null,
         'user/getSizeMultiplier': 1,
diff --git a/client/layouts/default.vue b/client/layouts/default.vue
index 33e7aa15..9f15af67 100644
--- a/client/layouts/default.vue
+++ b/client/layouts/default.vue
@@ -33,6 +33,7 @@ export default {
     return {
       socket: null,
       isSocketConnected: false,
+      isSocketAuthenticated: false,
       isFirstSocketConnection: true,
       socketConnectionToastId: null,
       currentLang: null,
@@ -81,9 +82,28 @@ export default {
         document.body.classList.add('app-bar')
       }
     },
+    tokenRefreshed(newAccessToken) {
+      if (this.isSocketConnected && !this.isSocketAuthenticated) {
+        console.log('[SOCKET] Re-authenticating socket after token refresh')
+        this.socket.emit('auth', newAccessToken)
+      }
+    },
     updateSocketConnectionToast(content, type, timeout) {
       if (this.socketConnectionToastId !== null && this.socketConnectionToastId !== undefined) {
-        this.$toast.update(this.socketConnectionToastId, { content: content, options: { timeout: timeout, type: type, closeButton: false, position: 'bottom-center', onClose: () => null, closeOnClick: timeout !== null } }, false)
+        const toastUpdateOptions = {
+          content: content,
+          options: {
+            timeout: timeout,
+            type: type,
+            closeButton: false,
+            position: 'bottom-center',
+            onClose: () => {
+              this.socketConnectionToastId = null
+            },
+            closeOnClick: timeout !== null
+          }
+        }
+        this.$toast.update(this.socketConnectionToastId, toastUpdateOptions, false)
       } else {
         this.socketConnectionToastId = this.$toast[type](content, { position: 'bottom-center', timeout: timeout, closeButton: false, closeOnClick: timeout !== null })
       }
@@ -109,7 +129,7 @@ export default {
       this.updateSocketConnectionToast(this.$strings.ToastSocketDisconnected, 'error', null)
     },
     reconnect() {
-      console.error('[SOCKET] reconnected')
+      console.log('[SOCKET] reconnected')
     },
     reconnectAttempt(val) {
       console.log(`[SOCKET] reconnect attempt ${val}`)
@@ -120,6 +140,10 @@ export default {
     reconnectFailed() {
       console.error('[SOCKET] reconnect failed')
     },
+    authFailed(payload) {
+      console.error('[SOCKET] auth failed', payload.message)
+      this.isSocketAuthenticated = false
+    },
     init(payload) {
       console.log('Init Payload', payload)
 
@@ -127,7 +151,7 @@ export default {
         this.$store.commit('users/setUsersOnline', payload.usersOnline)
       }
 
-      this.$eventBus.$emit('socket_init')
+      this.isSocketAuthenticated = true
     },
     streamOpen(stream) {
       if (this.$refs.mediaPlayerContainer) this.$refs.mediaPlayerContainer.streamOpen(stream)
@@ -354,6 +378,15 @@ export default {
       this.$store.commit('scanners/removeCustomMetadataProvider', provider)
     },
     initializeSocket() {
+      if (this.$root.socket) {
+        // Can happen in dev due to hot reload
+        console.warn('Socket already initialized')
+        this.socket = this.$root.socket
+        this.isSocketConnected = this.$root.socket?.connected
+        this.isFirstSocketConnection = false
+        this.socketConnectionToastId = null
+        return
+      }
       this.socket = this.$nuxtSocket({
         name: process.env.NODE_ENV === 'development' ? 'dev' : 'prod',
         persist: 'main',
@@ -364,6 +397,7 @@ export default {
         path: `${this.$config.routerBasePath}/socket.io`
       })
       this.$root.socket = this.socket
+      this.isSocketAuthenticated = false
       console.log('Socket initialized')
 
       // Pre-defined socket events
@@ -377,6 +411,7 @@ export default {
 
       // Event received after authorizing socket
       this.socket.on('init', this.init)
+      this.socket.on('auth_failed', this.authFailed)
 
       // Stream Listeners
       this.socket.on('stream_open', this.streamOpen)
@@ -571,6 +606,7 @@ export default {
     this.updateBodyClass()
     this.resize()
     this.$eventBus.$on('change-lang', this.changeLanguage)
+    this.$eventBus.$on('token_refreshed', this.tokenRefreshed)
     window.addEventListener('resize', this.resize)
     window.addEventListener('keydown', this.keyDown)
 
@@ -594,6 +630,7 @@ export default {
   },
   beforeDestroy() {
     this.$eventBus.$off('change-lang', this.changeLanguage)
+    this.$eventBus.$off('token_refreshed', this.tokenRefreshed)
     window.removeEventListener('resize', this.resize)
     window.removeEventListener('keydown', this.keyDown)
   }
diff --git a/client/nuxt.config.js b/client/nuxt.config.js
index f54d1cf4..7219c784 100644
--- a/client/nuxt.config.js
+++ b/client/nuxt.config.js
@@ -73,7 +73,8 @@ module.exports = {
 
   // Axios module configuration: https://go.nuxtjs.dev/config-axios
   axios: {
-    baseURL: routerBasePath
+    baseURL: routerBasePath,
+    progress: false
   },
 
   // nuxt/pwa https://pwa.nuxtjs.org
diff --git a/client/package-lock.json b/client/package-lock.json
index 23ec14a9..5dc4883a 100644
--- a/client/package-lock.json
+++ b/client/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "audiobookshelf-client",
-  "version": "2.24.0",
+  "version": "2.26.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "audiobookshelf-client",
-      "version": "2.24.0",
+      "version": "2.26.3",
       "license": "ISC",
       "dependencies": {
         "@nuxtjs/axios": "^5.13.6",
diff --git a/client/package.json b/client/package.json
index 7985cd78..78811710 100644
--- a/client/package.json
+++ b/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "audiobookshelf-client",
-  "version": "2.24.0",
+  "version": "2.26.3",
   "buildNumber": 1,
   "description": "Self-hosted audiobook and podcast client",
   "main": "index.js",
diff --git a/client/pages/account.vue b/client/pages/account.vue
index b157f570..e9b5da3c 100644
--- a/client/pages/account.vue
+++ b/client/pages/account.vue
@@ -182,18 +182,19 @@ export default {
           password: this.password,
           newPassword: this.newPassword
         })
-        .then((res) => {
-          if (res.success) {
-            this.$toast.success(this.$strings.ToastUserPasswordChangeSuccess)
-            this.resetForm()
-          } else {
-            this.$toast.error(res.error || this.$strings.ToastUnknownError)
-          }
-          this.changingPassword = false
+        .then(() => {
+          this.$toast.success(this.$strings.ToastUserPasswordChangeSuccess)
+          this.resetForm()
         })
         .catch((error) => {
-          console.error(error)
-          this.$toast.error(this.$strings.ToastUnknownError)
+          console.error('Failed to change password', error)
+          let errorMessage = this.$strings.ToastUnknownError
+          if (error.response?.data && typeof error.response.data === 'string') {
+            errorMessage = error.response.data
+          }
+          this.$toast.error(errorMessage)
+        })
+        .finally(() => {
           this.changingPassword = false
         })
     },
diff --git a/client/pages/audiobook/_id/manage.vue b/client/pages/audiobook/_id/manage.vue
index 37734934..40672af2 100644
--- a/client/pages/audiobook/_id/manage.vue
+++ b/client/pages/audiobook/_id/manage.vue
@@ -28,14 +28,14 @@
     <div class="flex justify-center flex-wrap lg:flex-nowrap gap-4">
       <div class="w-full max-w-2xl border border-white/10 bg-bg">
         <div class="flex py-2 px-4">
-          <div class="w-1/3 text-xs font-semibold uppercase text-gray-200">{{ $strings.LabelMetaTag }}</div>
-          <div class="w-2/3 text-xs font-semibold uppercase text-gray-200">{{ $strings.LabelValue }}</div>
+          <div class="w-28 min-w-28 text-xs font-semibold uppercase text-gray-200">{{ $strings.LabelMetaTag }}</div>
+          <div class="grow text-xs font-semibold uppercase text-gray-200">{{ $strings.LabelValue }}</div>
         </div>
         <div class="w-full max-h-72 overflow-auto">
           <template v-for="(value, key, index) in metadataObject">
             <div :key="key" class="flex py-1 px-4 text-sm" :class="index % 2 === 0 ? 'bg-primary/25' : ''">
-              <div class="w-1/3 font-semibold">{{ key }}</div>
-              <div class="w-2/3">
+              <div class="w-28 min-w-28 font-semibold">{{ key }}</div>
+              <div class="grow">
                 {{ value }}
               </div>
             </div>
@@ -45,18 +45,18 @@
       <div class="w-full max-w-2xl border border-white/10 bg-bg">
         <div class="flex py-2 px-4 bg-primary/25">
           <div class="grow text-xs font-semibold uppercase text-gray-200">{{ $strings.LabelChapterTitle }}</div>
-          <div class="w-24 text-xs font-semibold uppercase text-gray-200">{{ $strings.LabelStart }}</div>
-          <div class="w-24 text-xs font-semibold uppercase text-gray-200">{{ $strings.LabelEnd }}</div>
+          <div class="w-16 min-w-16 text-xs font-semibold uppercase text-gray-200">{{ $strings.LabelStart }}</div>
+          <div class="w-16 min-w-16 text-xs font-semibold uppercase text-gray-200">{{ $strings.LabelEnd }}</div>
         </div>
         <div class="w-full max-h-72 overflow-auto">
           <p v-if="!metadataChapters.length" class="py-5 text-center text-gray-200">{{ $strings.MessageNoChapters }}</p>
           <template v-for="(chapter, index) in metadataChapters">
             <div :key="index" class="flex py-1 px-4 text-sm" :class="index % 2 === 1 ? 'bg-primary/25' : ''">
               <div class="grow font-semibold">{{ chapter.title }}</div>
-              <div class="w-24">
+              <div class="w-16 min-w-16">
                 {{ $secondsToTimestamp(chapter.start) }}
               </div>
-              <div class="w-24">
+              <div class="w-16 min-w-16">
                 {{ $secondsToTimestamp(chapter.end) }}
               </div>
             </div>
diff --git a/client/pages/config.vue b/client/pages/config.vue
index 5fa145e5..c4fe2446 100644
--- a/client/pages/config.vue
+++ b/client/pages/config.vue
@@ -53,6 +53,7 @@ export default {
         else if (pageName === 'sessions') return this.$strings.HeaderListeningSessions
         else if (pageName === 'stats') return this.$strings.HeaderYourStats
         else if (pageName === 'users') return this.$strings.HeaderUsers
+        else if (pageName === 'api-keys') return this.$strings.HeaderApiKeys
         else if (pageName === 'item-metadata-utils') return this.$strings.HeaderItemMetadataUtils
         else if (pageName === 'rss-feeds') return this.$strings.HeaderRSSFeeds
         else if (pageName === 'email') return this.$strings.HeaderEmail
diff --git a/client/pages/config/api-keys/index.vue b/client/pages/config/api-keys/index.vue
new file mode 100644
index 00000000..2523feed
--- /dev/null
+++ b/client/pages/config/api-keys/index.vue
@@ -0,0 +1,84 @@
+<template>
+  <div>
+    <app-settings-content :header-text="$strings.HeaderApiKeys">
+      <template #header-items>
+        <div v-if="numApiKeys" class="mx-2 px-1.5 rounded-lg bg-primary/50 text-gray-300/90 text-sm inline-flex items-center justify-center">
+          <span>{{ numApiKeys }}</span>
+        </div>
+
+        <ui-tooltip :text="$strings.LabelClickForMoreInfo" class="inline-flex ml-2">
+          <a href="https://www.audiobookshelf.org/guides/api-keys" target="_blank" class="inline-flex">
+            <span class="material-symbols text-xl w-5 text-gray-200">help_outline</span>
+          </a>
+        </ui-tooltip>
+
+        <div class="grow" />
+
+        <ui-btn color="bg-primary" :disabled="loadingUsers || users.length === 0" small @click="setShowApiKeyModal()">{{ $strings.ButtonAddApiKey }}</ui-btn>
+      </template>
+
+      <tables-api-keys-table ref="apiKeysTable" class="pt-2" @edit="setShowApiKeyModal" @numApiKeys="(count) => (numApiKeys = count)" />
+    </app-settings-content>
+    <modals-api-key-modal ref="apiKeyModal" v-model="showApiKeyModal" :api-key="selectedApiKey" :users="users" @created="apiKeyCreated" @updated="apiKeyUpdated" />
+    <modals-api-key-created-modal ref="apiKeyCreatedModal" v-model="showApiKeyCreatedModal" :api-key="selectedApiKey" />
+  </div>
+</template>
+
+<script>
+export default {
+  asyncData({ store, redirect }) {
+    if (!store.getters['user/getIsAdminOrUp']) {
+      redirect('/')
+    }
+  },
+  data() {
+    return {
+      loadingUsers: false,
+      selectedApiKey: null,
+      showApiKeyModal: false,
+      showApiKeyCreatedModal: false,
+      numApiKeys: 0,
+      users: []
+    }
+  },
+  methods: {
+    apiKeyCreated(apiKey) {
+      this.numApiKeys++
+      this.selectedApiKey = apiKey
+      this.showApiKeyCreatedModal = true
+      if (this.$refs.apiKeysTable) {
+        this.$refs.apiKeysTable.addApiKey(apiKey)
+      }
+    },
+    apiKeyUpdated(apiKey) {
+      if (this.$refs.apiKeysTable) {
+        this.$refs.apiKeysTable.updateApiKey(apiKey)
+      }
+    },
+    setShowApiKeyModal(selectedApiKey) {
+      this.selectedApiKey = selectedApiKey
+      this.showApiKeyModal = true
+    },
+    loadUsers() {
+      this.loadingUsers = true
+      this.$axios
+        .$get('/api/users')
+        .then((res) => {
+          this.users = res.users.sort((a, b) => {
+            return a.createdAt - b.createdAt
+          })
+        })
+        .catch((error) => {
+          console.error('Failed', error)
+        })
+        .finally(() => {
+          this.loadingUsers = false
+        })
+    }
+  },
+  mounted() {
+    this.loadUsers()
+  },
+  beforeDestroy() {}
+}
+</script>
diff --git a/client/pages/config/rss-feeds.vue b/client/pages/config/rss-feeds.vue
index 56823920..b5ba90a3 100644
--- a/client/pages/config/rss-feeds.vue
+++ b/client/pages/config/rss-feeds.vue
@@ -78,10 +78,10 @@ export default {
   },
   computed: {
     dateFormat() {
-      return this.$store.state.serverSettings.dateFormat
+      return this.$store.getters['getServerSetting']('dateFormat')
     },
     timeFormat() {
-      return this.$store.state.serverSettings.timeFormat
+      return this.$store.getters['getServerSetting']('timeFormat')
     }
   },
   methods: {
diff --git a/client/pages/config/sessions.vue b/client/pages/config/sessions.vue
index 0b1bdaa7..86ec7eec 100644
--- a/client/pages/config/sessions.vue
+++ b/client/pages/config/sessions.vue
@@ -6,80 +6,82 @@
       </div>
 
       <div v-if="listeningSessions.length" class="block max-w-full relative">
-        <table class="userSessionsTable">
-          <tr class="bg-primary/40">
-            <th class="w-6 min-w-6 text-left hidden md:table-cell h-11">
-              <ui-checkbox v-model="isAllSelected" :partial="numSelected > 0 && !isAllSelected" small checkbox-bg="bg" />
-            </th>
-            <th v-if="numSelected" class="grow text-left" :colspan="7">
-              <div class="flex items-center">
-                <p>{{ $getString('MessageSelected', [numSelected]) }}</p>
-                <div class="grow" />
-                <ui-btn small color="bg-error" :loading="deletingSessions" @click.stop="removeSessionsClick">{{ $strings.ButtonRemove }}</ui-btn>
-              </div>
-            </th>
-            <th v-if="!numSelected" class="grow sm:grow-0 sm:w-48 sm:max-w-48 text-left group cursor-pointer" @click.stop="sortColumn('displayTitle')">
-              <div class="inline-flex items-center">
-                {{ $strings.LabelItem }} <span :class="{ 'opacity-0 group-hover:opacity-30': !isSortSelected('displayTitle') }" class="material-symbols text-base pl-px">{{ sortDesc ? 'arrow_drop_down' : 'arrow_drop_up' }}</span>
-              </div>
-            </th>
-            <th v-if="!numSelected" class="w-20 min-w-20 text-left hidden md:table-cell">{{ $strings.LabelUser }}</th>
-            <th v-if="!numSelected" class="w-26 min-w-26 text-left hidden md:table-cell group cursor-pointer" @click.stop="sortColumn('playMethod')">
-              <div class="inline-flex items-center">
-                {{ $strings.LabelPlayMethod }} <span :class="{ 'opacity-0 group-hover:opacity-30': !isSortSelected('playMethod') }" class="material-symbols text-base pl-px">{{ sortDesc ? 'arrow_drop_down' : 'arrow_drop_up' }}</span>
-              </div>
-            </th>
-            <th v-if="!numSelected" class="w-32 min-w-32 text-left hidden sm:table-cell">{{ $strings.LabelDeviceInfo }}</th>
-            <th v-if="!numSelected" class="w-24 min-w-24 sm:w-32 sm:min-w-32 group cursor-pointer" @click.stop="sortColumn('timeListening')">
-              <div class="inline-flex items-center">
-                {{ $strings.LabelTimeListened }} <span :class="{ 'opacity-0 group-hover:opacity-30': !isSortSelected('timeListening') }" class="material-symbols text-base pl-px hidden sm:inline-block">{{ sortDesc ? 'arrow_drop_down' : 'arrow_drop_up' }}</span>
-              </div>
-            </th>
-            <th v-if="!numSelected" class="w-24 min-w-24 group cursor-pointer" @click.stop="sortColumn('currentTime')">
-              <div class="inline-flex items-center">
-                {{ $strings.LabelLastTime }} <span :class="{ 'opacity-0 group-hover:opacity-30': !isSortSelected('currentTime') }" class="material-symbols text-base pl-px hidden sm:inline-block">{{ sortDesc ? 'arrow_drop_down' : 'arrow_drop_up' }}</span>
-              </div>
-            </th>
-            <th v-if="!numSelected" class="grow hidden sm:table-cell cursor-pointer group" @click.stop="sortColumn('updatedAt')">
-              <div class="inline-flex items-center">
-                {{ $strings.LabelLastUpdate }} <span :class="{ 'opacity-0 group-hover:opacity-30': !isSortSelected('updatedAt') }" class="material-symbols text-base pl-px">{{ sortDesc ? 'arrow_drop_down' : 'arrow_drop_up' }}</span>
-              </div>
-            </th>
-          </tr>
+        <div class="overflow-x-auto">
+          <table class="userSessionsTable">
+            <tr class="bg-primary/40">
+              <th class="w-6 min-w-6 text-left hidden md:table-cell h-11">
+                <ui-checkbox v-model="isAllSelected" :partial="numSelected > 0 && !isAllSelected" small checkbox-bg="bg" />
+              </th>
+              <th v-if="numSelected" class="grow text-left" :colspan="7">
+                <div class="flex items-center">
+                  <p>{{ $getString('MessageSelected', [numSelected]) }}</p>
+                  <div class="grow" />
+                  <ui-btn small color="bg-error" :loading="deletingSessions" @click.stop="removeSessionsClick">{{ $strings.ButtonRemove }}</ui-btn>
+                </div>
+              </th>
+              <th v-if="!numSelected" class="grow sm:grow-0 sm:w-48 sm:max-w-48 text-left group cursor-pointer" @click.stop="sortColumn('displayTitle')">
+                <div class="inline-flex items-center">
+                  {{ $strings.LabelItem }} <span :class="{ 'opacity-0 group-hover:opacity-30': !isSortSelected('displayTitle') }" class="material-symbols text-base pl-px">{{ sortDesc ? 'arrow_drop_down' : 'arrow_drop_up' }}</span>
+                </div>
+              </th>
+              <th v-if="!numSelected" class="w-20 min-w-20 text-left hidden md:table-cell">{{ $strings.LabelUser }}</th>
+              <th v-if="!numSelected" class="w-26 min-w-26 text-left hidden md:table-cell group cursor-pointer" @click.stop="sortColumn('playMethod')">
+                <div class="inline-flex items-center">
+                  {{ $strings.LabelPlayMethod }} <span :class="{ 'opacity-0 group-hover:opacity-30': !isSortSelected('playMethod') }" class="material-symbols text-base pl-px">{{ sortDesc ? 'arrow_drop_down' : 'arrow_drop_up' }}</span>
+                </div>
+              </th>
+              <th v-if="!numSelected" class="w-32 min-w-32 text-left hidden sm:table-cell">{{ $strings.LabelDeviceInfo }}</th>
+              <th v-if="!numSelected" class="w-24 min-w-24 sm:w-32 sm:min-w-32 group cursor-pointer" @click.stop="sortColumn('timeListening')">
+                <div class="inline-flex items-center">
+                  {{ $strings.LabelTimeListened }} <span :class="{ 'opacity-0 group-hover:opacity-30': !isSortSelected('timeListening') }" class="material-symbols text-base pl-px hidden sm:inline-block">{{ sortDesc ? 'arrow_drop_down' : 'arrow_drop_up' }}</span>
+                </div>
+              </th>
+              <th v-if="!numSelected" class="w-24 min-w-24 group cursor-pointer" @click.stop="sortColumn('currentTime')">
+                <div class="inline-flex items-center">
+                  {{ $strings.LabelLastTime }} <span :class="{ 'opacity-0 group-hover:opacity-30': !isSortSelected('currentTime') }" class="material-symbols text-base pl-px hidden sm:inline-block">{{ sortDesc ? 'arrow_drop_down' : 'arrow_drop_up' }}</span>
+                </div>
+              </th>
+              <th v-if="!numSelected" class="grow hidden sm:table-cell cursor-pointer group" @click.stop="sortColumn('updatedAt')">
+                <div class="inline-flex items-center">
+                  {{ $strings.LabelLastUpdate }} <span :class="{ 'opacity-0 group-hover:opacity-30': !isSortSelected('updatedAt') }" class="material-symbols text-base pl-px">{{ sortDesc ? 'arrow_drop_down' : 'arrow_drop_up' }}</span>
+                </div>
+              </th>
+            </tr>
 
-          <tr v-for="session in listeningSessions" :key="session.id" :class="{ selected: session.selected }" class="cursor-pointer" @click="clickSessionRow(session)">
-            <td class="hidden md:table-cell py-1 max-w-6 relative">
-              <ui-checkbox v-model="session.selected" small checkbox-bg="bg" />
-              <!-- overlay of the checkbox so that the entire box is clickable -->
-              <div class="absolute inset-0 w-full h-full" @click.stop="session.selected = !session.selected" />
-            </td>
-            <td class="py-1 grow sm:grow-0 sm:w-48 sm:max-w-48">
-              <p class="text-xs text-gray-200 truncate">{{ session.displayTitle }}</p>
-              <p class="text-xs text-gray-400 truncate">{{ session.displayAuthor }}</p>
-            </td>
-            <td class="hidden md:table-cell w-20 min-w-20">
-              <p v-if="filteredUserUsername" class="text-xs">{{ filteredUserUsername }}</p>
-              <p v-else class="text-xs">{{ session.user ? session.user.username : 'N/A' }}</p>
-            </td>
-            <td class="hidden md:table-cell w-26 min-w-26">
-              <p class="text-xs">{{ getPlayMethodName(session.playMethod) }}</p>
-            </td>
-            <td class="hidden sm:table-cell max-w-32 min-w-32">
-              <p class="text-xs truncate" v-html="getDeviceInfoString(session.deviceInfo)" />
-            </td>
-            <td class="text-center w-24 min-w-24 sm:w-32 sm:min-w-32">
-              <p class="text-xs font-mono">{{ $elapsedPretty(session.timeListening) }}</p>
-            </td>
-            <td class="text-center hover:underline w-24 min-w-24" @click.stop="clickCurrentTime(session)">
-              <p class="text-xs font-mono">{{ $secondsToTimestamp(session.currentTime) }}</p>
-            </td>
-            <td class="text-center hidden sm:table-cell">
-              <ui-tooltip v-if="session.updatedAt" direction="top" :text="$formatDatetime(session.updatedAt, dateFormat, timeFormat)">
-                <p class="text-xs text-gray-200">{{ $dateDistanceFromNow(session.updatedAt) }}</p>
-              </ui-tooltip>
-            </td>
-          </tr>
-        </table>
+            <tr v-for="session in listeningSessions" :key="session.id" :class="{ selected: session.selected }" class="cursor-pointer" @click="clickSessionRow(session)">
+              <td class="hidden md:table-cell py-1 max-w-6 relative">
+                <ui-checkbox v-model="session.selected" small checkbox-bg="bg" />
+                <!-- overlay of the checkbox so that the entire box is clickable -->
+                <div class="absolute inset-0 w-full h-full" @click.stop="session.selected = !session.selected" />
+              </td>
+              <td class="py-1 grow sm:grow-0 sm:w-48 sm:max-w-48">
+                <p class="text-xs text-gray-200 truncate">{{ session.displayTitle }}</p>
+                <p class="text-xs text-gray-400 truncate">{{ session.displayAuthor }}</p>
+              </td>
+              <td class="hidden md:table-cell w-20 min-w-20">
+                <p v-if="filteredUserUsername" class="text-xs">{{ filteredUserUsername }}</p>
+                <p v-else class="text-xs">{{ session.user ? session.user.username : 'N/A' }}</p>
+              </td>
+              <td class="hidden md:table-cell w-26 min-w-26">
+                <p class="text-xs">{{ getPlayMethodName(session.playMethod) }}</p>
+              </td>
+              <td class="hidden sm:table-cell max-w-32 min-w-32">
+                <p class="text-xs truncate" v-html="getDeviceInfoString(session.deviceInfo)" />
+              </td>
+              <td class="text-center w-24 min-w-24 sm:w-32 sm:min-w-32">
+                <p class="text-xs font-mono">{{ $elapsedPrettyLocalized(session.timeListening) }}</p>
+              </td>
+              <td class="text-center hover:underline w-24 min-w-24" @click.stop="clickCurrentTime(session)">
+                <p class="text-xs font-mono">{{ $secondsToTimestamp(session.currentTime) }}</p>
+              </td>
+              <td class="text-center hidden sm:table-cell">
+                <ui-tooltip v-if="session.updatedAt" direction="top" :text="$formatDatetime(session.updatedAt, dateFormat, timeFormat)">
+                  <p class="text-xs text-gray-200">{{ $dateDistanceFromNow(session.updatedAt) }}</p>
+                </ui-tooltip>
+              </td>
+            </tr>
+          </table>
+        </div>
         <!-- table bottom options -->
         <div class="flex items-center my-2">
           <div class="grow" />
@@ -250,10 +252,10 @@ export default {
       return user?.username || null
     },
     dateFormat() {
-      return this.$store.state.serverSettings.dateFormat
+      return this.$store.getters['getServerSetting']('dateFormat')
     },
     timeFormat() {
-      return this.$store.state.serverSettings.timeFormat
+      return this.$store.getters['getServerSetting']('timeFormat')
     },
     numSelected() {
       return this.listeningSessions.filter((s) => s.selected).length
diff --git a/client/pages/config/users/_id/index.vue b/client/pages/config/users/_id/index.vue
index e2f8e208..34a0fc86 100644
--- a/client/pages/config/users/_id/index.vue
+++ b/client/pages/config/users/_id/index.vue
@@ -13,8 +13,10 @@
         <widgets-online-indicator :value="!!userOnline" />
         <h1 class="text-xl pl-2">{{ username }}</h1>
       </div>
-      <div v-if="userToken" class="flex text-xs mt-4">
-        <ui-text-input-with-label :label="$strings.LabelApiToken" :value="userToken" readonly show-copy />
+      <div v-if="legacyToken" class="text-xs space-y-2 mt-4">
+        <ui-text-input-with-label label="Legacy API Token" :value="legacyToken" readonly show-copy />
+
+        <p class="text-warning" v-html="$strings.MessageAuthenticationLegacyTokenWarning" />
       </div>
       <div class="w-full h-px bg-white/10 my-2" />
       <div class="py-2">
@@ -100,9 +102,12 @@ export default {
     }
   },
   computed: {
-    userToken() {
+    legacyToken() {
       return this.user.token
     },
+    userToken() {
+      return this.user.accessToken
+    },
     bookCoverAspectRatio() {
       return this.$store.getters['libraries/getBookCoverAspectRatio']
     },
@@ -129,10 +134,10 @@ export default {
       return this.listeningSessions.sessions[0]
     },
     dateFormat() {
-      return this.$store.state.serverSettings.dateFormat
+      return this.$store.getters['getServerSetting']('dateFormat')
     },
     timeFormat() {
-      return this.$store.state.serverSettings.timeFormat
+      return this.$store.getters['getServerSetting']('timeFormat')
     }
   },
   methods: {
diff --git a/client/pages/config/users/_id/sessions.vue b/client/pages/config/users/_id/sessions.vue
index ab33b4b1..060f34be 100644
--- a/client/pages/config/users/_id/sessions.vue
+++ b/client/pages/config/users/_id/sessions.vue
@@ -19,39 +19,41 @@
       <div class="py-2">
         <h1 class="text-lg mb-2 text-white/90 px-2 sm:px-0">{{ $strings.HeaderListeningSessions }}</h1>
         <div v-if="listeningSessions.length">
-          <table class="userSessionsTable">
-            <tr class="bg-primary/40">
-              <th class="w-48 min-w-48 text-left">{{ $strings.LabelItem }}</th>
-              <th class="w-32 min-w-32 text-left hidden md:table-cell">{{ $strings.LabelPlayMethod }}</th>
-              <th class="w-32 min-w-32 text-left hidden sm:table-cell">{{ $strings.LabelDeviceInfo }}</th>
-              <th class="w-32 min-w-32">{{ $strings.LabelTimeListened }}</th>
-              <th class="w-16 min-w-16">{{ $strings.LabelLastTime }}</th>
-              <th class="grow hidden sm:table-cell">{{ $strings.LabelLastUpdate }}</th>
-            </tr>
-            <tr v-for="session in listeningSessions" :key="session.id" class="cursor-pointer" @click="showSession(session)">
-              <td class="py-1 max-w-48">
-                <p class="text-xs text-gray-200 truncate">{{ session.displayTitle }}</p>
-                <p class="text-xs text-gray-400 truncate">{{ session.displayAuthor }}</p>
-              </td>
-              <td class="hidden md:table-cell">
-                <p class="text-xs">{{ getPlayMethodName(session.playMethod) }}</p>
-              </td>
-              <td class="hidden sm:table-cell min-w-32 max-w-32">
-                <p class="text-xs truncate" v-html="getDeviceInfoString(session.deviceInfo)" />
-              </td>
-              <td class="text-center">
-                <p class="text-xs font-mono">{{ $elapsedPretty(session.timeListening) }}</p>
-              </td>
-              <td class="text-center hover:underline" @click.stop="clickCurrentTime(session)">
-                <p class="text-xs font-mono">{{ $secondsToTimestamp(session.currentTime) }}</p>
-              </td>
-              <td class="text-center hidden sm:table-cell">
-                <ui-tooltip v-if="session.updatedAt" direction="top" :text="$formatDatetime(session.updatedAt, dateFormat, timeFormat)">
-                  <p class="text-xs text-gray-200">{{ $dateDistanceFromNow(session.updatedAt) }}</p>
-                </ui-tooltip>
-              </td>
-            </tr>
-          </table>
+          <div class="overflow-x-auto">
+            <table class="userSessionsTable">
+              <tr class="bg-primary/40">
+                <th class="w-48 min-w-48 text-left">{{ $strings.LabelItem }}</th>
+                <th class="w-32 min-w-32 text-left hidden md:table-cell">{{ $strings.LabelPlayMethod }}</th>
+                <th class="w-32 min-w-32 text-left hidden sm:table-cell">{{ $strings.LabelDeviceInfo }}</th>
+                <th class="w-32 min-w-32">{{ $strings.LabelTimeListened }}</th>
+                <th class="w-16 min-w-16">{{ $strings.LabelLastTime }}</th>
+                <th class="grow hidden sm:table-cell">{{ $strings.LabelLastUpdate }}</th>
+              </tr>
+              <tr v-for="session in listeningSessions" :key="session.id" class="cursor-pointer" @click="showSession(session)">
+                <td class="py-1 max-w-48">
+                  <p class="text-xs text-gray-200 truncate">{{ session.displayTitle }}</p>
+                  <p class="text-xs text-gray-400 truncate">{{ session.displayAuthor }}</p>
+                </td>
+                <td class="hidden md:table-cell">
+                  <p class="text-xs">{{ getPlayMethodName(session.playMethod) }}</p>
+                </td>
+                <td class="hidden sm:table-cell min-w-32 max-w-32">
+                  <p class="text-xs truncate" v-html="getDeviceInfoString(session.deviceInfo)" />
+                </td>
+                <td class="text-center">
+                  <p class="text-xs font-mono">{{ $elapsedPrettyLocalized(session.timeListening) }}</p>
+                </td>
+                <td class="text-center hover:underline" @click.stop="clickCurrentTime(session)">
+                  <p class="text-xs font-mono">{{ $secondsToTimestamp(session.currentTime) }}</p>
+                </td>
+                <td class="text-center hidden sm:table-cell">
+                  <ui-tooltip v-if="session.updatedAt" direction="top" :text="$formatDatetime(session.updatedAt, dateFormat, timeFormat)">
+                    <p class="text-xs text-gray-200">{{ $dateDistanceFromNow(session.updatedAt) }}</p>
+                  </ui-tooltip>
+                </td>
+              </tr>
+            </table>
+          </div>
           <div class="flex items-center justify-end py-1">
             <ui-icon-btn icon="arrow_back_ios_new" :size="7" icon-font-size="1rem" class="mx-1" :disabled="currentPage === 0" @click="prevPage" />
             <p class="text-sm mx-1">{{ $getString('LabelPaginationPageXOfY', [currentPage + 1, numPages]) }}</p>
@@ -98,10 +100,10 @@ export default {
       return this.$store.getters['users/getIsUserOnline'](this.user.id)
     },
     dateFormat() {
-      return this.$store.state.serverSettings.dateFormat
+      return this.$store.getters['getServerSetting']('dateFormat')
     },
     timeFormat() {
-      return this.$store.state.serverSettings.timeFormat
+      return this.$store.getters['getServerSetting']('timeFormat')
     }
   },
   methods: {
diff --git a/client/pages/item/_id/index.vue b/client/pages/item/_id/index.vue
index 6042f92a..1d8f0f20 100644
--- a/client/pages/item/_id/index.vue
+++ b/client/pages/item/_id/index.vue
@@ -193,7 +193,7 @@ export default {
       return `${process.env.serverUrl}/api/items/${this.libraryItemId}/download?token=${this.userToken}`
     },
     dateFormat() {
-      return this.$store.state.serverSettings.dateFormat
+      return this.$store.getters['getServerSetting']('dateFormat')
     },
     userIsAdminOrUp() {
       return this.$store.getters['user/getIsAdminOrUp']
diff --git a/client/pages/library/_library/narrators.vue b/client/pages/library/_library/narrators.vue
index 17160213..9e58bf14 100644
--- a/client/pages/library/_library/narrators.vue
+++ b/client/pages/library/_library/narrators.vue
@@ -10,7 +10,7 @@
         </tr>
         <tr v-for="narrator in narrators" :key="narrator.id">
           <td>
-            <p v-if="selectedNarrator?.id !== narrator.id" class="text-sm md:text-base text-gray-100">{{ narrator.name }}</p>
+            <nuxt-link v-if="selectedNarrator?.id !== narrator.id" :to="`/library/${currentLibraryId}/bookshelf?filter=narrators.${narrator.id}`" class="text-sm md:text-base text-gray-100 hover:underline">{{ narrator.name }}</nuxt-link>
             <form v-else @submit.prevent="saveClick">
               <ui-text-input v-model="newNarratorName" />
             </form>
diff --git a/client/pages/library/_library/podcast/latest.vue b/client/pages/library/_library/podcast/latest.vue
index 4da25f3e..4f12043e 100644
--- a/client/pages/library/_library/podcast/latest.vue
+++ b/client/pages/library/_library/podcast/latest.vue
@@ -141,7 +141,7 @@ export default {
       return episodeIds
     },
     dateFormat() {
-      return this.$store.state.serverSettings.dateFormat
+      return this.$store.getters['getServerSetting']('dateFormat')
     }
   },
   methods: {
diff --git a/client/pages/login.vue b/client/pages/login.vue
index 3f48509f..b6235845 100644
--- a/client/pages/login.vue
+++ b/client/pages/login.vue
@@ -40,6 +40,15 @@
 
           <p v-if="error" class="text-error text-center py-2">{{ error }}</p>
 
+          <div v-if="showNewAuthSystemMessage" class="mb-4">
+            <widgets-alert type="warning">
+              <div>
+                <p>{{ $strings.MessageAuthenticationSecurityMessage }}</p>
+                <a v-if="showNewAuthSystemAdminMessage" href="https://github.com/advplyr/audiobookshelf/discussions/4460" target="_blank" class="underline">{{ $strings.LabelMoreInfo }}</a>
+              </div>
+            </widgets-alert>
+          </div>
+
           <form v-show="login_local" @submit.prevent="submitForm">
             <label class="text-xs text-gray-300 uppercase">{{ $strings.LabelUsername }}</label>
             <ui-text-input v-model.trim="username" :disabled="processing" class="mb-3 w-full" inputName="username" />
@@ -85,7 +94,10 @@ export default {
       MetadataPath: '',
       login_local: true,
       login_openid: false,
-      authFormData: null
+      authFormData: null,
+      // New JWT auth system re-login flags
+      showNewAuthSystemMessage: false,
+      showNewAuthSystemAdminMessage: false
     }
   },
   watch: {
@@ -179,11 +191,17 @@ export default {
 
       this.$store.commit('libraries/setCurrentLibrary', userDefaultLibraryId)
       this.$store.commit('user/setUser', user)
+      // Access token only returned from login, not authorize
+      if (user.accessToken) {
+        this.$store.commit('user/setAccessToken', user.accessToken)
+      }
 
       this.$store.dispatch('user/loadUserSettings')
     },
     async submitForm() {
       this.error = null
+      this.showNewAuthSystemMessage = false
+      this.showNewAuthSystemAdminMessage = false
       this.processing = true
 
       const payload = {
@@ -210,6 +228,8 @@ export default {
 
       this.processing = true
 
+      this.$store.commit('user/setAccessToken', token)
+
       return this.$axios
         .$post('/api/authorize', null, {
           headers: {
@@ -217,15 +237,25 @@ export default {
           }
         })
         .then((res) => {
+          // Force re-login if user is using an old token with no expiration
+          if (res.user.isOldToken) {
+            this.username = res.user.username
+            this.showNewAuthSystemMessage = true
+            // Admin user sees link to github discussion
+            this.showNewAuthSystemAdminMessage = res.user.type === 'admin' || res.user.type === 'root'
+            return false
+          }
+
           this.setUser(res)
-          this.processing = false
           return true
         })
         .catch((error) => {
           console.error('Authorize error', error)
-          this.processing = false
           return false
         })
+        .finally(() => {
+          this.processing = false
+        })
     },
     checkStatus() {
       this.processing = true
@@ -280,8 +310,9 @@ export default {
     }
   },
   async mounted() {
-    if (this.$route.query?.setToken) {
-      localStorage.setItem('token', this.$route.query.setToken)
+    // Token passed as query parameter after successful oidc login
+    if (this.$route.query?.accessToken) {
+      localStorage.setItem('token', this.$route.query.accessToken)
     }
     if (localStorage.getItem('token')) {
       if (await this.checkAuth()) return // if valid user no need to check status
diff --git a/client/plugins/axios.js b/client/plugins/axios.js
index c2ce8dad..66a9fa85 100644
--- a/client/plugins/axios.js
+++ b/client/plugins/axios.js
@@ -1,4 +1,19 @@
-export default function ({ $axios, store, $config }) {
+export default function ({ $axios, store, $root, app }) {
+  // Track if we're currently refreshing to prevent multiple refresh attempts
+  let isRefreshing = false
+  let failedQueue = []
+
+  const processQueue = (error, token = null) => {
+    failedQueue.forEach(({ resolve, reject }) => {
+      if (error) {
+        reject(error)
+      } else {
+        resolve(token)
+      }
+    })
+    failedQueue = []
+  }
+
   $axios.onRequest((config) => {
     if (!config.url) {
       console.error('Axios request invalid config', config)
@@ -7,7 +22,7 @@ export default function ({ $axios, store, $config }) {
     if (config.url.startsWith('http:') || config.url.startsWith('https:')) {
       return
     }
-    const bearerToken = store.state.user.user?.token || null
+    const bearerToken = store.getters['user/getToken']
     if (bearerToken) {
       config.headers.common['Authorization'] = `Bearer ${bearerToken}`
     }
@@ -17,9 +32,79 @@ export default function ({ $axios, store, $config }) {
     }
   })
 
-  $axios.onError((error) => {
+  $axios.onError(async (error) => {
+    const originalRequest = error.config
     const code = parseInt(error.response && error.response.status)
     const message = error.response ? error.response.data || 'Unknown Error' : 'Unknown Error'
+
     console.error('Axios error', code, message)
+
+    // Handle 401 Unauthorized (token expired)
+    if (code === 401 && !originalRequest._retry) {
+      // Skip refresh for auth endpoints to prevent infinite loops
+      if (originalRequest.url === '/auth/refresh' || originalRequest.url === '/login') {
+        // Refresh failed or login failed, redirect to login
+        store.commit('user/setUser', null)
+        store.commit('user/setAccessToken', null)
+        app.router.push('/login')
+        return Promise.reject(error)
+      }
+
+      if (isRefreshing) {
+        // If already refreshing, queue this request
+        return new Promise((resolve, reject) => {
+          failedQueue.push({ resolve, reject })
+        })
+          .then((token) => {
+            if (!originalRequest.headers) {
+              originalRequest.headers = {}
+            }
+            originalRequest.headers['Authorization'] = `Bearer ${token}`
+            return $axios(originalRequest)
+          })
+          .catch((err) => {
+            return Promise.reject(err)
+          })
+      }
+
+      originalRequest._retry = true
+      isRefreshing = true
+
+      try {
+        // Attempt to refresh the token
+        // Updates store if successful, otherwise clears store and throw error
+        const newAccessToken = await store.dispatch('user/refreshToken')
+        if (!newAccessToken) {
+          console.error('No new access token received')
+          return Promise.reject(error)
+        }
+
+        // Update the original request with new token
+        if (!originalRequest.headers) {
+          originalRequest.headers = {}
+        }
+        originalRequest.headers['Authorization'] = `Bearer ${newAccessToken}`
+
+        // Process any queued requests
+        processQueue(null, newAccessToken)
+
+        // Retry the original request
+        return $axios(originalRequest)
+      } catch (refreshError) {
+        console.error('Token refresh failed:', refreshError)
+
+        // Process queued requests with error
+        processQueue(refreshError, null)
+
+        // Redirect to login
+        app.router.push('/login')
+
+        return Promise.reject(refreshError)
+      } finally {
+        isRefreshing = false
+      }
+    }
+
+    return Promise.reject(error)
   })
 }
diff --git a/client/plugins/utils.js b/client/plugins/utils.js
index 8341a9e2..a03deb41 100644
--- a/client/plugins/utils.js
+++ b/client/plugins/utils.js
@@ -37,6 +37,48 @@ Vue.prototype.$elapsedPretty = (seconds, useFullNames = false, useMilliseconds =
   return `${hours} ${useFullNames ? `hour${hours === 1 ? '' : 's'}` : 'hr'} ${minutes} ${useFullNames ? `minute${minutes === 1 ? '' : 's'}` : 'min'}`
 }
 
+Vue.prototype.$elapsedPrettyLocalized = (seconds, useFullNames = false, useMilliseconds = false) => {
+  if (isNaN(seconds) || seconds === null) return ''
+
+  try {
+    const df = new Intl.DurationFormat(Vue.prototype.$languageCodes.current, {
+      style: useFullNames ? 'long' : 'short'
+    })
+
+    const duration = {}
+
+    if (seconds < 60) {
+      if (useMilliseconds && seconds < 1) {
+        duration.milliseconds = Math.floor(seconds * 1000)
+      } else {
+        duration.seconds = Math.floor(seconds)
+      }
+    } else if (seconds < 3600) {
+      // 1 hour
+      duration.minutes = Math.floor(seconds / 60)
+    } else if (seconds < 86400) {
+      // 1 day
+      duration.hours = Math.floor(seconds / 3600)
+      const minutes = Math.floor((seconds % 3600) / 60)
+      if (minutes > 0) {
+        duration.minutes = minutes
+      }
+    } else {
+      duration.days = Math.floor(seconds / 86400)
+      const hours = Math.floor((seconds % 86400) / 3600)
+      if (hours > 0) {
+        duration.hours = hours
+      }
+    }
+
+    return df.format(duration)
+  } catch (error) {
+    // Handle not supported
+    console.warn('Intl.DurationFormat not supported, not localizing duration')
+    return Vue.prototype.$elapsedPretty(seconds, useFullNames, useMilliseconds)
+  }
+}
+
 Vue.prototype.$secondsToTimestamp = (seconds, includeMs = false, alwaysIncludeHours = false) => {
   if (!seconds) {
     return alwaysIncludeHours ? '00:00:00' : '0:00'
diff --git a/client/store/user.js b/client/store/user.js
index d5aad19b..158ec8f4 100644
--- a/client/store/user.js
+++ b/client/store/user.js
@@ -1,5 +1,6 @@
 export const state = () => ({
   user: null,
+  accessToken: null,
   settings: {
     orderBy: 'media.metadata.title',
     orderDesc: false,
@@ -25,19 +26,19 @@ export const getters = {
   getIsRoot: (state) => state.user && state.user.type === 'root',
   getIsAdminOrUp: (state) => state.user && (state.user.type === 'admin' || state.user.type === 'root'),
   getToken: (state) => {
-    return state.user?.token || null
+    return state.accessToken || null
   },
   getUserMediaProgress:
     (state) =>
     (libraryItemId, episodeId = null) => {
-      if (!state.user.mediaProgress) return null
+      if (!state.user?.mediaProgress) return null
       return state.user.mediaProgress.find((li) => {
         if (episodeId && li.episodeId !== episodeId) return false
         return li.libraryItemId == libraryItemId
       })
     },
   getUserBookmarksForItem: (state) => (libraryItemId) => {
-    if (!state.user.bookmarks) return []
+    if (!state.user?.bookmarks) return []
     return state.user.bookmarks.filter((bm) => bm.libraryItemId === libraryItemId)
   },
   getUserSetting: (state) => (key) => {
@@ -58,6 +59,9 @@ export const getters = {
   getUserCanAccessAllLibraries: (state) => {
     return !!state.user?.permissions?.accessAllLibraries
   },
+  getUserCanAccessExplicitContent: (state) => {
+    return !!state.user?.permissions?.accessExplicitContent
+  },
   getLibrariesAccessible: (state, getters) => {
     if (!state.user) return []
     if (getters.getUserCanAccessAllLibraries) return []
@@ -88,7 +92,7 @@ export const actions = {
       if (state.settings.orderBy == 'media.duration') {
         settingsUpdate.orderBy = 'media.numTracks'
       }
-      if (state.settings.orderBy == 'media.metadata.publishedYear') {
+      if (state.settings.orderBy == 'media.metadata.publishedYear' || state.settings.orderBy == 'progress') {
         settingsUpdate.orderBy = 'media.metadata.title'
       }
       const invalidFilters = ['series', 'authors', 'narrators', 'publishers', 'publishedDecades', 'languages', 'progress', 'issues', 'ebooks', 'abridged']
@@ -142,21 +146,42 @@ export const actions = {
     } catch (error) {
       console.error('Failed to load userSettings from local storage', error)
     }
+  },
+  refreshToken({ state, commit }) {
+    return this.$axios
+      .$post('/auth/refresh')
+      .then(async (response) => {
+        const newAccessToken = response.user.accessToken
+        commit('setUser', response.user)
+        commit('setAccessToken', newAccessToken)
+        // Emit event used to re-authenticate socket in default.vue since $root is not available here
+        if (this.$eventBus) {
+          this.$eventBus.$emit('token_refreshed', newAccessToken)
+        }
+        return newAccessToken
+      })
+      .catch((error) => {
+        console.error('Failed to refresh token', error)
+        commit('setUser', null)
+        commit('setAccessToken', null)
+        // Calling function handles redirect to login
+        throw error
+      })
   }
 }
 
 export const mutations = {
   setUser(state, user) {
     state.user = user
-    if (user) {
-      if (user.token) localStorage.setItem('token', user.token)
-    } else {
-      localStorage.removeItem('token')
-    }
   },
-  setUserToken(state, token) {
-    state.user.token = token
-    localStorage.setItem('token', token)
+  setAccessToken(state, token) {
+    if (!token) {
+      localStorage.removeItem('token')
+      state.accessToken = null
+    } else {
+      state.accessToken = token
+      localStorage.setItem('token', token)
+    }
   },
   updateMediaProgress(state, { id, data }) {
     if (!state.user) return
diff --git a/client/strings/ar.json b/client/strings/ar.json
index a1383047..b04d94b9 100644
--- a/client/strings/ar.json
+++ b/client/strings/ar.json
@@ -514,7 +514,7 @@
   "LabelPublishers": "الناشرون",
   "LabelRSSFeedCustomOwnerEmail": "البريد الالكتروني المخصص للمالك",
   "LabelRSSFeedCustomOwnerName": "الاسم المخصص للمالك",
-  "LabelRSSFeedOpen": "فتح تغذية RSS",
+  "LabelRSSFeedOpen": "موجز RSS مفتوح",
   "LabelRSSFeedPreventIndexing": "منع الفهرسة",
   "LabelRSSFeedSlug": "اسم تعريف تغذية RSS",
   "LabelRSSFeedURL": "رابط تغذية RSS",
@@ -918,6 +918,8 @@
   "NotificationOnBackupCompletedDescription": "يتم تشغيله عند اكتمال النسخ الاحتياطي",
   "NotificationOnBackupFailedDescription": "يتم تشغيله عند فشل النسخ الاحتياطي",
   "NotificationOnEpisodeDownloadedDescription": "يتم تشغيله عند تنزيل حلقة بودكاست تلقائيًا",
+  "NotificationOnRSSFeedDisabledDescription": "يتم تشغيله عندما يتم تعطيل تنزيلات الحلقة التلقائية بسبب الكثير من المحاولات الفاشلة",
+  "NotificationOnRSSFeedFailedDescription": "يتم تشغيله عند فشل طلب تغذية RSS في تنزيل حلقة تلقائية",
   "NotificationOnTestDescription": "حدث لاختبار نظام الإشعارات",
   "PlaceholderNewCollection": "اسم المجموعة الجديدة",
   "PlaceholderNewFolderPath": "مسار المجلد الجديد",
diff --git a/client/strings/cs.json b/client/strings/cs.json
index b17075b0..547806d3 100644
--- a/client/strings/cs.json
+++ b/client/strings/cs.json
@@ -1,5 +1,6 @@
 {
   "ButtonAdd": "Přidat",
+  "ButtonAddApiKey": "Přidat API klíč",
   "ButtonAddChapters": "Přidat kapitoly",
   "ButtonAddDevice": "Přidat zařízení",
   "ButtonAddLibrary": "Přidat knihovnu",
@@ -20,6 +21,7 @@
   "ButtonChooseAFolder": "Vybrat složku",
   "ButtonChooseFiles": "Vybrat soubory",
   "ButtonClearFilter": "Vymazat filtr",
+  "ButtonClose": "Zavřít",
   "ButtonCloseFeed": "Zavřít kanál",
   "ButtonCloseSession": "Zavřít otevřenou relaci",
   "ButtonCollections": "Kolekce",
@@ -119,6 +121,7 @@
   "HeaderAccount": "Účet",
   "HeaderAddCustomMetadataProvider": "Přidat vlastního poskytovatele metadat",
   "HeaderAdvanced": "Pokročilé",
+  "HeaderApiKeys": "API klíče",
   "HeaderAppriseNotificationSettings": "Nastavení oznámení Apprise",
   "HeaderAudioTracks": "Zvukové stopy",
   "HeaderAudiobookTools": "Nástroje pro správu souborů audioknih",
@@ -154,7 +157,7 @@
   "HeaderListeningSessions": "Poslechové relace",
   "HeaderListeningStats": "Statistiky poslechu",
   "HeaderLogin": "Přihlásit",
-  "HeaderLogs": "Záznamy",
+  "HeaderLogs": "Logy",
   "HeaderManageGenres": "Spravovat žánry",
   "HeaderManageTags": "Spravovat štítky",
   "HeaderMapDetails": "Podrobnosti mapování",
@@ -162,6 +165,7 @@
   "HeaderMetadataOrderOfPrecedence": "Pořadí priorit metadat",
   "HeaderMetadataToEmbed": "Metadata k vložení",
   "HeaderNewAccount": "Nový účet",
+  "HeaderNewApiKey": "Nový API klíč",
   "HeaderNewLibrary": "Nová knihovna",
   "HeaderNotificationCreate": "Vytvořit notifikaci",
   "HeaderNotificationUpdate": "Aktualizovat notifikaci",
@@ -177,6 +181,7 @@
   "HeaderPlaylist": "Seznam skladeb",
   "HeaderPlaylistItems": "Položky seznamu přehrávání",
   "HeaderPodcastsToAdd": "Podcasty k přidání",
+  "HeaderPresets": "Předvolba",
   "HeaderPreviewCover": "Náhled obálky",
   "HeaderRSSFeedGeneral": "Podrobnosti o RSS",
   "HeaderRSSFeedIsOpen": "Informační kanál RSS je otevřený",
@@ -205,6 +210,7 @@
   "HeaderTableOfContents": "Obsah",
   "HeaderTools": "Nástroje",
   "HeaderUpdateAccount": "Aktualizovat účet",
+  "HeaderUpdateApiKey": "Aktualizovat API klíč",
   "HeaderUpdateAuthor": "Aktualizovat autora",
   "HeaderUpdateDetails": "Aktualizovat podrobnosti",
   "HeaderUpdateLibrary": "Aktualizovat knihovnu",
@@ -234,6 +240,10 @@
   "LabelAllUsersExcludingGuests": "Všichni uživatelé kromě hostů",
   "LabelAllUsersIncludingGuests": "Všichni uživatelé včetně hostů",
   "LabelAlreadyInYourLibrary": "Již ve vaší knihovně",
+  "LabelApiKeyCreated": "API klíč \"{0}\" byl úspěšně vytvořen.",
+  "LabelApiKeyCreatedDescription": "Zkopírujte si API klíč nyní, později již nebude možné jej zobrazit.",
+  "LabelApiKeyUser": "Vydávat se za uživatele",
+  "LabelApiKeyUserDescription": "Tento API klíč bude mít stejná oprávnění jako uživatel za něhož vystupuje. V protokolech to bude vypadat jako kdyby požadavky vytvářel přímo daný uživatel.",
   "LabelApiToken": "API Token",
   "LabelAppend": "Připojit",
   "LabelAudioBitrate": "Bitový tok zvuku (např. 128k)",
@@ -345,11 +355,15 @@
   "LabelExample": "Příklad",
   "LabelExpandSeries": "Rozbalit série",
   "LabelExpandSubSeries": "Rozbalit podsérie",
-  "LabelExplicit": "Explicitní",
+  "LabelExpired": "Expirovaný",
+  "LabelExpiresAt": "Expiruje v",
+  "LabelExpiresInSeconds": "Expiruje za (sekundy)",
+  "LabelExpiresNever": "Nikdy",
+  "LabelExplicit": "Explicitně",
   "LabelExplicitChecked": "Explicitní (zaškrtnuto)",
   "LabelExplicitUnchecked": "Není explicitní (nezaškrtnuto)",
   "LabelExportOPML": "Export OPML",
-  "LabelFeedURL": "URL zdroje",
+  "LabelFeedURL": "URL kanálu",
   "LabelFetchingMetadata": "Získávání metadat",
   "LabelFile": "Soubor",
   "LabelFileBirthtime": "Čas vzniku souboru",
@@ -454,6 +468,7 @@
   "LabelNewestEpisodes": "Nejnovější epizody",
   "LabelNextBackupDate": "Datum příští zálohy",
   "LabelNextScheduledRun": "Další naplánované spuštění",
+  "LabelNoApiKeys": "Žádné API klíče",
   "LabelNoCustomMetadataProviders": "Žádní vlastní poskytovatelé metadat",
   "LabelNoEpisodesSelected": "Nebyly vybrány žádné epizody",
   "LabelNotFinished": "Nedokončeno",
@@ -513,9 +528,9 @@
   "LabelPublishers": "Vydavatelé",
   "LabelRSSFeedCustomOwnerEmail": "Vlastní e-mail vlastníka",
   "LabelRSSFeedCustomOwnerName": "Vlastní jméno vlastníka",
-  "LabelRSSFeedOpen": "Otevření RSS kanálu",
+  "LabelRSSFeedOpen": "RSS kanál otevřen",
   "LabelRSSFeedPreventIndexing": "Zabránit indexování",
-  "LabelRSSFeedSlug": "RSS kanál Slug",
+  "LabelRSSFeedSlug": "Klíčové slovo kanálu RSS",
   "LabelRSSFeedURL": "URL RSS kanálu",
   "LabelRandomly": "Náhodně",
   "LabelReAddSeriesToContinueListening": "Znovu přidat sérii k pokračování poslechu",
@@ -530,6 +545,7 @@
   "LabelReleaseDate": "Datum vydání",
   "LabelRemoveAllMetadataAbs": "Odebrat všechny soubory metadata.abs",
   "LabelRemoveAllMetadataJson": "Smazat všechny soubory metadata.json",
+  "LabelRemoveAudibleBranding": "Odebrat úvod a závěr Audible z kapitol",
   "LabelRemoveCover": "Odstranit obálku",
   "LabelRemoveMetadataFile": "Odstranit soubory metadat ve složkách položek knihovny",
   "LabelRemoveMetadataFileHelp": "Odstraníte všechny soubory metadata.json a metadata.abs ve svých složkách {0}.",
@@ -542,6 +558,7 @@
   "LabelSelectAll": "Vybrat vše",
   "LabelSelectAllEpisodes": "Vybrat všechny epizody",
   "LabelSelectEpisodesShowing": "Vyberte {0} epizody, které se zobrazují",
+  "LabelSelectUser": "Vybrat uživatele",
   "LabelSelectUsers": "Vybrat uživatele",
   "LabelSendEbookToDevice": "Odeslat e-knihu do...",
   "LabelSequence": "Sekvence",
@@ -549,7 +566,7 @@
   "LabelSeries": "Série",
   "LabelSeriesName": "Název série",
   "LabelSeriesProgress": "Průběh série",
-  "LabelServerLogLevel": "Úroveň protokolu serveru",
+  "LabelServerLogLevel": "Úroveň Logování serveru",
   "LabelServerYearReview": "Přehled roku na serveru ({0})",
   "LabelSetEbookAsPrimary": "Nastavit jako primární",
   "LabelSetEbookAsSupplementary": "Nastavit jako doplňkové",
@@ -706,6 +723,9 @@
   "MessageAddToPlayerQueue": "Přidat do fronty přehrávače",
   "MessageAppriseDescription": "Abyste mohli používat tuto funkci, musíte mít spuštěnou instanci <a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">Apprise API</a> nebo API, které bude zpracovávat stejné požadavky. <br />Adresa URL API Apprise by měla být úplná URL cesta pro odeslání oznámení, např. pokud je vaše instance API obsluhována na adrese <code>http://192.168.1.1:8337</code> pak byste měli zadat <code>http://192.168.1.1:8337/notify</code>.",
   "MessageAsinCheck": "Ujistěte se, že používáte ASIN ze správného regionu Audible a ne z Amazonu.",
+  "MessageAuthenticationLegacyTokenWarning": "Zastaralé API tokeny budou v budoucnu odstraněny. Použijte místo nich <a href=\"/config/api-keys\">API klíče</a>.",
+  "MessageAuthenticationOIDCChangesRestart": "Po uložení restartujte server, aby se změny OIDC použily.",
+  "MessageAuthenticationSecurityMessage": "Bezpečnost autentizace byla vylepšena. Všichni uživatelé se musí znovu přihlásit.",
   "MessageBackupsDescription": "Zálohy zahrnují uživatele, průběh uživatele, podrobnosti o položkách knihovny, nastavení serveru a obrázky uložené v <code>/metadata/items</code> a <code>/metadata/authors</code>. Zálohy <strong>ne</strong> zahrnují všechny soubory uložené ve složkách knihovny.",
   "MessageBackupsLocationEditNote": "Poznámka: Změna umístění záloh nepřesune ani nezmění existující zálohy",
   "MessageBackupsLocationNoEditNote": "Poznámka: Umístění záloh je nastavené z proměnných prostředí a nelze zde změnit.",
@@ -727,6 +747,7 @@
   "MessageChaptersNotFound": "Kapitoly nenalezeny",
   "MessageCheckingCron": "Kontrola cronu...",
   "MessageConfirmCloseFeed": "Opravdu chcete zavřít tento kanál?",
+  "MessageConfirmDeleteApiKey": "Opravdu chcete vymazat API klíč \"{0}\"?",
   "MessageConfirmDeleteBackup": "Opravdu chcete smazat zálohu pro {0}?",
   "MessageConfirmDeleteDevice": "Opravdu chcete vymazat zařízení e-reader \"{0}\"?",
   "MessageConfirmDeleteFile": "Tento krok smaže soubor ze souborového systému. Jsi si jisti?",
@@ -754,6 +775,7 @@
   "MessageConfirmRemoveAuthor": "Opravdu chcete odstranit autora \"{0}\"?",
   "MessageConfirmRemoveCollection": "Opravdu chcete odstranit kolekci \"{0}\"?",
   "MessageConfirmRemoveEpisode": "Opravdu chcete odstranit epizodu \"{0}\"?",
+  "MessageConfirmRemoveEpisodeNote": "Poznámka: Tím se zvukový soubor neodstraní, pokud nepřepnete volbu “Tvrdé odstranění souboru“",
   "MessageConfirmRemoveEpisodes": "Opravdu chcete odstranit {0} epizody?",
   "MessageConfirmRemoveListeningSessions": "Opravdu chcete odebrat {0} poslechových relací?",
   "MessageConfirmRemoveMetadataFiles": "Jste si jisti, že chcete odstranit všechny metadata.{0} soubory ve složkách s položkami ve vaší knihovně?",
@@ -787,7 +809,7 @@
   "MessageJoinUsOn": "Přidejte se k nám",
   "MessageLoading": "Načítá se...",
   "MessageLoadingFolders": "Načítám složky...",
-  "MessageLogsDescription": "Protokoly se ukládají do souborů JSON v <code>/metadata/logs</code>. Protokoly o pádech jsou uloženy v <code>/metadata/logs/crash_logs.txt</code>.",
+  "MessageLogsDescription": "Logy se ukládají do souborů JSON v <code>/metadata/logs</code>. Logy o pádech jsou uloženy v <code>/metadata/logs/crash_logs.txt</code>.",
   "MessageM4BFailed": "M4B se nezdařil!",
   "MessageM4BFinished": "M4B dokončen!",
   "MessageMapChapterTitles": "Mapování názvů kapitol ke stávajícím kapitolám audioknihy bez úpravy časových razítek",
@@ -811,11 +833,11 @@
   "MessageNoEpisodes": "Žádné epizody",
   "MessageNoFoldersAvailable": "Nejsou k dispozici žádné složky",
   "MessageNoGenres": "Žádné žánry",
-  "MessageNoIssues": "Žádné výtisk",
+  "MessageNoIssues": "Žádné problémy",
   "MessageNoItems": "Žádné položky",
   "MessageNoItemsFound": "Nebyly nalezeny žádné položky",
   "MessageNoListeningSessions": "Žádné poslechové relace",
-  "MessageNoLogs": "Žádné protokoly",
+  "MessageNoLogs": "Žádné logy",
   "MessageNoMediaProgress": "Žádný průběh médií",
   "MessageNoNotifications": "Žádná oznámení",
   "MessageNoPodcastFeed": "Neplatný podcast: Žádný kanál",
@@ -853,6 +875,7 @@
   "MessageScheduleRunEveryWeekdayAtTime": "Spusť každý {0} v {1}",
   "MessageSearchResultsFor": "Výsledky hledání pro",
   "MessageSelected": "{0} vybráno",
+  "MessageSeriesSequenceCannotContainSpaces": "Sekvence série nesmí obsahovat mezery",
   "MessageServerCouldNotBeReached": "Server je nedostupný",
   "MessageSetChaptersFromTracksDescription": "Nastavit kapitoly jako kapitolu a název kapitoly jako název zvukového souboru",
   "MessageShareExpirationWillBe": "Expiruje <strong>{0}</strong>",
@@ -914,6 +937,8 @@
   "NotificationOnBackupCompletedDescription": "Spuštěno po dokončení zálohování",
   "NotificationOnBackupFailedDescription": "Spuštěno pokud zálohování selže",
   "NotificationOnEpisodeDownloadedDescription": "Spuštěno při automatickém stažení epizody podcastu",
+  "NotificationOnRSSFeedDisabledDescription": "Aktivováno když je automatické stahování pozastaveno z důvodu příliš mnoho neůspěšných pokusů",
+  "NotificationOnRSSFeedFailedDescription": "Aktivováno když selže RSS kanál pro stahování epizod",
   "NotificationOnTestDescription": "Akce pro otestování upozorňovacího systému",
   "PlaceholderNewCollection": "Nový název kolekce",
   "PlaceholderNewFolderPath": "Nová cesta ke složce",
@@ -958,7 +983,7 @@
   "ToastBackupRestoreFailed": "Nepodařilo se obnovit zálohu",
   "ToastBackupUploadFailed": "Nepodařilo se nahrát zálohu",
   "ToastBackupUploadSuccess": "Záloha nahrána",
-  "ToastBatchApplyDetailsToItemsSuccess": "Detaily aplikované na položky",
+  "ToastBatchApplyDetailsToItemsSuccess": "Detaily byly aplikované na položky",
   "ToastBatchDeleteFailed": "Hromadné smazání selhalo",
   "ToastBatchDeleteSuccess": "Hromadné smazání proběhlo úspěšně",
   "ToastBatchQuickMatchFailed": "Rychlá schoda dávky se nezdařila!",
@@ -971,6 +996,8 @@
   "ToastCachePurgeFailed": "Nepodařilo se vyčistit mezipaměť",
   "ToastCachePurgeSuccess": "Vyrovnávací paměť úspěšně vyčištěna",
   "ToastChaptersHaveErrors": "Kapitoly obsahují chyby",
+  "ToastChaptersInvalidShiftAmountLast": "Nesprávná délka posunu. Čas začátku poslední kapitoly by přesáhl dobu trvání této audioknihy.",
+  "ToastChaptersInvalidShiftAmountStart": "Nesprávná délka posunu. První kapitola by měla nulovou nebo zápornou délku a byla by přepsána druhou kapitolou. Zvětšete čas začátku druhé kapitoly.",
   "ToastChaptersMustHaveTitles": "Kapitoly musí mít názvy",
   "ToastChaptersRemoved": "Kapitoly odstraněny",
   "ToastChaptersUpdated": "Kapitola aktualizována",
@@ -992,6 +1019,8 @@
   "ToastEpisodeDownloadQueueClearSuccess": "Fronta stahování epizod je prázdná",
   "ToastEpisodeUpdateSuccess": "{0} epizod aktualizováno",
   "ToastErrorCannotShare": "Na tomto zařízení nelze nativně sdílet",
+  "ToastFailedToCreate": "Nepodařilo se vytvořit",
+  "ToastFailedToDelete": "Nepodařilo se odstranit",
   "ToastFailedToLoadData": "Nepodařilo se načíst data",
   "ToastFailedToMatch": "Nepodařilo se spárovat",
   "ToastFailedToShare": "Sdílení selhalo",
@@ -1023,6 +1052,7 @@
   "ToastMustHaveAtLeastOnePath": "Musí mít minimálně jednu cestu",
   "ToastNameEmailRequired": "Jméno a email jsou vyžadovány",
   "ToastNameRequired": "Jméno je vyžadováno",
+  "ToastNewApiKeyUserError": "Je nutné vybrat uživatele",
   "ToastNewEpisodesFound": "{0} nových epizod bylo nalezeno",
   "ToastNewUserCreatedFailed": "Chyba při vytváření účtu: \"{0}\"",
   "ToastNewUserCreatedSuccess": "Vytvořen nový účet",
@@ -1091,7 +1121,7 @@
   "ToastUnlinkOpenIdFailed": "Chyba při odpárování uživatele z OpenID",
   "ToastUnlinkOpenIdSuccess": "Uživatel odpárován z uživatele z OpenID",
   "ToastUploaderFilepathExistsError": "Soubor \"{0}\" na serveru již existuje",
-  "ToastUploaderItemExistsInSubdirectoryError": "Položka \"{0}\" používá podsložku nahrávané cesty.",
+  "ToastUploaderItemExistsInSubdirectoryError": "Položka \"{0}\" používá podadresář cesty pro nahrání.",
   "ToastUserDeleteFailed": "Nepodařilo se smazat uživatele",
   "ToastUserDeleteSuccess": "Uživatel smazán",
   "ToastUserPasswordChangeSuccess": "Heslo bylo změněno úspěšně",
diff --git a/client/strings/da.json b/client/strings/da.json
index 06342342..342529f7 100644
--- a/client/strings/da.json
+++ b/client/strings/da.json
@@ -177,6 +177,7 @@
   "HeaderPlaylist": "Afspilningsliste",
   "HeaderPlaylistItems": "Afspilningsliste Elementer",
   "HeaderPodcastsToAdd": "Podcasts til Tilføjelse",
+  "HeaderPresets": "Forudindstillinger",
   "HeaderPreviewCover": "Forhåndsvis Omslag",
   "HeaderRSSFeedGeneral": "RSS Detaljer",
   "HeaderRSSFeedIsOpen": "RSS Feed er Åben",
@@ -513,7 +514,7 @@
   "LabelPublishers": "Forlag",
   "LabelRSSFeedCustomOwnerEmail": "Brugerdefineret ejerens e-mail",
   "LabelRSSFeedCustomOwnerName": "Brugerdefineret ejerens navn",
-  "LabelRSSFeedOpen": "Åben RSS-feed",
+  "LabelRSSFeedOpen": "RSS-feed åbent",
   "LabelRSSFeedPreventIndexing": "Forhindrer indeksering",
   "LabelRSSFeedSlug": "RSS-feed-slug",
   "LabelRSSFeedURL": "RSS-feed-URL",
@@ -530,6 +531,7 @@
   "LabelReleaseDate": "Udgivelsesdato",
   "LabelRemoveAllMetadataAbs": "Fjern alle metadata.abs filer",
   "LabelRemoveAllMetadataJson": "Fjern alle metadata.json filer",
+  "LabelRemoveAudibleBranding": "Fjern Audible intro og outro fra kapitler",
   "LabelRemoveCover": "Fjern omslag",
   "LabelRemoveMetadataFile": "Fjern alle metadata filer i biblioteksmapper",
   "LabelRemoveMetadataFileHelp": "Fjern alle metadata.json og metadata.abs filer i dine {0} mapper.",
@@ -604,6 +606,7 @@
   "LabelSlug": "Snegl",
   "LabelSortAscending": "Stigende",
   "LabelSortDescending": "Faldende",
+  "LabelSortPubDate": "Sortér Pub Dato",
   "LabelStart": "Start",
   "LabelStartTime": "Starttid",
   "LabelStarted": "Startet",
@@ -704,6 +707,8 @@
   "LabelYourProgress": "Din fremgang",
   "MessageAddToPlayerQueue": "Tilføj til afspilningskø",
   "MessageAppriseDescription": "For at bruge denne funktion skal du have en instans af <a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">Apprise API</a> kørende eller en API, der håndterer de samme anmodninger. <br /> Apprise API-webadressen skal være den fulde URL-sti for at sende underretningen, f.eks. hvis din API-instans er tilgængelig på <code>http://192.168.1.1:8337</code>, så skal du bruge <code>http://192.168.1.1:8337/notify</code>.",
+  "MessageAsinCheck": "Sikr dig at du bruger ASIN fra den korrekte Audible region, ikke Amazon.",
+  "MessageAuthenticationOIDCChangesRestart": "Genstart sin server efter du har gemt for at bekræfte OIDC ændringer.",
   "MessageBackupsDescription": "Backups inkluderer brugere, brugerfremskridt, biblioteksvareoplysninger, serverindstillinger og billeder gemt i <code>/metadata/items</code> og <code>/metadata/authors</code>. Backups inkluderer <strong>ikke</strong> nogen filer gemt i dine biblioteksmapper.",
   "MessageBackupsLocationEditNote": "Note: Opdatering af backup sti vil ikke fjerne eller modificere eksisterende backups",
   "MessageBackupsLocationNoEditNote": "Note: Backup sti er sat igennem miljøvariabel og kan ikke ændres her.",
@@ -722,6 +727,7 @@
   "MessageChapterErrorStartGteDuration": "Ugyldig starttid skal være mindre end lydbogens varighed",
   "MessageChapterErrorStartLtPrev": "Ugyldig starttid skal være større end eller lig med den foregående kapitels starttid",
   "MessageChapterStartIsAfter": "Kapitelstarten er efter slutningen af din lydbog",
+  "MessageChaptersNotFound": "Kapitler ikke fundet",
   "MessageCheckingCron": "Tjekker cron...",
   "MessageConfirmCloseFeed": "Er du sikker på, at du vil lukke dette feed?",
   "MessageConfirmDeleteBackup": "Er du sikker på, at du vil slette backup for {0}?",
@@ -778,6 +784,7 @@
   "MessageForceReScanDescription": "vil scanne alle filer igen som en frisk scanning. Lydfilens ID3-tags, OPF-filer og tekstfiler scannes som nye.",
   "MessageImportantNotice": "Vigtig besked!",
   "MessageInsertChapterBelow": "Indsæt kapitel nedenfor",
+  "MessageInvalidAsin": "Ugyldig ASIN",
   "MessageItemsSelected": "{0} elementer valgt",
   "MessageItemsUpdated": "{0} elementer opdateret",
   "MessageJoinUsOn": "Deltag i os på",
@@ -849,6 +856,7 @@
   "MessageScheduleRunEveryWeekdayAtTime": "Kør hvert {0} af {1}",
   "MessageSearchResultsFor": "Søgeresultater for",
   "MessageSelected": "{0} valgt",
+  "MessageSeriesSequenceCannotContainSpaces": "Serie sekvens kan ikke indeholde mellemrum",
   "MessageServerCouldNotBeReached": "Serveren kunne ikke nås",
   "MessageSetChaptersFromTracksDescription": "Indstil kapitler ved at bruge hver lydfil som et kapitel og kapiteloverskrift som lydfilnavn",
   "MessageShareExpirationWillBe": "Udløb vil være <strong>{0}</strong>",
@@ -910,6 +918,8 @@
   "NotificationOnBackupCompletedDescription": "Udløst når backup er færdig",
   "NotificationOnBackupFailedDescription": "Udløst når backup fejler",
   "NotificationOnEpisodeDownloadedDescription": "Udløst når et podcast afsnit er automatisk downloadet",
+  "NotificationOnRSSFeedDisabledDescription": "Aktiveret når automatiske episode-downloads er slået fra, på grund af for mange forsøg",
+  "NotificationOnRSSFeedFailedDescription": "Aktiveret når anmodning om RSS-feedet fejler for en automatisk episode-download",
   "NotificationOnTestDescription": "Event for test af notifikationssystemet",
   "PlaceholderNewCollection": "Nyt samlingnavn",
   "PlaceholderNewFolderPath": "Ny mappes sti",
@@ -954,6 +964,7 @@
   "ToastBackupRestoreFailed": "Mislykkedes gendannelse af sikkerhedskopi",
   "ToastBackupUploadFailed": "Mislykkedes upload af sikkerhedskopi",
   "ToastBackupUploadSuccess": "Sikkerhedskopi uploadet",
+  "ToastBatchApplyDetailsToItemsSuccess": "Detaljer bekræftet på element",
   "ToastBatchDeleteFailed": "Batch slet fejlede",
   "ToastBatchDeleteSuccess": "Batch slet succes",
   "ToastBatchQuickMatchFailed": "Batch Hurtig Match fejlede!",
diff --git a/client/strings/de.json b/client/strings/de.json
index 55b33d8a..2e913c11 100644
--- a/client/strings/de.json
+++ b/client/strings/de.json
@@ -1,5 +1,6 @@
 {
   "ButtonAdd": "Hinzufügen",
+  "ButtonAddApiKey": "API-Schlüssel hinzufügen",
   "ButtonAddChapters": "Kapitel hinzufügen",
   "ButtonAddDevice": "Gerät hinzufügen",
   "ButtonAddLibrary": "Bibliothek hinzufügen",
@@ -20,6 +21,7 @@
   "ButtonChooseAFolder": "Wähle einen Ordner",
   "ButtonChooseFiles": "Wähle eine Datei",
   "ButtonClearFilter": "Filter löschen",
+  "ButtonClose": "Schließen",
   "ButtonCloseFeed": "Feed schließen",
   "ButtonCloseSession": "Offene Sitzung schließen",
   "ButtonCollections": "Sammlungen",
@@ -32,7 +34,7 @@
   "ButtonEditChapters": "Kapitel bearbeiten",
   "ButtonEditPodcast": "Podcast bearbeiten",
   "ButtonEnable": "Aktivieren",
-  "ButtonFireAndFail": "Abfeuern und versagen",
+  "ButtonFireAndFail": "Abschicken und fehlschlagen",
   "ButtonFireOnTest": "Test-Event abfeuern",
   "ButtonForceReScan": "Komplett-Scan (alle Medien)",
   "ButtonFullPath": "Vollständiger Pfad",
@@ -53,7 +55,7 @@
   "ButtonNext": "Vor",
   "ButtonNextChapter": "Nächstes Kapitel",
   "ButtonNextItemInQueue": "Das nächste Element in der Warteschlange",
-  "ButtonOk": "Einverstanden",
+  "ButtonOk": "Ok",
   "ButtonOpenFeed": "Feed öffnen",
   "ButtonOpenManager": "Manager öffnen",
   "ButtonPause": "Pausieren",
@@ -119,6 +121,7 @@
   "HeaderAccount": "Konto",
   "HeaderAddCustomMetadataProvider": "Benutzerdefinierten Metadatenanbieter hinzufügen",
   "HeaderAdvanced": "Erweitert",
+  "HeaderApiKeys": "API-Schlüssel",
   "HeaderAppriseNotificationSettings": "Apprise Benachrichtigungseinstellungen",
   "HeaderAudioTracks": "Audiodateien",
   "HeaderAudiobookTools": "Hörbuch-Dateiverwaltungswerkzeuge",
@@ -162,6 +165,7 @@
   "HeaderMetadataOrderOfPrecedence": "Metadaten Rangfolge",
   "HeaderMetadataToEmbed": "Einzubettende Metadaten",
   "HeaderNewAccount": "Neues Konto",
+  "HeaderNewApiKey": "Neuen API-Schlüssel erstellen",
   "HeaderNewLibrary": "Neue Bibliothek",
   "HeaderNotificationCreate": "Benachrichtigung erstellen",
   "HeaderNotificationUpdate": "Benachrichtigung bearbeiten",
@@ -206,6 +210,7 @@
   "HeaderTableOfContents": "Inhaltsverzeichnis",
   "HeaderTools": "Werkzeuge",
   "HeaderUpdateAccount": "Konto aktualisieren",
+  "HeaderUpdateApiKey": "API-Schlüssel aktualisieren",
   "HeaderUpdateAuthor": "Autor aktualisieren",
   "HeaderUpdateDetails": "Details aktualisieren",
   "HeaderUpdateLibrary": "Bibliothek aktualisieren",
@@ -235,6 +240,10 @@
   "LabelAllUsersExcludingGuests": "Alle Benutzer außer Gästen",
   "LabelAllUsersIncludingGuests": "Alle Benutzer und Gäste",
   "LabelAlreadyInYourLibrary": "Bereits in der Bibliothek",
+  "LabelApiKeyCreated": "API-Schlüssel \"{0}\" erfolgreich erstellt.",
+  "LabelApiKeyCreatedDescription": "Speichere den API-Schlüssel an einem sicheren Ort, du wirst ihn später nicht mehr abrufen können.",
+  "LabelApiKeyUser": "Im Kontext eines Nutzers agieren",
+  "LabelApiKeyUserDescription": "Dieser API-Schlüssel hat die gleichen Berechtigungen wie der Benutzer, in dessen Namen er erstellt wurde .In den Protokollen wird es aussehen, als ob der Benutzer die Anfrage durchführte.",
   "LabelApiToken": "API Schlüssel",
   "LabelAppend": "Anhängen",
   "LabelAudioBitrate": "Audiobitrate (z. B. 128 kbit/s)",
@@ -346,7 +355,11 @@
   "LabelExample": "Beispiel",
   "LabelExpandSeries": "Serie ausklappen",
   "LabelExpandSubSeries": "Unterserie ausklappen",
-  "LabelExplicit": "Explizit (Altersbeschränkung)",
+  "LabelExpired": "Abgelaufen",
+  "LabelExpiresAt": "Läuft ab am",
+  "LabelExpiresInSeconds": "Ablauf in (seconds) Sekunden",
+  "LabelExpiresNever": "Niemals",
+  "LabelExplicit": "Explizit",
   "LabelExplicitChecked": "Explicit (Altersbeschränkung) (angehakt)",
   "LabelExplicitUnchecked": "Not Explicit (Altersbeschränkung) (nicht angehakt)",
   "LabelExportOPML": "OPML exportieren",
@@ -425,6 +438,7 @@
   "LabelLogLevelWarn": "Warnungen",
   "LabelLookForNewEpisodesAfterDate": "Suche nach neuen Episoden nach diesem Datum",
   "LabelLowestPriority": "Niedrigste Priorität",
+  "LabelMatchConfidence": "Zuversicht",
   "LabelMatchExistingUsersBy": "Zuordnen existierender Benutzer mit",
   "LabelMatchExistingUsersByDescription": "Wird zum Verbinden vorhandener Benutzer verwendet. Sobald die Verbindung hergestellt ist, wird den Benutzern eine eindeutige ID vom SSO-Anbieter zugeordnet",
   "LabelMaxEpisodesToDownload": "Max. Anzahl an Episoden zum Herunterladen, 0 für unbegrenzte Episoden.",
@@ -455,6 +469,7 @@
   "LabelNewestEpisodes": "Neueste Episoden",
   "LabelNextBackupDate": "Nächstes Sicherungsdatum",
   "LabelNextScheduledRun": "Nächster planmäßiger Durchlauf",
+  "LabelNoApiKeys": "Keine API-Schlüssel vorhanden",
   "LabelNoCustomMetadataProviders": "Keine benutzerdefinierten Metadata Anbieter",
   "LabelNoEpisodesSelected": "Keine Episoden ausgewählt",
   "LabelNotFinished": "Nicht beendet",
@@ -544,6 +559,7 @@
   "LabelSelectAll": "Alles auswählen",
   "LabelSelectAllEpisodes": "Alle Episoden auswählen",
   "LabelSelectEpisodesShowing": "{0} ausgewählte Episoden werden angezeigt",
+  "LabelSelectUser": "Ausgewählter Benutzer",
   "LabelSelectUsers": "Benutzer auswählen",
   "LabelSendEbookToDevice": "E-Buch senden an …",
   "LabelSequence": "Reihenfolge",
@@ -708,7 +724,9 @@
   "MessageAddToPlayerQueue": "Zur Abspielwarteliste hinzufügen",
   "MessageAppriseDescription": "Um diese Funktion nutzen zu können, musst du eine Instanz von <a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">Apprise API</a> laufen haben oder eine API verwenden welche dieselbe Anfragen bearbeiten kann. <br />Die Apprise API Url muss der vollständige URL-Pfad sein, an den die Benachrichtigung gesendet werden soll, z.B. wenn Ihre API-Instanz unter <code>http://192.168.1.1:8337</code> läuft, würdest du <code>http://192.168.1.1:8337/notify</code> eingeben.",
   "MessageAsinCheck": "Stellen Sie sicher, dass Sie die ASIN aus der richtigen Audible Region verwenden, nicht Amazon.",
-  "MessageAuthenticationOIDCChangesRestart": "Nach dem Speichern muß der Server neugestartet werden um die OIDC Änderungen zu übernehmen.",
+  "MessageAuthenticationLegacyTokenWarning": "Alte API tokens werden in Zukunft entfernt. Benutze stattdessen <a href=\"/config/api-keys\">API Keys</a>.",
+  "MessageAuthenticationOIDCChangesRestart": "Nach dem Speichern muss der Server neugestartet werden um die OIDC Änderungen zu übernehmen.",
+  "MessageAuthenticationSecurityMessage": "Die Anmeldung wurde abgesichert. Benutzersitzungen werden getrennt, alle Benutzer müssen sich erneut anmelden.",
   "MessageBackupsDescription": "In einer Sicherung werden Benutzer, Benutzerfortschritte, Details zu den Bibliotheksobjekten, Servereinstellungen und Bilder welche in <code>/metadata/items</code> & <code>/metadata/authors</code> gespeichert sind gespeichert. Sicherungen enthalten keine Dateien welche in den einzelnen Bibliotheksordnern (Medien-Ordnern) gespeichert sind.",
   "MessageBackupsLocationEditNote": "Hinweis: Durch das Aktualisieren des Backup-Speicherorts werden vorhandene Sicherungen nicht verschoben oder geändert",
   "MessageBackupsLocationNoEditNote": "Hinweis: Der Sicherungsspeicherort wird über eine Umgebungsvariable festgelegt und kann hier nicht geändert werden.",
@@ -730,6 +748,7 @@
   "MessageChaptersNotFound": "Kapitel gefunden nicht",
   "MessageCheckingCron": "Überprüfe Cron...",
   "MessageConfirmCloseFeed": "Feed wird geschlossen! Bist du dir sicher?",
+  "MessageConfirmDeleteApiKey": "Möchtest du den API-Schlüssel \"{0}\" wirklich entfernen ?",
   "MessageConfirmDeleteBackup": "Sicherung für {0} wird gelöscht! Bist du dir sicher?",
   "MessageConfirmDeleteDevice": "Möchtest du das Lesegerät „{0}“ wirklich löschen?",
   "MessageConfirmDeleteFile": "Datei wird vom System gelöscht! Bist du dir sicher?",
@@ -757,6 +776,7 @@
   "MessageConfirmRemoveAuthor": "Autor \"{0}\" wird enfernt! Bist du dir sicher?",
   "MessageConfirmRemoveCollection": "Sammlung \"{0}\" wird entfernt! Bist du dir sicher?",
   "MessageConfirmRemoveEpisode": "Episode \"{0}\" wird entfernt! Bist du dir sicher?",
+  "MessageConfirmRemoveEpisodeNote": "Hinweis: Die Audiodatei wird nicht gelöscht, es sei denn \"Datei dauerhaft löschen\" ist aktiviert",
   "MessageConfirmRemoveEpisodes": "{0} Episoden werden entfernt! Bist du dir sicher?",
   "MessageConfirmRemoveListeningSessions": "Bist du dir sicher, dass du {0} Hörsitzungen enfernen möchtest?",
   "MessageConfirmRemoveMetadataFiles": "Bist du sicher, dass du alle metadata.{0} Dateien in deinen Bibliotheksordnern löschen willst?",
@@ -852,13 +872,13 @@
   "MessageResetChaptersConfirm": "Kapitel und vorgenommenen Änderungen werden zurückgesetzt und rückgängig gemacht! Bist du dir sicher?",
   "MessageRestoreBackupConfirm": "Bist du dir sicher, dass du die Sicherung wiederherstellen willst, welche am",
   "MessageRestoreBackupWarning": "Bei der Wiederherstellung einer Sicherung wird die gesamte Datenbank unter /config und die Titelbilder in /metadata/items und /metadata/authors überschrieben.<br /><br />Bei der Sicherung werden keine Dateien in deinen Bibliotheksordnern verändert. Wenn du die Servereinstellungen aktiviert hast, um Cover und Metadaten in deinen Bibliotheksordnern zu speichern, werden diese nicht gesichert oder überschrieben.<br /><br />Alle Clients, die Ihren Server nutzen, werden automatisch aktualisiert.",
-  "MessageScheduleLibraryScanNote": "Für die meisten Nutzer wird empfohlen, diese Funktion deaktiviert zu lassen und stattdessen die Ordnerüberwachung aktiviert zu lassen. Die Ordnerüberwachung erkennt automatisch Änderungen in deinen Bibliotheksordnern. Da die Ordnerüberwachung jedoch nicht mit jedem Dateisystem (z.B. NFS) funktioniert, können alternativ hier geplante Bibliotheks-Scans aktiviert werden.",
+  "MessageScheduleLibraryScanNote": "Für die meisten Anwender wird empfohlen, diese Funktion deaktiviert und die Ordnerüberwachung aktiviert zu lassen. Die Ordnerüberwachung wird Änderungen in den Bibliotheksordnern automatisch erkennen. Die Ordnerüberwachung funktioniert nicht mit allen Dateisystemen (wie NFS), hier kann stattdessen die automatischen Bibliothekssuchen verwendet werden.",
   "MessageScheduleRunEveryWeekdayAtTime": "Immer {0} um {1} ausführen",
   "MessageSearchResultsFor": "Suchergebnisse für",
   "MessageSelected": "{0} ausgewählt",
   "MessageSeriesSequenceCannotContainSpaces": "Serie Abfolge kann keine Leerzeichen enthalten",
   "MessageServerCouldNotBeReached": "Server kann nicht erreicht werden",
-  "MessageSetChaptersFromTracksDescription": "Kaitelerstellung basiert auf den existierenden einzelnen Audiodateien. Pro existierende Audiodatei wird 1 Kapitel erstellt, wobei deren Kapitelname aus dem Audiodateinamen extrahiert wird",
+  "MessageSetChaptersFromTracksDescription": "Kapitelerstellung basiert auf den existierenden einzelnen Audiodateien. Pro existierende Audiodatei wird 1 Kapitel erstellt, wobei deren Kapitelname aus dem Audiodateinamen extrahiert wird",
   "MessageShareExpirationWillBe": "Läuft am <strong>{0}</strong> ab",
   "MessageShareExpiresIn": "Läuft in {0} ab",
   "MessageShareURLWillBe": "Der Freigabe Link wird <strong>{0}</strong> sein",
@@ -918,6 +938,8 @@
   "NotificationOnBackupCompletedDescription": "Wird ausgeführt wenn ein Backup erstellt wurde",
   "NotificationOnBackupFailedDescription": "Wird ausgeführt wenn ein Backup fehlgeschlagen ist",
   "NotificationOnEpisodeDownloadedDescription": "Wird ausgeführt wenn eine Podcast Folge automatisch heruntergeladen wird",
+  "NotificationOnRSSFeedDisabledDescription": "Wird ausgeführt wenn automatische Downloads von Episoden wegen zu vielen fehlgeschlagenen Versuchen deaktiviert sind",
+  "NotificationOnRSSFeedFailedDescription": "Wird ausgelöst, wenn die RSS-Feed-Anforderung für einen automatischen Episoden-Download fehlschlägt",
   "NotificationOnTestDescription": "Wird ausgeführt wenn das Benachrichtigungssystem getestet wird",
   "PlaceholderNewCollection": "Neuer Sammlungsname",
   "PlaceholderNewFolderPath": "Neuer Ordnerpfad",
@@ -998,7 +1020,9 @@
   "ToastEpisodeDownloadQueueClearSuccess": "Warteschlange für Episoden-Downloads gelöscht",
   "ToastEpisodeUpdateSuccess": "{0} Episoden aktualisiert",
   "ToastErrorCannotShare": "Das kann nicht nativ auf diesem Gerät freigegeben werden",
-  "ToastFailedToLoadData": "Daten laden fehlgeschlagen",
+  "ToastFailedToCreate": "Fehler beim Erzeugen",
+  "ToastFailedToDelete": "Fehler beim Löschen",
+  "ToastFailedToLoadData": "Fehler beim laden der Daten",
   "ToastFailedToMatch": "Fehler beim Abgleich",
   "ToastFailedToShare": "Fehler beim Teilen",
   "ToastFailedToUpdate": "Aktualisierung ist fehlgeschlagen",
@@ -1029,6 +1053,7 @@
   "ToastMustHaveAtLeastOnePath": "Es muss mindestens ein Pfad angegeben werden",
   "ToastNameEmailRequired": "Name und E-Mail sind erforderlich",
   "ToastNameRequired": "Name ist erforderlich",
+  "ToastNewApiKeyUserError": "Bitte wähle einen Benutzer aus (Pflichtfeld)",
   "ToastNewEpisodesFound": "{0} neue Episoden gefunden",
   "ToastNewUserCreatedFailed": "Fehler beim erstellen des Accounts: \"{ 0}\"",
   "ToastNewUserCreatedSuccess": "Neuer Account erstellt",
diff --git a/client/strings/en-us.json b/client/strings/en-us.json
index d6d162ae..58cbf17b 100644
--- a/client/strings/en-us.json
+++ b/client/strings/en-us.json
@@ -1,5 +1,6 @@
 {
   "ButtonAdd": "Add",
+  "ButtonAddApiKey": "Add API Key",
   "ButtonAddChapters": "Add Chapters",
   "ButtonAddDevice": "Add Device",
   "ButtonAddLibrary": "Add Library",
@@ -20,6 +21,7 @@
   "ButtonChooseAFolder": "Choose a folder",
   "ButtonChooseFiles": "Choose files",
   "ButtonClearFilter": "Clear Filter",
+  "ButtonClose": "Close",
   "ButtonCloseFeed": "Close Feed",
   "ButtonCloseSession": "Close Open Session",
   "ButtonCollections": "Collections",
@@ -119,6 +121,7 @@
   "HeaderAccount": "Account",
   "HeaderAddCustomMetadataProvider": "Add Custom Metadata Provider",
   "HeaderAdvanced": "Advanced",
+  "HeaderApiKeys": "API Keys",
   "HeaderAppriseNotificationSettings": "Apprise Notification Settings",
   "HeaderAudioTracks": "Audio Tracks",
   "HeaderAudiobookTools": "Audiobook File Management Tools",
@@ -163,6 +166,7 @@
   "HeaderMetadataOrderOfPrecedence": "Metadata order of precedence",
   "HeaderMetadataToEmbed": "Metadata to embed",
   "HeaderNewAccount": "New Account",
+  "HeaderNewApiKey": "New API Key",
   "HeaderNewLibrary": "New Library",
   "HeaderNotificationCreate": "Create Notification",
   "HeaderNotificationUpdate": "Update Notification",
@@ -207,6 +211,7 @@
   "HeaderTableOfContents": "Table of Contents",
   "HeaderTools": "Tools",
   "HeaderUpdateAccount": "Update Account",
+  "HeaderUpdateApiKey": "Update API Key",
   "HeaderUpdateAuthor": "Update Author",
   "HeaderUpdateDetails": "Update Details",
   "HeaderUpdateLibrary": "Update Library",
@@ -236,6 +241,10 @@
   "LabelAllUsersExcludingGuests": "All users excluding guests",
   "LabelAllUsersIncludingGuests": "All users including guests",
   "LabelAlreadyInYourLibrary": "Already in your library",
+  "LabelApiKeyCreated": "API Key \"{0}\" created successfully.",
+  "LabelApiKeyCreatedDescription": "Make sure to copy the API key now as you will not be able to see this again.",
+  "LabelApiKeyUser": "Act on behalf of user",
+  "LabelApiKeyUserDescription": "This API key will have the same permissions as the user it is acting on behalf of. This will appear the same in logs as if the user was making the request.",
   "LabelApiToken": "API Token",
   "LabelAppend": "Append",
   "LabelAudioBitrate": "Audio Bitrate (e.g. 128k)",
@@ -348,6 +357,10 @@
   "LabelExample": "Example",
   "LabelExpandSeries": "Expand Series",
   "LabelExpandSubSeries": "Expand Sub Series",
+  "LabelExpired": "Expired",
+  "LabelExpiresAt": "Expires At",
+  "LabelExpiresInSeconds": "Expires in (seconds)",
+  "LabelExpiresNever": "Never",
   "LabelExplicit": "Explicit",
   "LabelExplicitChecked": "Explicit (checked)",
   "LabelExplicitUnchecked": "Not Explicit (unchecked)",
@@ -407,6 +420,7 @@
   "LabelLanguages": "Languages",
   "LabelLastBookAdded": "Last Book Added",
   "LabelLastBookUpdated": "Last Book Updated",
+  "LabelLastProgressDate": "Last progress: {0}",
   "LabelLastSeen": "Last Seen",
   "LabelLastTime": "Last Time",
   "LabelLastUpdate": "Last Update",
@@ -419,6 +433,7 @@
   "LabelLibraryFilterSublistEmpty": "No {0}",
   "LabelLibraryItem": "Library Item",
   "LabelLibraryName": "Library Name",
+  "LabelLibrarySortByProgress": "Progress Updated",
   "LabelLimit": "Limit",
   "LabelLineSpacing": "Line spacing",
   "LabelListenAgain": "Listen Again",
@@ -427,6 +442,7 @@
   "LabelLogLevelWarn": "Warn",
   "LabelLookForNewEpisodesAfterDate": "Look for new episodes after this date",
   "LabelLowestPriority": "Lowest Priority",
+  "LabelMatchConfidence": "Confidence",
   "LabelMatchExistingUsersBy": "Match existing users by",
   "LabelMatchExistingUsersByDescription": "Used for connecting existing users. Once connected, users will be matched by a unique id from your SSO provider",
   "LabelMaxEpisodesToDownload": "Max # of episodes to download. Use 0 for unlimited.",
@@ -458,6 +474,7 @@
   "LabelNextBackupDate": "Next backup date",
   "LabelNextChapters": "Next chapters will be:",
   "LabelNextScheduledRun": "Next scheduled run",
+  "LabelNoApiKeys": "No API keys",
   "LabelNoCustomMetadataProviders": "No custom metadata providers",
   "LabelNoEpisodesSelected": "No episodes selected",
   "LabelNotFinished": "Not Finished",
@@ -548,6 +565,7 @@
   "LabelSelectAll": "Select all",
   "LabelSelectAllEpisodes": "Select all episodes",
   "LabelSelectEpisodesShowing": "Select {0} episodes showing",
+  "LabelSelectUser": "Select user",
   "LabelSelectUsers": "Select users",
   "LabelSendEbookToDevice": "Send Ebook to...",
   "LabelSequence": "Sequence",
@@ -644,6 +662,7 @@
   "LabelTheme": "Theme",
   "LabelThemeDark": "Dark",
   "LabelThemeLight": "Light",
+  "LabelThemeSepia": "Sepia",
   "LabelTimeBase": "Time Base",
   "LabelTimeDurationXHours": "{0} hours",
   "LabelTimeDurationXMinutes": "{0} minutes",
@@ -712,7 +731,9 @@
   "MessageAddToPlayerQueue": "Add to player queue",
   "MessageAppriseDescription": "To use this feature you will need to have an instance of <a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">Apprise API</a> running or an api that will handle those same requests. <br />The Apprise API Url should be the full URL path to send the notification, e.g., if your API instance is served at <code>http://192.168.1.1:8337</code> then you would put <code>http://192.168.1.1:8337/notify</code>.",
   "MessageAsinCheck": "Ensure you are using the ASIN from the correct Audible region, not Amazon.",
+  "MessageAuthenticationLegacyTokenWarning": "Legacy API tokens will be removed in the future. Use <a href=\"/config/api-keys\">API Keys</a> instead.",
   "MessageAuthenticationOIDCChangesRestart": "Restart your server after saving to apply OIDC changes.",
+  "MessageAuthenticationSecurityMessage": "Authentication has been improved for security. All users are required to re-login.",
   "MessageBackupsDescription": "Backups include users, user progress, library item details, server settings, and images stored in <code>/metadata/items</code> & <code>/metadata/authors</code>. Backups <strong>do not</strong> include any files stored in your library folders.",
   "MessageBackupsLocationEditNote": "Note: Updating the backup location will not move or modify existing backups",
   "MessageBackupsLocationNoEditNote": "Note: The backup location is set through an environment variable and cannot be changed here.",
@@ -735,6 +756,7 @@
   "MessageChaptersNotFound": "Chapters not found",
   "MessageCheckingCron": "Checking cron...",
   "MessageConfirmCloseFeed": "Are you sure you want to close this feed?",
+  "MessageConfirmDeleteApiKey": "Are you sure you want to delete API key \"{0}\"?",
   "MessageConfirmDeleteBackup": "Are you sure you want to delete backup for {0}?",
   "MessageConfirmDeleteDevice": "Are you sure you want to delete e-reader device \"{0}\"?",
   "MessageConfirmDeleteFile": "This will delete the file from your file system. Are you sure?",
@@ -762,6 +784,7 @@
   "MessageConfirmRemoveAuthor": "Are you sure you want to remove author \"{0}\"?",
   "MessageConfirmRemoveCollection": "Are you sure you want to remove collection \"{0}\"?",
   "MessageConfirmRemoveEpisode": "Are you sure you want to remove episode \"{0}\"?",
+  "MessageConfirmRemoveEpisodeNote": "Note: This does not delete the audio file unless toggling \"Hard delete file\"",
   "MessageConfirmRemoveEpisodes": "Are you sure you want to remove {0} episodes?",
   "MessageConfirmRemoveListeningSessions": "Are you sure you want to remove {0} listening sessions?",
   "MessageConfirmRemoveMetadataFiles": "Are you sure you want to remove all metadata.{0} files in your library item folders?",
@@ -923,6 +946,8 @@
   "NotificationOnBackupCompletedDescription": "Triggered when a backup is completed",
   "NotificationOnBackupFailedDescription": "Triggered when a backup fails",
   "NotificationOnEpisodeDownloadedDescription": "Triggered when a podcast episode is auto-downloaded",
+  "NotificationOnRSSFeedDisabledDescription": "Triggered when automatic episode downloads are disabled due to too many failed attempts",
+  "NotificationOnRSSFeedFailedDescription": "Triggered when the RSS feed request fails for an automatic episode download",
   "NotificationOnTestDescription": "Event for testing the notification system",
   "PlaceholderBulkChapterInput": "Enter chapter title or use numbering (e.g., 'Episode 1', 'Chapter 10', '1.')",
   "PlaceholderNewCollection": "New collection name",
@@ -1009,6 +1034,8 @@
   "ToastEpisodeDownloadQueueClearSuccess": "Episode download queue cleared",
   "ToastEpisodeUpdateSuccess": "{0} episodes updated",
   "ToastErrorCannotShare": "Cannot share natively on this device",
+  "ToastFailedToCreate": "Failed to create",
+  "ToastFailedToDelete": "Failed to delete",
   "ToastFailedToLoadData": "Failed to load data",
   "ToastFailedToMatch": "Failed to match",
   "ToastFailedToShare": "Failed to share",
@@ -1040,6 +1067,7 @@
   "ToastMustHaveAtLeastOnePath": "Must have at least one path",
   "ToastNameEmailRequired": "Name and email are required",
   "ToastNameRequired": "Name is required",
+  "ToastNewApiKeyUserError": "Must select a user",
   "ToastNewEpisodesFound": "{0} new episodes found",
   "ToastNewUserCreatedFailed": "Failed to create account: \"{0}\"",
   "ToastNewUserCreatedSuccess": "New account created",
diff --git a/client/strings/fr.json b/client/strings/fr.json
index 1d5f8859..e57b7a52 100644
--- a/client/strings/fr.json
+++ b/client/strings/fr.json
@@ -1,5 +1,6 @@
 {
   "ButtonAdd": "Ajouter",
+  "ButtonAddApiKey": "Ajouter une clé API",
   "ButtonAddChapters": "Ajouter des chapitres",
   "ButtonAddDevice": "Ajouter un appareil",
   "ButtonAddLibrary": "Ajouter une bibliothèque",
@@ -20,6 +21,7 @@
   "ButtonChooseAFolder": "Sélectionner un dossier",
   "ButtonChooseFiles": "Sélectionner des fichiers",
   "ButtonClearFilter": "Effacer le filtre",
+  "ButtonClose": "Fermer",
   "ButtonCloseFeed": "Fermer le flux",
   "ButtonCloseSession": "Fermer la session",
   "ButtonCollections": "Collections",
@@ -119,6 +121,7 @@
   "HeaderAccount": "Compte",
   "HeaderAddCustomMetadataProvider": "Ajouter un fournisseur de métadonnées personnalisé",
   "HeaderAdvanced": "Avancé",
+  "HeaderApiKeys": "Clés API",
   "HeaderAppriseNotificationSettings": "Configuration des notifications Apprise",
   "HeaderAudioTracks": "Pistes audio",
   "HeaderAudiobookTools": "Outils de gestion de fichiers de livres audio",
@@ -163,6 +166,7 @@
   "HeaderMetadataOrderOfPrecedence": "Ordre de priorité des métadonnées",
   "HeaderMetadataToEmbed": "Métadonnées à intégrer",
   "HeaderNewAccount": "Nouveau compte",
+  "HeaderNewApiKey": "Nouvelle clé API",
   "HeaderNewLibrary": "Nouvelle bibliothèque",
   "HeaderNotificationCreate": "Créer une notification",
   "HeaderNotificationUpdate": "Mise à jour de la notification",
@@ -178,6 +182,7 @@
   "HeaderPlaylist": "Liste de lecture",
   "HeaderPlaylistItems": "Éléments de la liste de lecture",
   "HeaderPodcastsToAdd": "Podcasts à ajouter",
+  "HeaderPresets": "Préréglages",
   "HeaderPreviewCover": "Prévisualiser la couverture",
   "HeaderRSSFeedGeneral": "Détails du flux RSS",
   "HeaderRSSFeedIsOpen": "Le flux RSS est actif",
@@ -206,6 +211,7 @@
   "HeaderTableOfContents": "Table des matières",
   "HeaderTools": "Outils",
   "HeaderUpdateAccount": "Mettre à jour le compte",
+  "HeaderUpdateApiKey": "Mettre à jour la clé API",
   "HeaderUpdateAuthor": "Mettre à jour l’auteur",
   "HeaderUpdateDetails": "Mettre à jour les détails",
   "HeaderUpdateLibrary": "Mettre à jour la bibliothèque",
@@ -235,6 +241,10 @@
   "LabelAllUsersExcludingGuests": "Tous les utilisateurs à l’exception des invités",
   "LabelAllUsersIncludingGuests": "Tous les utilisateurs, y compris les invités",
   "LabelAlreadyInYourLibrary": "Déjà dans la bibliothèque",
+  "LabelApiKeyCreated": "La clé API « {0} » a été créée avec succès.",
+  "LabelApiKeyCreatedDescription": "Assurez-vous de copier la clé API maintenant car vous ne pourrez plus la voir.",
+  "LabelApiKeyUser": "Agir au nom de l’utilisateur",
+  "LabelApiKeyUserDescription": "Cette clé API disposera des mêmes autorisations que l’utilisateur pour lequel elle agit. Elle apparaîtra dans les journaux comme si c’était l’utilisateur qui effectuait la requête.",
   "LabelApiToken": "Token API",
   "LabelAppend": "Ajouter",
   "LabelAudioBitrate": "Débit audio (par exemple 128k)",
@@ -347,6 +357,10 @@
   "LabelExample": "Exemple",
   "LabelExpandSeries": "Développer la série",
   "LabelExpandSubSeries": "Développer les sous-séries",
+  "LabelExpired": "Expiré",
+  "LabelExpiresAt": "Expire à",
+  "LabelExpiresInSeconds": "Expire dans (secondes)",
+  "LabelExpiresNever": "Jamais",
   "LabelExplicit": "Restriction",
   "LabelExplicitChecked": "Explicite (vérifié)",
   "LabelExplicitUnchecked": "Non explicite (non vérifié)",
@@ -457,6 +471,7 @@
   "LabelNextBackupDate": "Date de la prochaine sauvegarde",
   "LabelNextChapters": "Les prochains chapitres seront :",
   "LabelNextScheduledRun": "Prochain lancement prévu",
+  "LabelNoApiKeys": "Aucune clé API",
   "LabelNoCustomMetadataProviders": "Aucun fournisseurs de métadonnées personnalisés",
   "LabelNoEpisodesSelected": "Aucun épisode sélectionné",
   "LabelNotFinished": "Non terminé",
@@ -547,6 +562,7 @@
   "LabelSelectAll": "Tout sélectionner",
   "LabelSelectAllEpisodes": "Sélectionner tous les épisodes",
   "LabelSelectEpisodesShowing": "Sélectionner {0} épisode(s) en cours",
+  "LabelSelectUser": "Sélectionner l’utilisateur",
   "LabelSelectUsers": "Sélectionner les utilisateurs",
   "LabelSendEbookToDevice": "Envoyer le livre numérique à…",
   "LabelSequence": "Séquence",
@@ -711,7 +727,9 @@
   "MessageAddToPlayerQueue": "Ajouter en file d’attente",
   "MessageAppriseDescription": "Nécessite une instance d’<a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">API Apprise</a> pour utiliser cette fonctionnalité ou une api qui prend en charge les mêmes requêtes.<br />L’URL de l’API Apprise doit comprendre le chemin complet pour envoyer la notification. Par exemple, si votre instance écoute sur <code>http://192.168.1.1:8337</code> alors vous devez mettre <code>http://192.168.1.1:8337/notify</code>.",
   "MessageAsinCheck": "Assurez-vous d’utiliser l’ASIN de la bonne région Audible, et non d’Amazon.",
+  "MessageAuthenticationLegacyTokenWarning": "Les jetons d’API hérités seront supprimés à l’avenir. Utilisez plutôt les <a href=\"/config/api-keys\">clés API</a>.",
   "MessageAuthenticationOIDCChangesRestart": "Redémarrez votre serveur après avoir enregistré pour appliquer les modifications OIDC.",
+  "MessageAuthenticationSecurityMessage": "L’authentification a été améliorée pour plus de sécurité. Tous les utilisateurs doivent se reconnecter.",
   "MessageBackupsDescription": "Les sauvegardes incluent les utilisateurs, la progression des utilisateurs, les détails des éléments de la bibliothèque, les paramètres du serveur et les images stockées dans <code>/metadata/items</code> & <code>/metadata/authors</code>. Les sauvegardes <strong>n’incluent pas</strong> les fichiers stockés dans les dossiers de votre bibliothèque.",
   "MessageBackupsLocationEditNote": "Remarque : Mettre à jour l'emplacement de sauvegarde ne déplacera pas ou ne modifiera pas les sauvegardes existantes",
   "MessageBackupsLocationNoEditNote": "Remarque : l’emplacement de sauvegarde est défini via une variable d’environnement et ne peut pas être modifié ici.",
@@ -734,6 +752,7 @@
   "MessageChaptersNotFound": "Chapitres non trouvés",
   "MessageCheckingCron": "Vérification du cron…",
   "MessageConfirmCloseFeed": "Êtes-vous sûr·e de vouloir fermer ce flux ?",
+  "MessageConfirmDeleteApiKey": "Êtes-vous sûr de vouloir supprimer la clé API « {0} » ?",
   "MessageConfirmDeleteBackup": "Êtes-vous sûr·e de vouloir supprimer la sauvegarde de « {0} » ?",
   "MessageConfirmDeleteDevice": "Êtes-vous sûr·e de vouloir supprimer la liseuse « {0} » ?",
   "MessageConfirmDeleteFile": "Cela supprimera le fichier de votre système de fichiers. Êtes-vous sûr ?",
@@ -761,6 +780,7 @@
   "MessageConfirmRemoveAuthor": "Êtes-vous sûr·e de vouloir supprimer l’auteur « {0} » ?",
   "MessageConfirmRemoveCollection": "Êtes-vous sûr·e de vouloir supprimer la collection « {0} » ?",
   "MessageConfirmRemoveEpisode": "Êtes-vous sûr·e de vouloir supprimer l’épisode « {0} » ?",
+  "MessageConfirmRemoveEpisodeNote": "Remarque : cela ne supprime pas le fichier audio, sauf si vous activez « Supprimer définitivement le fichier »",
   "MessageConfirmRemoveEpisodes": "Êtes-vous sûr·e de vouloir supprimer {0} épisodes ?",
   "MessageConfirmRemoveListeningSessions": "Êtes-vous sûr·e de vouloir supprimer {0} sessions d’écoute ?",
   "MessageConfirmRemoveMetadataFiles": "Êtes-vous sûr·e de vouloir supprimer tous les fichiers « metatadata.{0} » des dossiers d’éléments de votre bibliothèque ?",
@@ -922,6 +942,8 @@
   "NotificationOnBackupCompletedDescription": "Déclenché lorsqu’une sauvegarde est terminée",
   "NotificationOnBackupFailedDescription": "Déclenché lorsqu'une sauvegarde échoue",
   "NotificationOnEpisodeDownloadedDescription": "Déclenché lorsqu’un épisode de podcast est téléchargé automatiquement",
+  "NotificationOnRSSFeedDisabledDescription": "Déclenché lorsque les téléchargements automatiques d’épisodes sont désactivés en raison d’un trop grand nombre de tentatives infructueuses",
+  "NotificationOnRSSFeedFailedDescription": "Déclenché lorsque la demande de flux RSS échoue pour un téléchargement automatique d’épisode",
   "NotificationOnTestDescription": "Événement pour tester le système de notification",
   "PlaceholderBulkChapterInput": "Entrez le titre du chapitre ou utilisez la numérotation (ex. 'Épisode 1', 'Chapitre 10', '1.')",
   "PlaceholderNewCollection": "Nom de la nouvelle collection",
@@ -1006,6 +1028,8 @@
   "ToastEpisodeDownloadQueueClearSuccess": "File d’attente de téléchargement des épisodes effacée",
   "ToastEpisodeUpdateSuccess": "{0} épisodes mis à jour",
   "ToastErrorCannotShare": "Impossible de partager nativement sur cet appareil",
+  "ToastFailedToCreate": "Échec de la création",
+  "ToastFailedToDelete": "Échec de la suppression",
   "ToastFailedToLoadData": "Échec du chargement des données",
   "ToastFailedToMatch": "Échec de la correspondance",
   "ToastFailedToShare": "Échec du partage",
@@ -1037,6 +1061,7 @@
   "ToastMustHaveAtLeastOnePath": "Doit avoir au moins un chemin",
   "ToastNameEmailRequired": "Le nom et le courriel sont requis",
   "ToastNameRequired": "Le nom est requis",
+  "ToastNewApiKeyUserError": "Vous devez sélectionner un utilisateur",
   "ToastNewEpisodesFound": "{0} nouveaux épisodes trouvés",
   "ToastNewUserCreatedFailed": "La création du compte à échouée : « {0} »",
   "ToastNewUserCreatedSuccess": "Nouveau compte créé",
diff --git a/client/strings/gu.json b/client/strings/gu.json
index f0eee434..301d673b 100644
--- a/client/strings/gu.json
+++ b/client/strings/gu.json
@@ -9,6 +9,9 @@
   "ButtonApply": "લાગુ કરો",
   "ButtonApplyChapters": "પ્રકરણો લાગુ કરો",
   "ButtonAuthors": "લેખકો",
+  "ButtonBack": "પાછા",
+  "ButtonBatchEditPopulateFromExisting": "હાલની માહિતીમાંથી ભરો",
+  "ButtonBatchEditPopulateMapDetails": "નકશાની વિગત ભરો",
   "ButtonBrowseForFolder": "ફોલ્ડર માટે જુઓ",
   "ButtonCancel": "રદ કરો",
   "ButtonCancelEncode": "એન્કોડ રદ કરો",
@@ -27,11 +30,14 @@
   "ButtonEdit": "સંપાદિત કરો",
   "ButtonEditChapters": "પ્રકરણો સંપાદિત કરો",
   "ButtonEditPodcast": "પોડકાસ્ટ સંપાદિત કરો",
+  "ButtonEnable": "સક્રિય કરો",
   "ButtonForceReScan": "બળપૂર્વક ફરીથી સ્કેન કરો",
   "ButtonFullPath": "સંપૂર્ણ પથ",
   "ButtonHide": "છુપાવો",
   "ButtonHome": "ઘર",
   "ButtonIssues": "સમસ્યાઓ",
+  "ButtonJumpBackward": "પાછળ જાવો",
+  "ButtonJumpForward": "આગળ જાવો",
   "ButtonLatest": "નવીનતમ",
   "ButtonLibrary": "પુસ્તકાલય",
   "ButtonLogout": "લૉગ આઉટ",
@@ -41,19 +47,32 @@
   "ButtonMatchAllAuthors": "બધા મેળ ખાતા લેખકો શોધો",
   "ButtonMatchBooks": "મેળ ખાતી પુસ્તકો શોધો",
   "ButtonNevermind": "કંઈ વાંધો નહીં",
+  "ButtonNext": "આગળ જાઓ",
+  "ButtonNextChapter": "આગળનું અધ્યાય",
+  "ButtonNextItemInQueue": "કતારમાં આવતું આગળનું અધ્યાય",
   "ButtonOk": "ઓકે",
   "ButtonOpenFeed": "ફીડ ખોલો",
   "ButtonOpenManager": "મેનેજર ખોલો",
+  "ButtonPause": "વિરામ",
   "ButtonPlay": "ચલાવો",
+  "ButtonPlayAll": "બધું ચલાવો",
   "ButtonPlaying": "ચલાવી રહ્યું છે",
   "ButtonPlaylists": "પ્લેલિસ્ટ",
+  "ButtonPrevious": "પાછળનું",
+  "ButtonPreviousChapter": "પાછળનું અધ્યાય",
+  "ButtonProbeAudioFile": "ઑડિયો ફાઇલ તપાસો",
   "ButtonPurgeAllCache": "બધો Cache કાઢી નાખો",
   "ButtonPurgeItemsCache": "વસ્તુઓનો Cache કાઢી નાખો",
   "ButtonQueueAddItem": "કતારમાં ઉમેરો",
   "ButtonQueueRemoveItem": "કતારથી કાઢી નાખો",
+  "ButtonQuickEmbed": "ઝડપથી સમાવેશ કરો",
+  "ButtonQuickEmbedMetadata": "ઝડપથી મેટાડેટા સમાવવો",
   "ButtonQuickMatch": "ઝડપી મેળ ખવડાવો",
   "ButtonReScan": "ફરીથી સ્કેન કરો",
   "ButtonRead": "વાંચો",
+  "ButtonReadLess": "ઓછું વાંચો",
+  "ButtonReadMore": "વધારે વાંચો",
+  "ButtonRefresh": "તાજું કરો",
   "ButtonRemove": "કાઢી નાખો",
   "ButtonRemoveAll": "બધું કાઢી નાખો",
   "ButtonRemoveAllLibraryItems": "બધું પુસ્તકાલય વસ્તુઓ કાઢી નાખો",
@@ -68,16 +87,21 @@
   "ButtonSaveTracklist": "ટ્રેક યાદી સાચવો",
   "ButtonScan": "સ્કેન કરો",
   "ButtonScanLibrary": "પુસ્તકાલય સ્કેન કરો",
+  "ButtonScrollLeft": "ડાબે",
+  "ButtonScrollRight": "જમણે",
   "ButtonSearch": "શોધો",
   "ButtonSelectFolderPath": "ફોલ્ડર પથ પસંદ કરો",
   "ButtonSeries": "સિરીઝ",
   "ButtonSetChaptersFromTracks": "ટ્રેક્સથી પ્રકરણો સેટ કરો",
+  "ButtonShare": "શેર કરો",
   "ButtonShiftTimes": "સમય શિફ્ટ કરો",
   "ButtonShow": "બતાવો",
   "ButtonStartM4BEncode": "M4B એન્કોડ શરૂ કરો",
   "ButtonStartMetadataEmbed": "મેટાડેટા એમ્બેડ શરૂ કરો",
+  "ButtonStats": "આંકડા",
   "ButtonSubmit": "સબમિટ કરો",
   "ButtonTest": "પરખ કરો",
+  "ButtonUnlinkOpenId": "OpenID દૂર કરો",
   "ButtonUpload": "અપલોડ કરો",
   "ButtonUploadBackup": "બેકઅપ અપલોડ કરો",
   "ButtonUploadCover": "કવર અપલોડ કરો",
@@ -86,11 +110,16 @@
   "ButtonUserEdit": "વપરાશકર્તા {0} સંપાદિત કરો",
   "ButtonViewAll": "બધું જુઓ",
   "ButtonYes": "હા",
+  "ErrorUploadFetchMetadataAPI": "મેટાડેટા મેળવવામાં તકલીફ આવી",
+  "ErrorUploadFetchMetadataNoResults": "મેટાડેટા મેળવી શક્યા નહીં – કૃપા કરીને શીર્ષક અને/અથવા લેખકનું નામ અપડેટ કરવાનો પ્રયત્ન કરો",
+  "ErrorUploadLacksTitle": "શીર્ષક હોવું આવશ્યક છે",
   "HeaderAccount": "એકાઉન્ટ",
+  "HeaderAddCustomMetadataProvider": "કસ્ટમ મેટાડેટા પ્રોવાઇડર ઉમેરો",
   "HeaderAdvanced": "અડ્વાન્સડ",
   "HeaderAppriseNotificationSettings": "Apprise સૂચના સેટિંગ્સ",
   "HeaderAudioTracks": "ઓડિયો ટ્રેક્સ",
   "HeaderAudiobookTools": "ઓડિયોબુક ફાઇલ વ્યવસ્થાપન ટૂલ્સ",
+  "HeaderAuthentication": "પ્રમાણીકરણ",
   "HeaderBackups": "બેકઅપ્સ",
   "HeaderChangePassword": "પાસવર્ડ બદલો",
   "HeaderChapters": "પ્રકરણો",
@@ -99,6 +128,7 @@
   "HeaderCollectionItems": "સંગ્રહ વસ્તુઓ",
   "HeaderCover": "આવરણ",
   "HeaderCurrentDownloads": "વર્તમાન ડાઉનલોડ્સ",
+  "HeaderCustomMetadataProviders": "કસ્ટમ મેટાડેટા પ્રોવાઇડર્સ",
   "HeaderDetails": "વિગતો",
   "HeaderDownloadQueue": "ડાઉનલોડ કતાર",
   "HeaderEbookFiles": "ઇબુક ફાઇલો",
@@ -129,6 +159,7 @@
   "HeaderMetadataToEmbed": "એમ્બેડ કરવા માટે મેટાડેટા",
   "HeaderNewAccount": "નવું એકાઉન્ટ",
   "HeaderNewLibrary": "નવી પુસ્તકાલય",
+  "HeaderNotificationCreate": "સૂચના બનાવો",
   "HeaderNotifications": "સૂચનાઓ",
   "HeaderOpenRSSFeed": "RSS ફીડ ખોલો",
   "HeaderOtherFiles": "અન્ય ફાઇલો",
diff --git a/client/strings/hr.json b/client/strings/hr.json
index c4715ff3..5289f803 100644
--- a/client/strings/hr.json
+++ b/client/strings/hr.json
@@ -1,5 +1,6 @@
 {
   "ButtonAdd": "Dodaj",
+  "ButtonAddApiKey": "Dodaj API ključ",
   "ButtonAddChapters": "Dodaj poglavlja",
   "ButtonAddDevice": "Dodaj uređaj",
   "ButtonAddLibrary": "Dodaj knjižnicu",
@@ -20,6 +21,7 @@
   "ButtonChooseAFolder": "Odaberi mapu",
   "ButtonChooseFiles": "Odaberi datoteke",
   "ButtonClearFilter": "Poništi filter",
+  "ButtonClose": "Zatvori",
   "ButtonCloseFeed": "Zatvori izvor",
   "ButtonCloseSession": "Zatvori otvorenu sesiju",
   "ButtonCollections": "Zbirke",
@@ -119,6 +121,7 @@
   "HeaderAccount": "Korisnički račun",
   "HeaderAddCustomMetadataProvider": "Dodaj prilagođenog pružatelja meta-podataka",
   "HeaderAdvanced": "Napredno",
+  "HeaderApiKeys": "API ključevi",
   "HeaderAppriseNotificationSettings": "Postavke obavijesti Apprise",
   "HeaderAudioTracks": "Zvučni zapisi",
   "HeaderAudiobookTools": "Alati za upravljanje datotekama zvučnih knjiga",
@@ -162,6 +165,7 @@
   "HeaderMetadataOrderOfPrecedence": "Redoslijed prihvaćanja meta-podataka",
   "HeaderMetadataToEmbed": "Meta-podatci za ugradnju",
   "HeaderNewAccount": "Novi korisnički račun",
+  "HeaderNewApiKey": "Novi API ključ",
   "HeaderNewLibrary": "Nova knjižnica",
   "HeaderNotificationCreate": "Izradi obavijest",
   "HeaderNotificationUpdate": "Ažuriraj obavijest",
@@ -206,6 +210,7 @@
   "HeaderTableOfContents": "Sadržaj",
   "HeaderTools": "Alati",
   "HeaderUpdateAccount": "Ažuriraj korisnički račun",
+  "HeaderUpdateApiKey": "Ažuriraj API ključ",
   "HeaderUpdateAuthor": "Ažuriraj autora",
   "HeaderUpdateDetails": "Ažuriraj pojedinosti",
   "HeaderUpdateLibrary": "Ažuriraj knjižnicu",
@@ -235,6 +240,10 @@
   "LabelAllUsersExcludingGuests": "Svi korisnici osim gostiju",
   "LabelAllUsersIncludingGuests": "Svi korisnici uključujući i goste",
   "LabelAlreadyInYourLibrary": "Već u vašoj knjižnici",
+  "LabelApiKeyCreated": "API ključ \"{0}\" uspješno izrađen.",
+  "LabelApiKeyCreatedDescription": "Ne zaboravite odmah kopirati API ključ jer ga više nećete moći vidjeti.",
+  "LabelApiKeyUser": "Izvršavaj u ime korisnika",
+  "LabelApiKeyUserDescription": "Ovaj API ključ imat će iste dozvole kao i korisnik u čije ime djeluje. U zapisnicima će biti zabilježeno da je korisnik slao zahtjeve.",
   "LabelApiToken": "API Token",
   "LabelAppend": "Pridodaj",
   "LabelAudioBitrate": "Kvaliteta zvučnog zapisa (npr. 128k)",
@@ -346,7 +355,11 @@
   "LabelExample": "Primjer",
   "LabelExpandSeries": "Serijal prikaži prošireno",
   "LabelExpandSubSeries": "Podserijal prikaži prošireno",
-  "LabelExplicit": "Eksplicitni sadržaj",
+  "LabelExpired": "Istekao",
+  "LabelExpiresAt": "Istječe",
+  "LabelExpiresInSeconds": "Istječe za (sekundi)",
+  "LabelExpiresNever": "Nikada",
+  "LabelExplicit": "Eksplicitno",
   "LabelExplicitChecked": "Eksplicitni sadržaj (označeno)",
   "LabelExplicitUnchecked": "Nije eksplicitni sadržaj (odznačeno)",
   "LabelExportOPML": "Izvoz OPML-a",
@@ -455,6 +468,7 @@
   "LabelNewestEpisodes": "Najnoviji nastavci",
   "LabelNextBackupDate": "Sljedeća izrada sigurnosne kopije",
   "LabelNextScheduledRun": "Sljedeće zakazano izvođenje",
+  "LabelNoApiKeys": "Nema API ključeva",
   "LabelNoCustomMetadataProviders": "Nema prilagođenih pružatelja meta-podataka",
   "LabelNoEpisodesSelected": "Nema odabranih nastavaka",
   "LabelNotFinished": "Nije dovršeno",
@@ -544,6 +558,7 @@
   "LabelSelectAll": "Označi sve",
   "LabelSelectAllEpisodes": "Označi sve nastavke",
   "LabelSelectEpisodesShowing": "Prikazujem {0} odabranih nastavaka",
+  "LabelSelectUser": "Odaberite korisnika",
   "LabelSelectUsers": "Označi korisnike",
   "LabelSendEbookToDevice": "Pošalji e-knjigu …",
   "LabelSequence": "Slijed",
@@ -708,7 +723,9 @@
   "MessageAddToPlayerQueue": "Dodaj u redoslijed izvođenja",
   "MessageAppriseDescription": "Da biste se koristili ovom značajkom, treba vam instanca <a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">Apprise API-ja</a> ili API koji može rukovati istom vrstom zahtjeva.<br />The Adresa Apprise API-ja treba biti puna URL putanja za slanje obavijesti, npr. ako vam se API instanca poslužuje na adresi <code>http://192.168.1.1:8337</code> trebate upisati <code>http://192.168.1.1:8337/notify</code>.",
   "MessageAsinCheck": "Upišite ASIN iz odgovarajuće Audibleove regije, ne s Amazonov.",
+  "MessageAuthenticationLegacyTokenWarning": "Starije API tokene ćemo ukloniti. Umjesto njih, koristite se <a href=\"/config/api-keys\">API ključevima</a> .",
   "MessageAuthenticationOIDCChangesRestart": "Ponovno pokrenite poslužitelj da biste primijenili OIDC promjene.",
+  "MessageAuthenticationSecurityMessage": "Provjera autentičnosti poboljšana je radi sigurnosti. Svi se korisnici moraju ponovno prijaviti.",
   "MessageBackupsDescription": "Sigurnosne kopije sadrže korisnike, korisnikov napredak medija, pojedinosti knjižničke građe, postavke poslužitelja i slike koje se spremaju u <code>/metadata/items</code> & <code>/metadata/authors</code>. Sigurnosne kopije ne sadrže niti jednu datoteku iz mapa knjižnice.",
   "MessageBackupsLocationEditNote": "Napomena: Uređivanje lokacije za sigurnosne kopije ne premješta ili mijenja postojeće sigurnosne kopije",
   "MessageBackupsLocationNoEditNote": "Napomena: Lokacija za sigurnosne kopije zadana je kroz varijablu okoline i ovdje se ne može izmijeniti.",
@@ -730,6 +747,7 @@
   "MessageChaptersNotFound": "Poglavlja nisu pronađena",
   "MessageCheckingCron": "Provjeravam cron...",
   "MessageConfirmCloseFeed": "Sigurno želite zatvoriti ovaj izvor?",
+  "MessageConfirmDeleteApiKey": "Sigurno želite izbrisati API ključ \"{0}\"?",
   "MessageConfirmDeleteBackup": "Sigurno želite izbrisati sigurnosnu kopiju za {0}?",
   "MessageConfirmDeleteDevice": "Sigurno želite izbrisati e-čitač \"{0}\"?",
   "MessageConfirmDeleteFile": "Ovo će izbrisati datoteke s datotečnog sustava. Jeste li sigurni?",
@@ -757,6 +775,7 @@
   "MessageConfirmRemoveAuthor": "Sigurno želite ukloniti autora \"{0}\"?",
   "MessageConfirmRemoveCollection": "Sigurno želite obrisati kolekciju \"{0}\"?",
   "MessageConfirmRemoveEpisode": "Sigurno želite ukloniti nastavak \"{0}\"?",
+  "MessageConfirmRemoveEpisodeNote": "Napomena: Ova funkcija neće izbrisati zvučnu datoteku ukoliko ne uključite opciju \"Izbriši datoteku zauvijek\"",
   "MessageConfirmRemoveEpisodes": "Sigurno želite ukloniti {0} nastavaka?",
   "MessageConfirmRemoveListeningSessions": "Sigurno želite ukloniti {0} sesija slušanja?",
   "MessageConfirmRemoveMetadataFiles": "Sigurno želite ukloniti sve datoteke metadata.{0} u mapama vaših knjižničkih stavki?",
@@ -918,6 +937,8 @@
   "NotificationOnBackupCompletedDescription": "Pokreće se po završetku sigurnosnog kopiranja",
   "NotificationOnBackupFailedDescription": "Pokreće se kada sigurnosno kopiranje ne uspije",
   "NotificationOnEpisodeDownloadedDescription": "Pokreće se kada se nastavak podcasta automatski preuzme",
+  "NotificationOnRSSFeedDisabledDescription": "Pokreće se kada su automatska preuzimanja nastavaka onemogućena zbog previše neuspjelih pokušaja",
+  "NotificationOnRSSFeedFailedDescription": "Pokreće se u slučaju pogreške pri pokušaju automatskog preuzimanja nastavka s RSS izvora",
   "NotificationOnTestDescription": "Događaj za testiranje sustava obavijesti",
   "PlaceholderNewCollection": "Ime nove zbirke",
   "PlaceholderNewFolderPath": "Nova putanja mape",
@@ -998,6 +1019,8 @@
   "ToastEpisodeDownloadQueueClearSuccess": "Redoslijed preuzimanja nastavaka očišćen",
   "ToastEpisodeUpdateSuccess": "{0} nastavak/a ažurirano",
   "ToastErrorCannotShare": "Dijeljenje na ovaj uređaj nije moguće",
+  "ToastFailedToCreate": "Izrada nije uspjela",
+  "ToastFailedToDelete": "Brisanje nije uspjelo",
   "ToastFailedToLoadData": "Učitavanje podataka nije uspjelo",
   "ToastFailedToMatch": "Nije prepoznato",
   "ToastFailedToShare": "Dijeljenje nije uspjelo",
@@ -1029,6 +1052,7 @@
   "ToastMustHaveAtLeastOnePath": "Mora postojati barem jedna putanja",
   "ToastNameEmailRequired": "Ime i adresa e-pošte su obavezni",
   "ToastNameRequired": "Ime je obavezno",
+  "ToastNewApiKeyUserError": "Morate odabrati korisnika",
   "ToastNewEpisodesFound": "pronađeno {0} novih nastavaka",
   "ToastNewUserCreatedFailed": "Račun \"{0}\" nije uspješno izrađen",
   "ToastNewUserCreatedSuccess": "Novi račun izrađen",
diff --git a/client/strings/hu.json b/client/strings/hu.json
index 16772328..325ead1a 100644
--- a/client/strings/hu.json
+++ b/client/strings/hu.json
@@ -11,7 +11,7 @@
   "ButtonAuthors": "Szerzők",
   "ButtonBack": "Vissza",
   "ButtonBatchEditPopulateFromExisting": "Létezőből feltöltés",
-  "ButtonBatchEditPopulateMapDetails": "",
+  "ButtonBatchEditPopulateMapDetails": "A térkép részleteinek feltöltése",
   "ButtonBrowseForFolder": "Mappa keresése",
   "ButtonCancel": "Mégse",
   "ButtonCancelEncode": "Kódolás megszakítása",
@@ -177,6 +177,7 @@
   "HeaderPlaylist": "Lejátszási lista",
   "HeaderPlaylistItems": "Lejátszási lista elemek",
   "HeaderPodcastsToAdd": "Hozzáadandó podcastok",
+  "HeaderPresets": "Alapbeállítások",
   "HeaderPreviewCover": "Borító előnézete",
   "HeaderRSSFeedGeneral": "RSS részletek",
   "HeaderRSSFeedIsOpen": "RSS hírcsatorna nyitva van",
@@ -219,6 +220,7 @@
   "LabelAccountTypeAdmin": "Adminisztrátor",
   "LabelAccountTypeGuest": "Vendég",
   "LabelAccountTypeUser": "Felhasználó",
+  "LabelActivities": "Tevékenységek",
   "LabelActivity": "Tevékenység",
   "LabelAddToCollection": "Hozzáadás a gyűjteményhez",
   "LabelAddToCollectionBatch": "{0} könyv hozzáadása a gyűjteményhez",
@@ -228,6 +230,7 @@
   "LabelAddedDate": "{0} Hozzáadva",
   "LabelAdminUsersOnly": "Csak admin felhasználók",
   "LabelAll": "Összes",
+  "LabelAllEpisodesDownloaded": "Minden epizód letöltve",
   "LabelAllUsers": "Minden felhasználó",
   "LabelAllUsersExcludingGuests": "Minden felhasználó, vendégek kivételével",
   "LabelAllUsersIncludingGuests": "Minden felhasználó, beleértve a vendégeket is",
@@ -251,7 +254,7 @@
   "LabelBackToUser": "Vissza a felhasználóhoz",
   "LabelBackupAudioFiles": "Audiófájlok biztonsági mentése",
   "LabelBackupLocation": "Biztonsági másolat helye",
-  "LabelBackupsEnableAutomaticBackups": "Automatikus biztonsági másolatok engedélyezése",
+  "LabelBackupsEnableAutomaticBackups": "Automatikus biztonsági másolatok",
   "LabelBackupsEnableAutomaticBackupsHelp": "Biztonsági másolatok mentése a /metadata/backups mappába",
   "LabelBackupsMaxBackupSize": "Maximális biztonsági másolat méret (GB-ban) (0-tól végtelenig)",
   "LabelBackupsMaxBackupSizeHelp": "A rossz konfiguráció elleni védelem érdekében a biztonsági másolatok meghiúsulnak, ha meghaladják a beállított méretet.",
@@ -275,7 +278,7 @@
   "LabelCollapseSeries": "Sorozat összecsukása",
   "LabelCollapseSubSeries": "Alszéria összecsukása",
   "LabelCollection": "Gyűjtemény",
-  "LabelCollections": "Gyűjtemény",
+  "LabelCollections": "Gyűjtemények",
   "LabelComplete": "Kész",
   "LabelConfirmPassword": "Jelszó megerősítése",
   "LabelContinueListening": "Hallgatás folytatása",
@@ -283,6 +286,7 @@
   "LabelContinueSeries": "Sorozat folytatása",
   "LabelCover": "Borító",
   "LabelCoverImageURL": "Borítókép URL",
+  "LabelCoverProvider": "Borító Szolgáltató",
   "LabelCreatedAt": "Létrehozás ideje",
   "LabelCronExpression": "Cron kifejezés",
   "LabelCurrent": "Jelenlegi",
@@ -391,7 +395,8 @@
   "LabelIntervalEvery6Hours": "Minden 6 órában",
   "LabelIntervalEveryDay": "Minden nap",
   "LabelIntervalEveryHour": "Minden órában",
-  "LabelInvert": "Megfordítás",
+  "LabelIntervalEveryMinute": "Minden percben",
+  "LabelInvert": "Inverz",
   "LabelItem": "Elem",
   "LabelJumpBackwardAmount": "Visszafelé ugrás mennyisége",
   "LabelJumpForwardAmount": "Előre ugrás mennyisége",
@@ -486,6 +491,7 @@
   "LabelPersonalYearReview": "Az éved összefoglalása ({0})",
   "LabelPhotoPathURL": "Fénykép útvonal/URL",
   "LabelPlayMethod": "Lejátszási módszer",
+  "LabelPlaybackRateIncrementDecrement": "Lejátszási sebesség növelés/csökkentés értéke",
   "LabelPlayerChapterNumberMarker": "{0} a {1} -ből",
   "LabelPlaylists": "Lejátszási listák",
   "LabelPodcast": "Podcast",
@@ -508,7 +514,7 @@
   "LabelPublishers": "Kiadók",
   "LabelRSSFeedCustomOwnerEmail": "Egyéni tulajdonos e-mail",
   "LabelRSSFeedCustomOwnerName": "Egyéni tulajdonos neve",
-  "LabelRSSFeedOpen": "RSS hírcsatorna nyitva",
+  "LabelRSSFeedOpen": "RSS-hírcsatorna nyitva",
   "LabelRSSFeedPreventIndexing": "Indexelés megakadályozása",
   "LabelRSSFeedSlug": "RSS hírcsatorna slug",
   "LabelRSSFeedURL": "RSS hírcsatorna URL",
@@ -525,6 +531,7 @@
   "LabelReleaseDate": "Megjelenés dátuma",
   "LabelRemoveAllMetadataAbs": "Az összes metadata.abs fájl eltávolítása",
   "LabelRemoveAllMetadataJson": "Az összes metadata.json fájl eltávolítása",
+  "LabelRemoveAudibleBranding": "Audible intro és outro eltávolítása a fejezetekből",
   "LabelRemoveCover": "Borító eltávolítása",
   "LabelRemoveMetadataFile": "Metaadatfájlok eltávolítása a könyvtár elemek mappáiból",
   "LabelRemoveMetadataFileHelp": "A metadata.json és metadata.abs fájlokat eltávolítása a {0} mappáidból.",
@@ -554,6 +561,8 @@
   "LabelSettingsBookshelfViewHelp": "Skeuomorfikus dizájn fa polcokkal",
   "LabelSettingsChromecastSupport": "Chromecast támogatás",
   "LabelSettingsDateFormat": "Dátumformátum",
+  "LabelSettingsEnableWatcher": "Változások automatikus vizsgálata a könyvtárakban",
+  "LabelSettingsEnableWatcherForLibrary": "Változások automatikus vizsgálata a könyvtárban",
   "LabelSettingsEnableWatcherHelp": "Engedélyezi az automatikus elem hozzáadás/frissítés funkciót, amikor fájlváltozásokat észlel. *Szerver újraindítása szükséges",
   "LabelSettingsEpubsAllowScriptedContent": "Szkriptelt tartalmak engedélyezése epub-okban",
   "LabelSettingsEpubsAllowScriptedContentHelp": "Megengedi, hogy az epub fájlok szkripteket hajtsanak végre. Ezt a beállítást kikapcsolva ajánlott tartani, kivéve, ha megbízik az epub fájlok forrásában.",
@@ -597,6 +606,7 @@
   "LabelSlug": "Rövid cím",
   "LabelSortAscending": "Emelkedő",
   "LabelSortDescending": "Csökkenő",
+  "LabelSortPubDate": "Rendezés megjelenés dátuma szerint",
   "LabelStart": "Kezdés",
   "LabelStartTime": "Kezdési idő",
   "LabelStarted": "Elkezdődött",
@@ -697,12 +707,17 @@
   "LabelYourProgress": "Haladásod",
   "MessageAddToPlayerQueue": "Hozzáadás a lejátszó sorhoz",
   "MessageAppriseDescription": "Ennek a funkció használatához futtatnia kell egy <a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">Apprise API</a> példányt vagy egy olyan API-t, amely kezeli ezeket a kéréseket. <br />Az Apprise API URL-nek a teljes URL útvonalat kell tartalmaznia az értesítés elküldéséhez, például, ha az API példánya a <code>http://192.168.1.1:8337</code> címen szolgáltatva, akkor <code>http://192.168.1.1:8337/notify</code> értéket kell megadnia.",
+  "MessageAsinCheck": "Győződjön meg róla, hogy az ASIN-t a megfelelő Audible régióból használja, nem az Amazonból.",
+  "MessageAuthenticationOIDCChangesRestart": "A mentés után indítsa újra a szervert az OIDC módosítások alkalmazásához.",
   "MessageBackupsDescription": "A biztonsági másolatok tartalmazzák a felhasználókat, a felhasználói haladást, a könyvtári elem részleteit, a szerver beállításait és a képeket, amelyek a <code>/metadata/items</code> és <code>/metadata/authors</code> mappákban vannak tárolva. A biztonsági másolatok <strong>nem</strong> tartalmazzák a könyvtári mappákban tárolt fájlokat.",
   "MessageBackupsLocationEditNote": "Megjegyzés: A biztonsági mentés helyének frissítése nem mozgatja vagy módosítja a meglévő biztonsági mentéseket",
   "MessageBackupsLocationNoEditNote": "Megjegyzés: A biztonsági mentés helye egy környezeti változóval van beállítva, és itt nem módosítható.",
   "MessageBackupsLocationPathEmpty": "A biztonsági mentés helyének elérési útvonala nem lehet üres",
+  "MessageBatchEditPopulateMapDetailsAllHelp": "Az engedélyezett mezők feltöltése az összes elem adatával. A több értéket tartalmazó mezők összevonásra kerülnek",
+  "MessageBatchEditPopulateMapDetailsItemHelp": "A térkép engedélyezett adatmezőinek feltöltése ezen elem adataival",
   "MessageBatchQuickMatchDescription": "A Gyors egyeztetés megpróbálja hozzáadni a hiányzó borítókat és metaadatokat a kiválasztott elemekhez. Engedélyezze az alábbi opciókat, hogy a Gyors egyeztetés felülírhassa a meglévő borítókat és/vagy metaadatokat.",
   "MessageBookshelfNoCollections": "Még nem készített gyűjteményeket",
+  "MessageBookshelfNoCollectionsHelp": "A gyűjtemények nyilvánosak. Minden, a könyvtárhoz hozzáféréssel rendelkező felhasználó láthatja őket.",
   "MessageBookshelfNoRSSFeeds": "Nincsenek nyitott RSS hírcsatornák",
   "MessageBookshelfNoResultsForFilter": "Nincs eredmény a \"{0}: {1}\" szűrőre",
   "MessageBookshelfNoResultsForQuery": "Nincs eredmény a lekérdezéshez",
@@ -712,6 +727,7 @@
   "MessageChapterErrorStartGteDuration": "Érvénytelen kezdési idő, kevesebbnek kell lennie, mint a hangoskönyv időtartama",
   "MessageChapterErrorStartLtPrev": "Érvénytelen kezdési idő, nagyobbnak kell lennie, mint az előző fejezet kezdési ideje",
   "MessageChapterStartIsAfter": "A fejezet kezdete a hangoskönyv végét követi",
+  "MessageChaptersNotFound": "Fejezetek nem találhatók",
   "MessageCheckingCron": "Cron ellenőrzése...",
   "MessageConfirmCloseFeed": "Biztosan be szeretné zárni ezt a hírcsatornát?",
   "MessageConfirmDeleteBackup": "Biztosan törölni szeretné a(z) {0} biztonsági másolatot?",
@@ -741,6 +757,7 @@
   "MessageConfirmRemoveAuthor": "Biztosan eltávolítja a(z) \"{0}\" szerzőt?",
   "MessageConfirmRemoveCollection": "Biztosan eltávolítja a(z) \"{0}\" gyűjteményt?",
   "MessageConfirmRemoveEpisode": "Biztosan eltávolítja a(z) \"{0}\" epizódot?",
+  "MessageConfirmRemoveEpisodeNote": "Megjegyzés: Ez nem törli a hangfájlt, kivéve, ha a \"Hangfájl végleges törlése\" be van kapcsolva",
   "MessageConfirmRemoveEpisodes": "Biztosan eltávolítja a(z) {0} epizódot?",
   "MessageConfirmRemoveListeningSessions": "Biztosan eltávolítja a(z) {0} hallgatási munkamenetet?",
   "MessageConfirmRemoveMetadataFiles": "Biztos, hogy az összes metaadatot el akarja távolítani {0} fájl van könyvtár mappáiban?",
@@ -768,6 +785,7 @@
   "MessageForceReScanDescription": "minden fájlt újra szkennel, mint egy friss szkennelés. Az audiofájlok ID3 címkéi, OPF fájlok és szövegfájlok újként lesznek szkennelve.",
   "MessageImportantNotice": "Fontos közlemény!",
   "MessageInsertChapterBelow": "Fejezet beszúrása alulra",
+  "MessageInvalidAsin": "Érvénytelen ASIN",
   "MessageItemsSelected": "{0} kiválasztott elem",
   "MessageItemsUpdated": "{0} frissített elem",
   "MessageJoinUsOn": "Csatlakozzon hozzánk a",
@@ -813,6 +831,7 @@
   "MessageNoTasksRunning": "Nincsenek futó feladatok",
   "MessageNoUpdatesWereNecessary": "Nem volt szükség frissítésekre",
   "MessageNoUserPlaylists": "Nincsenek felhasználói lejátszási listák",
+  "MessageNoUserPlaylistsHelp": "A lejátszási listák személyesek. Csak az a felhasználó láthatja őket, aki létrehozta őket.",
   "MessageNotYetImplemented": "Még nem implementált",
   "MessageOpmlPreviewNote": "Megjegyzés: Ez egy előnézeti kép az elemzett OPML fájlról. A podcast tényleges címe az RSS hírcsatornából származik.",
   "MessageOr": "vagy",
@@ -835,8 +854,10 @@
   "MessageRestoreBackupConfirm": "Biztosan vissza szeretné állítani a biztonsági másolatot, amely ekkor készült:",
   "MessageRestoreBackupWarning": "A biztonsági mentés visszaállítása felülírja az egész adatbázist, amely a /config mappában található, valamint a borítóképeket a /metadata/items és /metadata/authors mappákban.<br /><br />A biztonsági mentések nem módosítják a könyvtár mappáiban található fájlokat. Ha engedélyezte a szerverbeállításokat a borítóképek és a metaadatok könyvtármappákban való tárolására, akkor ezek nem kerülnek biztonsági mentésre vagy felülírásra.<br /><br />A szerver használó összes kliens automatikusan frissül.",
   "MessageScheduleLibraryScanNote": "A legtöbb felhasználó számára ajánlott ezt a funkciót kikapcsolva hagyni, és engedélyezni a mappafigyelő beállítást. A mappafigyelő automatikusan észleli a könyvtári mappák változásait. A mappafigyelő nem működik minden fájlrendszernél (mint például az NFS), ezért helyette ütemezett könyvtárellenőrzéseket lehet használni.",
+  "MessageScheduleRunEveryWeekdayAtTime": "Futás minden {1} óra {0}-kor",
   "MessageSearchResultsFor": "Keresési eredmények",
   "MessageSelected": "{0} kiválasztva",
+  "MessageSeriesSequenceCannotContainSpaces": "Sorozat sorrend nem tartalmazhat szóközt",
   "MessageServerCouldNotBeReached": "A szervert nem lehet elérni",
   "MessageSetChaptersFromTracksDescription": "Fejezetek beállítása minden egyes hangfájlt egy fejezetként használva, és a fejezet címét a hangfájl neveként",
   "MessageShareExpirationWillBe": "A lejárat: <strong>{0}</strong>",
@@ -861,6 +882,7 @@
   "MessageTaskNoFilesToScan": "Nincs beolvasandó fájl",
   "MessageTaskOpmlImport": "OPML import",
   "MessageTaskOpmlImportDescription": "Podcastok létrehozása {0} RSS hírcsatornából",
+  "MessageTaskOpmlImportFeed": "OPML import hírcsatorna",
   "MessageTaskOpmlImportFeedDescription": "RSS feed „{0}” importálása",
   "MessageTaskOpmlImportFeedFailed": "Nem sikerült letölteni a podcast feedet",
   "MessageTaskOpmlImportFeedPodcastDescription": "„{0}” podcast létrehozása",
@@ -869,6 +891,7 @@
   "MessageTaskOpmlImportFinished": "{0} podcast hozzáadva",
   "MessageTaskOpmlParseFailed": "Az OPML fájl elemzése nem sikerült",
   "MessageTaskOpmlParseFastFail": "Érvénytelen OPML fájl: <opml> tag nem található VAGY nem találtak <outline> taget",
+  "MessageTaskOpmlParseNoneFound": "Nem található feed az OPML fájlban",
   "MessageTaskScanItemsAdded": "{0} hozzáadva",
   "MessageTaskScanItemsMissing": "{0} hiányzik",
   "MessageTaskScanItemsUpdated": "{0} frissítve",
@@ -896,6 +919,8 @@
   "NotificationOnBackupCompletedDescription": "A biztonsági mentés befejezésekor aktiválódik",
   "NotificationOnBackupFailedDescription": "A biztonsági mentés sikertelensége esetén aktiválódik",
   "NotificationOnEpisodeDownloadedDescription": "Egy podcast epizód automatikus letöltésekor aktiválódik",
+  "NotificationOnRSSFeedDisabledDescription": "Akkor lép működésbe, ha az automatikus epizódletöltés a túl sok sikertelen próbálkozás miatt letiltásra kerül",
+  "NotificationOnRSSFeedFailedDescription": "Akkor aktiválódik, ha az RSS feed kérés sikertelen az automatikus epizódletöltésnél",
   "NotificationOnTestDescription": "Esemény az értesítési rendszer teszteléséhez",
   "PlaceholderNewCollection": "Új gyűjtemény neve",
   "PlaceholderNewFolderPath": "Új mappa útvonala",
@@ -940,8 +965,11 @@
   "ToastBackupRestoreFailed": "A biztonsági mentés visszaállítása sikertelen",
   "ToastBackupUploadFailed": "A biztonsági mentés feltöltése sikertelen",
   "ToastBackupUploadSuccess": "Biztonsági mentés feltöltve",
+  "ToastBatchApplyDetailsToItemsSuccess": "Tételekre alkalmazott részletek",
   "ToastBatchDeleteFailed": "A tömeges törlés nem sikerült",
   "ToastBatchDeleteSuccess": "Sikeres tömeges törlés",
+  "ToastBatchQuickMatchFailed": "Tömeges Gyors Egyeztetés sikertelen!",
+  "ToastBatchQuickMatchStarted": "{0} könyv Tömeges Gyors Egyeztetése elkezdődött!",
   "ToastBatchUpdateFailed": "Kötegelt frissítés sikertelen",
   "ToastBatchUpdateSuccess": "Kötegelt frissítés sikeres",
   "ToastBookmarkCreateFailed": "Könyvjelző létrehozása sikertelen",
@@ -950,9 +978,12 @@
   "ToastCachePurgeFailed": "A gyorsítótár törlése sikertelen",
   "ToastCachePurgeSuccess": "A gyorsítótár sikeresen törölve",
   "ToastChaptersHaveErrors": "A fejezetek hibákat tartalmaznak",
+  "ToastChaptersInvalidShiftAmountLast": "Érvénytelen eltolási érték. Az utolsó fejezet kezdési időpontja túlnyúlna a hangoskönyv időtartamán.",
+  "ToastChaptersInvalidShiftAmountStart": "Érvénytelen eltolási érték. Az első fejezet hossza nulla vagy negatív lenne, és a második fejezet felülírná. Növelje a második fejezet kezdő időtartamát.",
   "ToastChaptersMustHaveTitles": "A fejezeteknek címekkel kell rendelkezniük",
   "ToastChaptersRemoved": "Fejezetek eltávolítva",
   "ToastChaptersUpdated": "Fejezetek frissítve",
+  "ToastCollectionItemsAddFailed": "A tétel(ek) hozzáadása gyűjteményhez sikertelen",
   "ToastCollectionRemoveSuccess": "Gyűjtemény eltávolítva",
   "ToastCollectionUpdateSuccess": "Gyűjtemény frissítve",
   "ToastCoverUpdateFailed": "A borító frissítése nem sikerült",
@@ -967,6 +998,7 @@
   "ToastEncodeCancelFailed": "A kódolás törlése sikertelen volt",
   "ToastEncodeCancelSucces": "Kódolás törölve",
   "ToastEpisodeDownloadQueueClearFailed": "Nem sikerült törölni a várólistát",
+  "ToastEpisodeDownloadQueueClearSuccess": "Epizód letöltési várólista törölve",
   "ToastEpisodeUpdateSuccess": "{0} epizód frissítve",
   "ToastErrorCannotShare": "Ezen az eszközön nem lehet natívan megosztani",
   "ToastFailedToLoadData": "Sikertelen adatbetöltés",
@@ -974,6 +1006,7 @@
   "ToastFailedToShare": "Nem sikerült megosztani",
   "ToastFailedToUpdate": "Nem sikerült frissíteni",
   "ToastInvalidImageUrl": "Érvénytelen a kép URL címe",
+  "ToastInvalidMaxEpisodesToDownload": "A letölthető epizódok száma érvénytelen",
   "ToastInvalidUrl": "Érvénytelen URL",
   "ToastItemCoverUpdateSuccess": "Elem borítója frissítve",
   "ToastItemDeletedFailed": "Nem sikerült törölni az elemet",
@@ -1011,8 +1044,11 @@
   "ToastNoUpdatesNecessary": "Nincs szükség frissítésre",
   "ToastNotificationCreateFailed": "Értesítés létrehozása sikertelen",
   "ToastNotificationDeleteFailed": "Értesítés törlése sikertelen",
+  "ToastNotificationFailedMaximum": "A sikertelen kísérletek maximális száma >= 0 kell, hogy legyen",
+  "ToastNotificationQueueMaximum": "Az értesítési sor maximális száma >= 0 kell, hogy legyen",
   "ToastNotificationSettingsUpdateSuccess": "Értesítési beállítások frissítve",
   "ToastNotificationTestTriggerFailed": "Nem sikerült a tesztértesítést elindítani",
+  "ToastNotificationTestTriggerSuccess": "Kiváltott tesztértesítés",
   "ToastNotificationUpdateSuccess": "Értesítés frissítve",
   "ToastPlaylistCreateFailed": "Lejátszási lista létrehozása sikertelen",
   "ToastPlaylistCreateSuccess": "Lejátszási lista létrehozva",
@@ -1020,6 +1056,7 @@
   "ToastPlaylistUpdateSuccess": "Lejátszási lista frissítve",
   "ToastPodcastCreateFailed": "Podcast létrehozása sikertelen",
   "ToastPodcastCreateSuccess": "A podcast sikeresen létrehozva",
+  "ToastPodcastGetFeedFailed": "Nem sikerült podcast feedet kapni",
   "ToastPodcastNoEpisodesInFeed": "Nincsenek epizódok az RSS hírcsatornában",
   "ToastPodcastNoRssFeed": "A podcastnak nincs RSS-hírcsatornája",
   "ToastProgressIsNotBeingSynced": "Az előrehaladás nem szinkronizálódik, a lejátszás újraindul",
@@ -1032,10 +1069,18 @@
   "ToastRemoveFailed": "Sikertelen eltávolítás",
   "ToastRemoveItemFromCollectionFailed": "Tétel eltávolítása a gyűjteményből sikertelen",
   "ToastRemoveItemFromCollectionSuccess": "Tétel eltávolítva a gyűjteményből",
+  "ToastRemoveItemsWithIssuesFailed": "Nem sikerült eltávolítani a hibás könyvtárelemeket",
+  "ToastRemoveItemsWithIssuesSuccess": "Hibás könyvtárelemek eltávolítva",
   "ToastRenameFailed": "Sikertelen átnevezés",
+  "ToastRescanFailed": "Sikertelen újrakeresés a következőnél: {0}",
+  "ToastRescanRemoved": "A teljes újrabeolvasás befejezve, elem eltávolítva",
+  "ToastRescanUpToDate": "A teljes újrabeolvasás befejezve, elem naprakész volt",
+  "ToastRescanUpdated": "A teljes újrabeolvasás befejezve, elem frissítve",
+  "ToastScanFailed": "Nem sikerült beolvasni a könyvtárelemet",
   "ToastSelectAtLeastOneUser": "Válasszon legalább egy felhasználót",
   "ToastSendEbookToDeviceFailed": "E-könyv küldése az eszközre sikertelen",
   "ToastSendEbookToDeviceSuccess": "E-könyv elküldve az eszközre \"{0}\"",
+  "ToastSeriesSubmitFailedSameName": "Nem lehet két azonos nevű sorozatot hozzáadni",
   "ToastSeriesUpdateFailed": "Sorozat frissítése sikertelen",
   "ToastSeriesUpdateSuccess": "Sorozat frissítése sikeres",
   "ToastServerSettingsUpdateSuccess": "Szerver beállítások frissítve",
@@ -1043,6 +1088,8 @@
   "ToastSessionDeleteFailed": "Munkamenet törlése sikertelen",
   "ToastSessionDeleteSuccess": "Munkamenet törölve",
   "ToastSleepTimerDone": "Alvásidőzítő kész... zZzzZZz",
+  "ToastSlugMustChange": "A Slug érvénytelen karaktereket tartalmaz",
+  "ToastSlugRequired": "Slug szükséges",
   "ToastSocketConnected": "Socket csatlakoztatva",
   "ToastSocketDisconnected": "Socket lecsatlakoztatva",
   "ToastSocketFailedToConnect": "A Socket csatlakoztatása sikertelen",
@@ -1050,9 +1097,14 @@
   "ToastSortingPrefixesUpdateSuccess": "Rendezési előtagok frissítése ({0} elem)",
   "ToastTitleRequired": "A cím kötelező",
   "ToastUnknownError": "Ismeretlen hiba",
+  "ToastUnlinkOpenIdFailed": "Nem sikerült leválasztani a felhasználót az OpenID-ről",
+  "ToastUnlinkOpenIdSuccess": "Felhasználó leválasztva az OpenID-ről",
+  "ToastUploaderFilepathExistsError": "A \"{0}\" fájl elérési útja már létezik a szerveren",
+  "ToastUploaderItemExistsInSubdirectoryError": "A „{0}” elem a feltöltési útvonal egy alkönyvtárát használja.",
   "ToastUserDeleteFailed": "Felhasználó törlése sikertelen",
   "ToastUserDeleteSuccess": "Felhasználó törölve",
   "ToastUserPasswordChangeSuccess": "Jelszó sikeresen megváltoztatva",
+  "ToastUserPasswordMismatch": "A jelszavak nem egyeznek",
   "ToastUserPasswordMustChange": "Az új jelszó nem egyezik a régi jelszóval",
   "ToastUserRootRequireName": "Egy root felhasználónevet kell megadnia"
 }
diff --git a/client/strings/it.json b/client/strings/it.json
index 41c06175..7f4fd7c7 100644
--- a/client/strings/it.json
+++ b/client/strings/it.json
@@ -1,18 +1,19 @@
 {
   "ButtonAdd": "Aggiungi",
+  "ButtonAddApiKey": "Aggiungi chiave API",
   "ButtonAddChapters": "Aggiungi Capitoli",
   "ButtonAddDevice": "Aggiungi Dispositivo",
   "ButtonAddLibrary": "Aggiungi Libreria",
   "ButtonAddPodcasts": "Aggiungi Podcast",
-  "ButtonAddUser": "Aggiungi User",
+  "ButtonAddUser": "Aggiungi Utente",
   "ButtonAddYourFirstLibrary": "Aggiungi la tua prima libreria",
   "ButtonApply": "Applica",
-  "ButtonApplyChapters": "Applica",
+  "ButtonApplyChapters": "Applica Capitoli",
   "ButtonAuthors": "Autori",
   "ButtonBack": "Indietro",
   "ButtonBatchEditPopulateFromExisting": "Popola da esistente",
   "ButtonBatchEditPopulateMapDetails": "Inserisci i dettagli della mappa",
-  "ButtonBrowseForFolder": "Per Cartella",
+  "ButtonBrowseForFolder": "Sfoglia per Cartella",
   "ButtonCancel": "Annulla",
   "ButtonCancelEncode": "Ferma la codifica",
   "ButtonChangeRootPassword": "Cambia la Password di root",
@@ -20,6 +21,7 @@
   "ButtonChooseAFolder": "Seleziona la Cartella",
   "ButtonChooseFiles": "Seleziona i File",
   "ButtonClearFilter": "Elimina filtri",
+  "ButtonClose": "Chiudi",
   "ButtonCloseFeed": "Chiudi flusso",
   "ButtonCloseSession": "Chiudi la sessione aperta",
   "ButtonCollections": "Raccolte",
@@ -514,7 +516,7 @@
   "LabelPublishers": "Editori",
   "LabelRSSFeedCustomOwnerEmail": "E-mail del proprietario personalizzato",
   "LabelRSSFeedCustomOwnerName": "Nome del proprietario personalizzato",
-  "LabelRSSFeedOpen": "Flusso RSS aperto",
+  "LabelRSSFeedOpen": "Feed RSS aperto",
   "LabelRSSFeedPreventIndexing": "Impedisci l'indicizzazione",
   "LabelRSSFeedSlug": "Parole chiave del flusso RSS",
   "LabelRSSFeedURL": "URL del flusso RSS",
@@ -918,6 +920,8 @@
   "NotificationOnBackupCompletedDescription": "Attivato al completamento di un backup",
   "NotificationOnBackupFailedDescription": "Attivato quando un backup fallisce",
   "NotificationOnEpisodeDownloadedDescription": "Attivato quando un episodio di podcast viene scaricato automaticamente",
+  "NotificationOnRSSFeedDisabledDescription": "Attivato quando i download automatici degli episodi vengono disabilitati a causa di troppi tentativi falliti",
+  "NotificationOnRSSFeedFailedDescription": "Attivato quando la richiesta del feed RSS per il download automatico di un episodio fallisce",
   "NotificationOnTestDescription": "test il sistema di notifica",
   "PlaceholderNewCollection": "Nome Nuova Raccolta",
   "PlaceholderNewFolderPath": "Nuovo Percorso Cartella",
diff --git a/client/strings/nl.json b/client/strings/nl.json
index 955ba86b..c5c14827 100644
--- a/client/strings/nl.json
+++ b/client/strings/nl.json
@@ -24,7 +24,7 @@
   "ButtonCloseSession": "Sluit Sessie",
   "ButtonCollections": "Collecties",
   "ButtonConfigureScanner": "Configureer scanner",
-  "ButtonCreate": "Creëer",
+  "ButtonCreate": "Aanmaken",
   "ButtonCreateBackup": "Maak back-up",
   "ButtonDelete": "Verwijder",
   "ButtonDownloadQueue": "Wachtrij",
@@ -43,9 +43,9 @@
   "ButtonJumpForward": "Spring vooruit",
   "ButtonLatest": "Meest recent",
   "ButtonLibrary": "Bibliotheek",
-  "ButtonLogout": "Log uit",
+  "ButtonLogout": "Uitloggen",
   "ButtonLookup": "Zoeken",
-  "ButtonManageTracks": "Beheer tracks",
+  "ButtonManageTracks": "Tracks beheren",
   "ButtonMapChapterTitles": "Hoofdstuktitels mappen",
   "ButtonMatchAllAuthors": "Alle auteurs matchen",
   "ButtonMatchBooks": "Alle boeken matchen",
@@ -72,7 +72,7 @@
   "ButtonQuickEmbedMetadata": "Snel Metadata Insluiten",
   "ButtonQuickMatch": "Snelle match",
   "ButtonReScan": "Nieuwe scan",
-  "ButtonRead": "Lees",
+  "ButtonRead": "Lezen",
   "ButtonReadLess": "Lees minder",
   "ButtonReadMore": "Lees meer",
   "ButtonRefresh": "Verversen",
@@ -107,7 +107,7 @@
   "ButtonUnlinkOpenId": "OpenID Ontkoppelen",
   "ButtonUpload": "Upload",
   "ButtonUploadBackup": "Upload back-up",
-  "ButtonUploadCover": "Upload cover",
+  "ButtonUploadCover": "Omslag uploaden",
   "ButtonUploadOPMLFile": "Upload OPML-bestand",
   "ButtonUserDelete": "Verwijder gebruiker {0}",
   "ButtonUserEdit": "Wijzig gebruiker {0}",
@@ -177,7 +177,8 @@
   "HeaderPlaylist": "Afspeellijst",
   "HeaderPlaylistItems": "Onderdelen in afspeellijst",
   "HeaderPodcastsToAdd": "Toe te voegen podcasts",
-  "HeaderPreviewCover": "Preview cover",
+  "HeaderPresets": "Voorinstellingen",
+  "HeaderPreviewCover": "Voorbeeld omslag",
   "HeaderRSSFeedGeneral": "RSS-details",
   "HeaderRSSFeedIsOpen": "RSS-feed is open",
   "HeaderRSSFeeds": "RSS-feeds",
@@ -284,7 +285,7 @@
   "LabelContinueReading": "Verder lezen",
   "LabelContinueSeries": "Doorgaan met Serie",
   "LabelCover": "Omslag",
-  "LabelCoverImageURL": "Coverafbeelding URL",
+  "LabelCoverImageURL": "Omslagafbeelding-URL",
   "LabelCoverProvider": "Omslag bron",
   "LabelCreatedAt": "Gecreëerd op",
   "LabelCronExpression": "Cron-uitdrukking",
@@ -321,7 +322,7 @@
   "LabelEmailSettingsSecure": "Veilig",
   "LabelEmailSettingsSecureHelp": "Als 'waar', dan gebruikt de verbinding TLS om met de server te verbinden. Als 'onwaar', dan wordt TLS gebruikt als de server de STARTTLS-extensie ondersteunt. In de meeste gevallen kies je voor 'waar' verbindt met poort 465. Voo poort 587 of 25, laat op 'onwaar'. (van nodemailer.com/smtp/#authentication)",
   "LabelEmailSettingsTestAddress": "Test-adres",
-  "LabelEmbeddedCover": "Ingesloten cover",
+  "LabelEmbeddedCover": "Omslag in bestand",
   "LabelEnable": "Inschakelen",
   "LabelEncodingBackupLocation": "Er wordt een back-up van uw originele audiobestanden opgeslagen in:",
   "LabelEncodingChaptersNotEmbedded": "Hoofdstukken zijn niet ingesloten in audioboeken met meerdere sporen.",
@@ -330,7 +331,7 @@
   "LabelEncodingInfoEmbedded": "Metagegevens worden ingesloten in de audiotracks in uw audioboekmap.",
   "LabelEncodingStartedNavigation": "Eenmaal de taak is gestart kan u weg navigeren van deze pagina.",
   "LabelEncodingTimeWarning": "Encoding kan tot 30 minuten duren.",
-  "LabelEncodingWarningAdvancedSettings": "Waarschuwing: update deze instellingen niet tenzij u bekend bent met de coderingsopties van ffmpeg.",
+  "LabelEncodingWarningAdvancedSettings": "Waarschuwing: pas deze instellingen niet aan tenzij u bekend bent met de coderingsopties van ffmpeg.",
   "LabelEncodingWatcherDisabled": "Als u de watcher hebt uitgeschakeld, moet u het audioboek daarna opnieuw scannen.",
   "LabelEnd": "Einde",
   "LabelEndOfChapter": "Einde van het Hoofdstuk",
@@ -372,7 +373,7 @@
   "LabelFull": "Vol",
   "LabelGenre": "Genre",
   "LabelGenres": "Genres",
-  "LabelHardDeleteFile": "Hard-delete bestand",
+  "LabelHardDeleteFile": "Bestand permanent verwijderen",
   "LabelHasEbook": "Heeft Ebook",
   "LabelHasSupplementaryEbook": "Heeft aanvullend Ebook",
   "LabelHideSubtitles": "Ondertitels Verstoppen",
@@ -394,6 +395,7 @@
   "LabelIntervalEvery6Hours": "Iedere 6 uur",
   "LabelIntervalEveryDay": "Iedere dag",
   "LabelIntervalEveryHour": "Ieder uur",
+  "LabelIntervalEveryMinute": "Elke minuut",
   "LabelInvert": "Omdraaien",
   "LabelItem": "Onderdeel",
   "LabelJumpBackwardAmount": "Terugspoelen hoeveelheid",
@@ -405,7 +407,7 @@
   "LabelLastBookUpdated": "Laatst bijgewerkte boek",
   "LabelLastSeen": "Laatst gezien",
   "LabelLastTime": "Laatste keer",
-  "LabelLastUpdate": "Laatste update",
+  "LabelLastUpdate": "Laatste wijziging",
   "LabelLayout": "Layout",
   "LabelLayoutSinglePage": "Enkele pagina",
   "LabelLayoutSplitPage": "Gesplitste pagina",
@@ -424,7 +426,7 @@
   "LabelLookForNewEpisodesAfterDate": "Zoek naar nieuwe afleveringen na deze datum",
   "LabelLowestPriority": "Laagste Prioriteit",
   "LabelMatchExistingUsersBy": "Bestaande gebruikers matchen op",
-  "LabelMatchExistingUsersByDescription": "Wordt gebruikt om bestaande gebruikers te verbinden. Zodra ze verbonden zijn, worden gebruikers gekoppeld aan een unieke id van uw SSO-provider.",
+  "LabelMatchExistingUsersByDescription": "Wordt gebruikt om bestaande gebruikers te verbinden. Zodra ze verbonden zijn, worden gebruikers gekoppeld aan een unieke id van uw SSO-provider",
   "LabelMaxEpisodesToDownload": "Maximale # afleveringen om te downloaden. Gebruik 0 voor ongelimiteerd.",
   "LabelMaxEpisodesToDownloadPerCheck": "Maximale # nieuwe afleveringen om te downloaden per check",
   "LabelMaxEpisodesToKeep": "Maximale # afleveringen om te houden",
@@ -512,7 +514,7 @@
   "LabelPublishers": "Uitgevers",
   "LabelRSSFeedCustomOwnerEmail": "Aangepast e-mailadres eigenaar",
   "LabelRSSFeedCustomOwnerName": "Aangepaste naam eigenaar",
-  "LabelRSSFeedOpen": "RSS-feed open",
+  "LabelRSSFeedOpen": "RSS Feed Open",
   "LabelRSSFeedPreventIndexing": "Voorkom indexering",
   "LabelRSSFeedSlug": "RSS-feed slug",
   "LabelRSSFeedURL": "RSS-feed URL",
@@ -529,7 +531,8 @@
   "LabelReleaseDate": "Verschijningsdatum",
   "LabelRemoveAllMetadataAbs": "Verwijder alle metadata.abs bestanden",
   "LabelRemoveAllMetadataJson": "Verwijder alle metadata.json bestanden",
-  "LabelRemoveCover": "Verwijder cover",
+  "LabelRemoveAudibleBranding": "Verwijder Audible intro en outro uit hoofdstukken",
+  "LabelRemoveCover": "Omslag verwijderen",
   "LabelRemoveMetadataFile": "Verwijder metadata bestanden in bibliotheek item folders",
   "LabelRemoveMetadataFileHelp": "Verwijder alle metadata.json en metadata.abs bestanden in uw {0} folders.",
   "LabelRowsPerPage": "Rijen per pagina",
@@ -557,14 +560,16 @@
   "LabelSettingsAudiobooksOnlyHelp": "Deze instelling inschakelen zorgt ervoor dat ebook-bestanden genegeerd worden tenzij ze in een audiobook-map staan, in welk geval ze worden ingesteld als supplementaire ebooks",
   "LabelSettingsBookshelfViewHelp": "Skeumorphisch design met houten planken",
   "LabelSettingsChromecastSupport": "Chromecast ondersteuning",
-  "LabelSettingsDateFormat": "Datum format",
+  "LabelSettingsDateFormat": "Datumnotatie",
+  "LabelSettingsEnableWatcher": "Bibliotheken automatisch scannen op wijzigingen",
+  "LabelSettingsEnableWatcherForLibrary": "Bibliotheek automatisch scannen op wijzigingen",
   "LabelSettingsEnableWatcherHelp": "Zorgt voor het automatisch toevoegen/bijwerken van onderdelen als bestandswijzigingen worden gedetecteerd. *Vereist herstarten van server",
   "LabelSettingsEpubsAllowScriptedContent": "Sta scripted content toe in epubs",
   "LabelSettingsEpubsAllowScriptedContentHelp": "Sta toe dat epub-bestanden scripts uitvoeren. Het wordt aanbevolen om deze instelling uitgeschakeld te houden, tenzij u de bron van de epub-bestanden vertrouwt.",
   "LabelSettingsExperimentalFeatures": "Experimentele functies",
   "LabelSettingsExperimentalFeaturesHelp": "Functies in ontwikkeling die je feedback en testing kunnen gebruiken. Klik om de Github-discussie te openen.",
-  "LabelSettingsFindCovers": "Zoek covers",
-  "LabelSettingsFindCoversHelp": "Als je audioboek geen ingesloten cover of cover in de map heeft, zal de scanner proberen een cover te vinden.<br>Opmerking: Dit zal de scan-duur verlengen",
+  "LabelSettingsFindCovers": "Omslagen zoeken",
+  "LabelSettingsFindCoversHelp": "Als je audioboek geen omslag in het bestand of in de map heeft, zal de scanner automatisch proberen een omslag te vinden.<br>Opmerking: Dit kan de scantijd verlengen",
   "LabelSettingsHideSingleBookSeries": "Verberg series met een enkel boek",
   "LabelSettingsHideSingleBookSeriesHelp": "Series die slechts een enkel boek bevatten worden verborgen op de seriespagina en de homepagina-planken.",
   "LabelSettingsHomePageBookshelfView": "Boekenplank-view voor homepagina",
@@ -574,18 +579,18 @@
   "LabelSettingsLibraryMarkAsFinishedWhen": "Markeer media item wanneer voltooid",
   "LabelSettingsOnlyShowLaterBooksInContinueSeries": "Sla eedere boeken in Serie Verderzetten over",
   "LabelSettingsOnlyShowLaterBooksInContinueSeriesHelp": "De Continue Series home page shelf toont het eerste boek dat nog niet is begonnen in series waarvan er minstens één is voltooid en er geen boeken in uitvoering zijn. Als u deze instelling inschakelt, wordt de serie voortgezet vanaf het boek dat het verst is voltooid in plaats van het eerste boek dat nog niet is begonnen.",
-  "LabelSettingsParseSubtitles": "Parseer subtitel",
+  "LabelSettingsParseSubtitles": "Subtitel afleiden uit foldernaam",
   "LabelSettingsParseSubtitlesHelp": "Haal subtitels uit mapnaam van audioboek.<br>Subtitel moet gescheiden zijn met \" - \"<br>b.v. \"Boektitel - Een Subtitel Hier\" heeft als subtitel \"Een Subtitel Hier\"",
-  "LabelSettingsPreferMatchedMetadata": "Prefereer gematchte metadata",
+  "LabelSettingsPreferMatchedMetadata": "Geef voorkeur aan gematchte metadata",
   "LabelSettingsPreferMatchedMetadataHelp": "Gematchte data zal onderdeeldetails overschrijven bij gebruik van Quick Match. Standaard vult Quick Match uitsluitend ontbrekende details aan.",
   "LabelSettingsSkipMatchingBooksWithASIN": "Sla matchen van boeken over die al over een ASIN beschikken",
   "LabelSettingsSkipMatchingBooksWithISBN": "Sla matchen van boeken over die al over een ISBN beschikken",
   "LabelSettingsSortingIgnorePrefixes": "Negeer voorvoegsels bij sorteren",
   "LabelSettingsSortingIgnorePrefixesHelp": "b.v. voor voorvoegsel \"The\" wordt titel \"The Title\" dan gesorteerd als \"Title, The\"",
-  "LabelSettingsSquareBookCovers": "Gebruik vierkante boekcovers",
-  "LabelSettingsSquareBookCoversHelp": "Prefereer gebruik van vierkante covers boven standaard 1.6:1 boekcovers",
-  "LabelSettingsStoreCoversWithItem": "Bewaar covers bij onderdeel",
-  "LabelSettingsStoreCoversWithItemHelp": "Standaard worden covers bewaard in /metadata/items, door deze instelling in te schakelen zullen covers in de map van je bibliotheekonderdeel bewaard worden. Slechts een bestand genaamd \"cover\" zal worden bewaard",
+  "LabelSettingsSquareBookCovers": "Gebruik vierkante boekomslagen",
+  "LabelSettingsSquareBookCoversHelp": "Gebruik vierkante boekomslagen in plaats van standaard 1,6:1",
+  "LabelSettingsStoreCoversWithItem": "Bewaar omslagen bij onderdeel",
+  "LabelSettingsStoreCoversWithItemHelp": "Omslagen worden standaard in /metadata/items opgeslagen. Bij inschakelen worden ze in de map van het bibliotheekitem zelf opgeslagen. Slechts een bestand genaamd \"cover\" zal worden bewaard",
   "LabelSettingsStoreMetadataWithItem": "Bewaar metadata bij onderdeel",
   "LabelSettingsStoreMetadataWithItemHelp": "Standaard worden metadata-bestanden bewaard in /metadata/items, door deze instelling in te schakelen zullen metadata bestanden in de map van je bibliotheekonderdeel bewaard worden",
   "LabelSettingsTimeFormat": "Tijdformat",
@@ -601,6 +606,7 @@
   "LabelSlug": "Slak",
   "LabelSortAscending": "Oplopend",
   "LabelSortDescending": "Aflopend",
+  "LabelSortPubDate": "Sorteer Pub Datum",
   "LabelStart": "Start",
   "LabelStartTime": "Starttijd",
   "LabelStarted": "Gestart",
@@ -646,12 +652,12 @@
   "LabelTimeToShift": "Tijd op te schuiven in seconden",
   "LabelTitle": "Titel",
   "LabelToolsEmbedMetadata": "Metadata insluiten",
-  "LabelToolsEmbedMetadataDescription": "Metadata insluiten in audiobestanden, inclusief coverafbeelding en hoofdstukken.",
+  "LabelToolsEmbedMetadataDescription": "Metadata insluiten in audiobestanden, inclusief omslagafbeelding en hoofdstukken.",
   "LabelToolsM4bEncoder": "M4B Encoder",
   "LabelToolsMakeM4b": "Maak M4B-audioboekbestand",
-  "LabelToolsMakeM4bDescription": "Genereer een .M4B-audioboekbestand met ingesloten metadata, coverafbeelding en hoofdstukken.",
+  "LabelToolsMakeM4bDescription": "Genereer een .M4B-audioboekbestand met ingesloten metadata, omslagafbeelding en hoofdstukken.",
   "LabelToolsSplitM4b": "Splitst M4B in MP3's",
-  "LabelToolsSplitM4bDescription": "Maak MP3's van een M4B, gesplitst per hoofdstuk met ingesloten metadata, coverafbeelding en hoofdstukken.",
+  "LabelToolsSplitM4bDescription": "Maak MP3's van een M4B, gesplitst per hoofdstuk met ingesloten metadata, omslagafbeelding en hoofdstukken.",
   "LabelTotalDuration": "Totale duur",
   "LabelTotalTimeListened": "Totale tijd geluisterd",
   "LabelTrackFromFilename": "Track vanuit bestandsnaam",
@@ -666,8 +672,8 @@
   "LabelUndo": "Ongedaan maken",
   "LabelUnknown": "Onbekend",
   "LabelUnknownPublishDate": "Onbekende uitgeefdatum",
-  "LabelUpdateCover": "Cover bijwerken",
-  "LabelUpdateCoverHelp": "Sta overschrijven van bestaande covers toe voor de geselecteerde boeken wanneer een match is gevonden",
+  "LabelUpdateCover": "Omslag bijwerken",
+  "LabelUpdateCoverHelp": "Sta overschrijven van bestaande omslagen toe voor de geselecteerde boeken wanneer een match is gevonden",
   "LabelUpdateDetails": "Details bijwerken",
   "LabelUpdateDetailsHelp": "Sta overschrijven van bestaande details toe voor de geselecteerde boeken wanneer een match is gevonden",
   "LabelUpdatedAt": "Bijgewerkt op",
@@ -701,13 +707,15 @@
   "LabelYourProgress": "Je voortgang",
   "MessageAddToPlayerQueue": "Toevoegen aan wachtrij",
   "MessageAppriseDescription": "Om deze functie te gebruiken heb je een draaiende instantie van <a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">Apprise API</a> nodig of een api die dezelfde requests afhandelt. <br />De Apprise API Url moet het volledige URL-pad zijn om de notificatie te verzenden, b.v., als je API-instantie draait op <code>http://192.168.1.1:8337</code> dan zou je <code>http://192.168.1.1:8337/notify</code> gebruiken.",
+  "MessageAsinCheck": "Zorg ervoor dat u de ASIN van de juiste Audible-regio gebruikt, niet die van Amazon.",
+  "MessageAuthenticationOIDCChangesRestart": "Start uw server opnieuw op nadat u het opslaan hebt uitgevoerd, om de OIDC-wijzigingen toe te passen.",
   "MessageBackupsDescription": "Back-ups omvatten gebruikers, gebruikers' voortgang, bibliotheekonderdeeldetails, serverinstellingen en afbeeldingen bewaard in <code>/metadata/items</code> & <code>/metadata/authors</code>. Back-ups <strong>bevatten niet</strong> de bestanden bewaard in je bibliotheekmappen.",
   "MessageBackupsLocationEditNote": "Let op: het bijwerken van de back-uplocatie zal bestaande back-ups niet verplaatsen of wijzigen",
   "MessageBackupsLocationNoEditNote": "Let op: De back-uplocatie wordt ingesteld via een omgevingsvariabele en kan hier niet worden gewijzigd.",
   "MessageBackupsLocationPathEmpty": "Backup locatie pad kan niet leeg zijn",
   "MessageBatchEditPopulateMapDetailsAllHelp": "Vul actieve velden in met data van alle items. Velden met meerdere waarden zullen worden samengevoegd",
   "MessageBatchEditPopulateMapDetailsItemHelp": "Vul actieve folder detail velden met de data van dit item",
-  "MessageBatchQuickMatchDescription": "Quick Match zal proberen ontbrekende covers en metadata voor de geselecteerde onderdelen te matchten. Schakel de opties hieronder in om Quick Match toe te staan bestaande covers en/of metadata te overschrijven.",
+  "MessageBatchQuickMatchDescription": "Quick Match probeert ontbrekende omslagen en metadata toe te voegen aan de geselecteerde items. Schakel de opties hieronder in om Quick Match bestaande omslagen en/of metadata te laten overschrijven.",
   "MessageBookshelfNoCollections": "Je hebt nog geen collecties gemaakt",
   "MessageBookshelfNoCollectionsHelp": "Collecties zijn publiekelijk. Alle gebruikers met toegang tot de bibliotheek kunnen ze zien.",
   "MessageBookshelfNoRSSFeeds": "Geen RSS-feeds geopend",
@@ -719,6 +727,7 @@
   "MessageChapterErrorStartGteDuration": "Ongeldig: starttijd moet kleiner zijn dan duur van audioboek",
   "MessageChapterErrorStartLtPrev": "Ongeldig: starttijd moet be groter zijn dan of equal aan starttijd van vorig hoofdstuk",
   "MessageChapterStartIsAfter": "Start van hoofdstuk is na het einde van je audioboek",
+  "MessageChaptersNotFound": "Hoofdstukken niet gevonden",
   "MessageCheckingCron": "Cron aan het checken...",
   "MessageConfirmCloseFeed": "Ben je zeker dat je deze feed wil sluiten?",
   "MessageConfirmDeleteBackup": "Weet je zeker dat je de backup voor {0} wil verwijderen?",
@@ -748,6 +757,7 @@
   "MessageConfirmRemoveAuthor": "Weet je zeker dat je auteur \"{0}\" wil verwijderen?",
   "MessageConfirmRemoveCollection": "Weet je zeker dat je de collectie \"{0}\" wil verwijderen?",
   "MessageConfirmRemoveEpisode": "Weet je zeker dat je de aflevering \"{0}\" wil verwijderen?",
+  "MessageConfirmRemoveEpisodeNote": "Let op: Het audiobestand wordt niet verwijderd, tenzij je ‘Bestand permanent verwijderen’ inschakelt",
   "MessageConfirmRemoveEpisodes": "Weet je zeker dat je {0} afleveringen wil verwijderen?",
   "MessageConfirmRemoveListeningSessions": "Weet je zeker dat je {0} luistersessies wilt verwijderen?",
   "MessageConfirmRemoveMetadataFiles": "Bent u zeker dat u alle metadata wil verwijderen. {0} bestanden in uw bibliotheel item folders?",
@@ -775,8 +785,9 @@
   "MessageForceReScanDescription": "zal alle bestanden opnieuw scannen als een verse scan. Audiobestanden ID3-tags, OPF-bestanden en textbestanden zullen als nieuw worden gescand.",
   "MessageImportantNotice": "Belangrijke opmerking!",
   "MessageInsertChapterBelow": "Hoofdstuk hieronder invoegen",
-  "MessageItemsSelected": "{0} onderdelen geselecteerd",
-  "MessageItemsUpdated": "{0} onderdelen bijgewerkt",
+  "MessageInvalidAsin": "Ongeldige ASIN",
+  "MessageItemsSelected": "{0} items geselecteerd",
+  "MessageItemsUpdated": "{0} items bijgewerkt",
   "MessageJoinUsOn": "Doe mee op",
   "MessageLoading": "Aan het laden...",
   "MessageLoadingFolders": "Mappen aan het laden...",
@@ -788,14 +799,14 @@
   "MessageMarkAllEpisodesNotFinished": "Markeer alle afleveringen als niet voltooid",
   "MessageMarkAsFinished": "Markeer als Voltooid",
   "MessageMarkAsNotFinished": "Markeer als Niet Voltooid",
-  "MessageMatchBooksDescription": "zal proberen boeken in de bibliotheek te matchen met een boek uit de geselecteerde bron en lege details en coverafbeelding te vullen. Overschrijft details niet.",
+  "MessageMatchBooksDescription": "zal proberen boeken in de bibliotheek te koppelen aan een boek uit de geselecteerde bron en ontbrekende gegevens en een omslag toe te voegen. Overschrijft geen bestaande gegevens.",
   "MessageNoAudioTracks": "Geen audiotracks",
   "MessageNoAuthors": "Geen auteurs",
   "MessageNoBackups": "Geen back-ups",
   "MessageNoBookmarks": "Geen boekwijzers",
   "MessageNoChapters": "Geen hoofdstukken",
   "MessageNoCollections": "Geen collecties",
-  "MessageNoCoversFound": "Geen covers gevonden",
+  "MessageNoCoversFound": "Geen omslagen gevonden",
   "MessageNoDescription": "Geen beschrijving",
   "MessageNoDevices": "Geen Apparaten",
   "MessageNoDownloadsInProgress": "Geen downloads bezig op dit moment",
@@ -808,7 +819,7 @@
   "MessageNoItems": "Geen onderdelen",
   "MessageNoItemsFound": "Geen onderdelen gevonden",
   "MessageNoListeningSessions": "Geen luistersessies",
-  "MessageNoLogs": "Geen logs",
+  "MessageNoLogs": "Geen logbestanden",
   "MessageNoMediaProgress": "Geen mediavoortgang",
   "MessageNoNotifications": "Geen notificaties",
   "MessageNoPodcastFeed": "Ongeldige podcast: Geen Feed",
@@ -833,7 +844,7 @@
   "MessageQuickEmbedInProgress": "Snelle inbedding in uitvoering",
   "MessageQuickEmbedQueue": "In de wachtrij voor snelle insluiting ({0} in wachtrij)",
   "MessageQuickMatchAllEpisodes": "Alle Afleveringen Snel Matchen",
-  "MessageQuickMatchDescription": "Vul lege onderdeeldetails & cover met eerste matchresultaat van '{0}'. Overschrijft geen details tenzij 'Prefereer gematchte metadata' serverinstelling is ingeschakeld.",
+  "MessageQuickMatchDescription": "Vult ontbrekende gegevens & omslag met eerste matchresultaat van '{0}'. Overschrijft gegevens alleen als de serverinstelling ‘Geef voorkeur aan gematchte metadata’ is ingeschakeld.",
   "MessageRemoveChapter": "Verwijder hoofdstuk",
   "MessageRemoveEpisodes": "Verwijder {0} aflevering(en)",
   "MessageRemoveFromPlayerQueue": "Verwijder uit afspeelwachtrij",
@@ -841,10 +852,12 @@
   "MessageReportBugsAndContribute": "Rapporteer bugs, vraag functionaliteiten aan en draag bij op",
   "MessageResetChaptersConfirm": "Weet je zeker dat je de hoofdstukken wil resetten en de wijzigingen die je gemaakt hebt ongedaan wil maken?",
   "MessageRestoreBackupConfirm": "Weet je zeker dat je wil herstellen met behulp van de back-up gemaakt op",
-  "MessageRestoreBackupWarning": "Herstellen met een back-up zal de volledige database in /config en de covers in /metadata/items & /metadata/authors overschrijven.<br /><br />Back-ups wijzigen geen bestanden in je bibliotheekmappen. Als je de serverinstelling gebruikt om covers en metadata in je bibliotheekmappen te bewaren dan worden deze niet geback-upt of overschreven.<br /><br />Alle clients die van je server gebruik maken zullen automatisch worden ververst.",
+  "MessageRestoreBackupWarning": "Een back-up herstellen zal de volledige database in /config en de omslagen in /metadata/items & /metadata/authors overschrijven.<br /><br />Back-ups wijzigen geen bestanden in je bibliotheekmappen. Als je de serverinstelling gebruikt om omslagen en metadata in je bibliotheekmappen te bewaren dan worden deze niet geback-upt of overschreven.<br /><br />Alle apparaten die je server gebruiken, worden automatisch ververst.",
   "MessageScheduleLibraryScanNote": "Voor de meeste gebruikers is het raadzaam om deze functie uitgeschakeld te laten en de folder watcher-instelling ingeschakeld te houden. De folder watcher detecteert automatisch wijzigingen in uw bibliotheekmappen. De folder watcher werkt niet voor elk bestandssysteem (zoals NFS), dus geplande bibliotheekscans kunnen in plaats daarvan worden gebruikt.",
+  "MessageScheduleRunEveryWeekdayAtTime": "Elke {0} uitvoeren op {1}",
   "MessageSearchResultsFor": "Zoekresultaten voor",
   "MessageSelected": "{0} geselecteerd",
+  "MessageSeriesSequenceCannotContainSpaces": "Serievolgorde mag geen spaties bevatten",
   "MessageServerCouldNotBeReached": "Server niet bereikbaar",
   "MessageSetChaptersFromTracksDescription": "Stel hoofdstukken in met ieder audiobestand als een hoofdstuk en de audiobestandsnaam als hoofdstuktitel",
   "MessageShareExpirationWillBe": "Vervaldatum is <strong>{0}</strong>",
@@ -906,6 +919,8 @@
   "NotificationOnBackupCompletedDescription": "Wordt geactiveerd wanneer een back-up is voltooid",
   "NotificationOnBackupFailedDescription": "Wordt geactiveerd wanneer een back-up mislukt",
   "NotificationOnEpisodeDownloadedDescription": "Wordt geactiveerd wanneer een podcastaflevering automatisch wordt gedownload",
+  "NotificationOnRSSFeedDisabledDescription": "Wordt geactiveerd wanneer automatische afleveringsdownloads zijn uitgeschakeld vanwege te veel mislukte pogingen",
+  "NotificationOnRSSFeedFailedDescription": "Getriggerd wanneer de RSS feed aanvraag faalt voor een automatische aflevering download",
   "NotificationOnTestDescription": "Event voor het testen van het notificatiesysteem",
   "PlaceholderNewCollection": "Nieuwe naam collectie",
   "PlaceholderNewFolderPath": "Nieuwe locatie map",
@@ -950,6 +965,7 @@
   "ToastBackupRestoreFailed": "Herstellen back-up mislukt",
   "ToastBackupUploadFailed": "Uploaden back-up mislukt",
   "ToastBackupUploadSuccess": "Back-up geüpload",
+  "ToastBatchApplyDetailsToItemsSuccess": "Details toegepast op items",
   "ToastBatchDeleteFailed": "Batch verwijderen mislukt",
   "ToastBatchDeleteSuccess": "Batch verwijderen gelukt",
   "ToastBatchQuickMatchFailed": "Batch Snel Vergelijken mislukt!",
@@ -962,13 +978,15 @@
   "ToastCachePurgeFailed": "Cache wissen is mislukt",
   "ToastCachePurgeSuccess": "Cache succesvol verwijderd",
   "ToastChaptersHaveErrors": "Hoofdstukken bevatten fouten",
+  "ToastChaptersInvalidShiftAmountLast": "Ongeldige shift-tijd. De starttijd van het laatste hoofdstuk zou langer zijn dan de duur van dit audioboek.",
+  "ToastChaptersInvalidShiftAmountStart": "Ongeldige shift-lengte. Het eerste hoofdstuk zou nul of een negatieve lengte hebben en zou worden overschreven door het tweede hoofdstuk. Verleng de startduur van het tweede hoofdstuk.",
   "ToastChaptersMustHaveTitles": "Hoofdstukken moeten titels hebben",
   "ToastChaptersRemoved": "Hoofdstukken verwijderd",
   "ToastChaptersUpdated": "Hoofdstukken bijgewerkt",
   "ToastCollectionItemsAddFailed": "Item(s) toegevoegd aan collectie mislukt",
   "ToastCollectionRemoveSuccess": "Collectie verwijderd",
   "ToastCollectionUpdateSuccess": "Collectie bijgewerkt",
-  "ToastCoverUpdateFailed": "Cover update mislukt",
+  "ToastCoverUpdateFailed": "Omslag bijwerken mislukt",
   "ToastDateTimeInvalidOrIncomplete": "Datum en tijd ongeldig of onvolledig",
   "ToastDeleteFileFailed": "Bestand verwijderen mislukt",
   "ToastDeleteFileSuccess": "Bestand verwijderd",
@@ -990,7 +1008,7 @@
   "ToastInvalidImageUrl": "Ongeldige afbeeldings-URL",
   "ToastInvalidMaxEpisodesToDownload": "Ongeldig maximum aantal afleveringen om te downloaden",
   "ToastInvalidUrl": "Ongeldige URL",
-  "ToastItemCoverUpdateSuccess": "Cover onderdeel bijgewerkt",
+  "ToastItemCoverUpdateSuccess": "Omslag bijgewerkt",
   "ToastItemDeletedFailed": "Item verwijderen mislukt",
   "ToastItemDeletedSuccess": "Verwijderd item",
   "ToastItemDetailsUpdateSuccess": "Details onderdeel bijgewerkt",
@@ -1062,6 +1080,7 @@
   "ToastSelectAtLeastOneUser": "Selecteer ten minste een gebruiker",
   "ToastSendEbookToDeviceFailed": "Ebook naar apparaat sturen mislukt",
   "ToastSendEbookToDeviceSuccess": "Ebook verstuurd naar apparaat \"{0}\"",
+  "ToastSeriesSubmitFailedSameName": "Kan niet twee series met dezelfde naam toevoegen",
   "ToastSeriesUpdateFailed": "Bijwerken serie mislukt",
   "ToastSeriesUpdateSuccess": "Bijwerken serie gelukt",
   "ToastServerSettingsUpdateSuccess": "Server instellingen bijgewerkt",
@@ -1080,6 +1099,8 @@
   "ToastUnknownError": "Onbekende fout",
   "ToastUnlinkOpenIdFailed": "Gebruiker ontkoppelen van OpenID mislukt",
   "ToastUnlinkOpenIdSuccess": "Gebruiker ontkoppeld van OpenID",
+  "ToastUploaderFilepathExistsError": "Bestandspad \"{0}\" bestaat al op de server",
+  "ToastUploaderItemExistsInSubdirectoryError": "Item \"{0}\" gebruikt een submap van het uploadpad.",
   "ToastUserDeleteFailed": "Verwijderen gebruiker mislukt",
   "ToastUserDeleteSuccess": "Gebruiker verwijderd",
   "ToastUserPasswordChangeSuccess": "Wachtwoord succesvol gewijzigd",
diff --git a/client/strings/no.json b/client/strings/no.json
index 642701ef..773d8d1f 100644
--- a/client/strings/no.json
+++ b/client/strings/no.json
@@ -8,7 +8,7 @@
   "ButtonAddYourFirstLibrary": "Legg til ditt første bibliotek",
   "ButtonApply": "Bruk",
   "ButtonApplyChapters": "Bruk kapittel",
-  "ButtonAuthors": "Forfatter",
+  "ButtonAuthors": "Forfattere",
   "ButtonBack": "Tilbake",
   "ButtonBrowseForFolder": "Bla gjennom mappe",
   "ButtonCancel": "Avbryt",
@@ -175,6 +175,7 @@
   "HeaderPlaylist": "Spilleliste",
   "HeaderPlaylistItems": "Spillelisteelement",
   "HeaderPodcastsToAdd": "Podcaster å legge til",
+  "HeaderPresets": "Forhåndsinnstillinger",
   "HeaderPreviewCover": "Forhåndsvis omslag",
   "HeaderRSSFeedGeneral": "RSS Detailer",
   "HeaderRSSFeedIsOpen": "RSS Feed er åpen",
@@ -217,6 +218,7 @@
   "LabelAccountTypeAdmin": "Administrator",
   "LabelAccountTypeGuest": "Gjest",
   "LabelAccountTypeUser": "Bruker",
+  "LabelActivities": "Aktiviteter",
   "LabelActivity": "Aktivitet",
   "LabelAddToCollection": "Legg til i samling",
   "LabelAddToCollectionBatch": "Legg {0} bøker til samling",
@@ -226,6 +228,7 @@
   "LabelAddedDate": "La til {0}",
   "LabelAdminUsersOnly": "Kun administratorer",
   "LabelAll": "Alle",
+  "LabelAllEpisodesDownloaded": "Alle nedlastede episoder",
   "LabelAllUsers": "Alle brukere",
   "LabelAllUsersExcludingGuests": "Alle brukere bortsett fra gjester",
   "LabelAllUsersIncludingGuests": "Alle brukere inkludert gjester",
@@ -281,6 +284,7 @@
   "LabelContinueSeries": "Fortsett serier",
   "LabelCover": "Omslag",
   "LabelCoverImageURL": "Omslagsbilde URL",
+  "LabelCoverProvider": "Tilbyder av omslagsbilde",
   "LabelCreatedAt": "Dato opprettet",
   "LabelCronExpression": "Cron uttrykk",
   "LabelCurrent": "Nåværende",
@@ -389,6 +393,7 @@
   "LabelIntervalEvery6Hours": "Hver 6. timer",
   "LabelIntervalEveryDay": "Hver dag",
   "LabelIntervalEveryHour": "Hver time",
+  "LabelIntervalEveryMinute": "Hvert minutt",
   "LabelInvert": "Inverter",
   "LabelItem": "Enhet",
   "LabelJumpBackwardAmount": "Hopp bakover med",
@@ -464,6 +469,7 @@
   "LabelNotificationsMaxQueueSizeHelp": "Hendelser er begrenset til avfyre én gang per sekund. Hendelser blir ignorert om køen er full. Dette forhindrer overflod av varslinger.",
   "LabelNumberOfBooks": "Antall bøker",
   "LabelNumberOfEpisodes": "Antall episoder",
+  "LabelOpenIDAdvancedPermsClaimDescription": "Navnet på OpenID claim'et som inneholder avanserte tilganger for brukerhandlinger i applikasjonen som vil brukes for ikke-administratorroller (<b>hvis konfigurert</b>). Hvis claim'et mangler fra responsen, nektes tilgang til ABS. Hvis en enkelt opsjon mangler, blir behandlet som <code>false</code>. Påse at identitetstilbyderens claim stemmer overens med den forventede strukturen:",
   "LabelOpenIDClaims": "La følge valg være tomme for å slå av avanserte gruppe og tillatelser. Gruppen \"Bruker\" vil da også automatisk legges til.",
   "LabelOpenRSSFeed": "Åpne RSS Feed",
   "LabelOverwrite": "Overskriv",
@@ -521,6 +527,7 @@
   "LabelReleaseDate": "Utgivelsesdato",
   "LabelRemoveAllMetadataAbs": "Fjern alle metadata.abs filer",
   "LabelRemoveAllMetadataJson": "Fjern alle metadata.json filer",
+  "LabelRemoveAudibleBranding": "Fjern Audible inn- og utledning fra kapitler",
   "LabelRemoveCover": "Fjern omslag",
   "LabelRemoveMetadataFile": "Fjern metadata-filer fra biblioteks-mapper",
   "LabelRemoveMetadataFileHelp": "Fjern alle metadata.json og metadata.abs i alle {0} mappene.",
@@ -550,6 +557,8 @@
   "LabelSettingsBookshelfViewHelp": "Skeuomorf design med hyller av ved",
   "LabelSettingsChromecastSupport": "Chromecast støtte",
   "LabelSettingsDateFormat": "Dato Format",
+  "LabelSettingsEnableWatcher": "Skann biblioteker automatisk for endringer",
+  "LabelSettingsEnableWatcherForLibrary": "Skann bibliotek automatisk for endringer",
   "LabelSettingsEnableWatcherHelp": "Aktiverer automatisk opprettelse/oppdatering av enheter når filendringer er oppdaget. *Krever restart av server*",
   "LabelSettingsEpubsAllowScriptedContent": "Tillat scripting i innholdet i ebub-bøker",
   "LabelSettingsEpubsAllowScriptedContentHelp": "Tillat epub-filer å kjøre script. Det er anbefalt å slå av denne innstillingen med mindre du stoler på kilden til epub-filene.",
@@ -593,6 +602,7 @@
   "LabelSlug": "Slug",
   "LabelSortAscending": "Stigende",
   "LabelSortDescending": "Synkende",
+  "LabelSortPubDate": "Sorter etter publiseringsdato",
   "LabelStart": "Start",
   "LabelStartTime": "Start Tid",
   "LabelStarted": "Startet",
@@ -693,6 +703,8 @@
   "LabelYourProgress": "Din fremgang",
   "MessageAddToPlayerQueue": "Legg til i kø",
   "MessageAppriseDescription": "For å bruke denne funksjonen trenger du en instans av <a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">Apprise API</a> kjørende eller et API som håndterer disse forespørslene. <br />Apprise API URL skal være hele URL-en til varslingen, f.eks., hvis din API-instans er på <code>http://192.168.1.1:8337</code> så skal du bruke <code>http://192.168.1.1:8337/notify</code>.",
+  "MessageAsinCheck": "Påse at du bruker ASIN fra den riktige Audible-regionen, ikke Amazon.",
+  "MessageAuthenticationOIDCChangesRestart": "Etter å ha lagret, start serveren din på nytt for at OIDC-endringene skal tre i kraft.",
   "MessageBackupsDescription": "Sikkerhetskopier inkluderer, brukerfremgang, detaljer om bibliotekgjenstander, tjener instillinger og bilder lagret under <code>/metadata/items</code> og <code>/metadata/authors</code>. Sikkerhetskopier <strong>vil ikke</strong> inkludere filer som er lagret i bibliotek mappene.",
   "MessageBackupsLocationEditNote": "Viktig: Endring av mappen for sikkerhetskopi hverken endrer eller flytter eksisterende sikkerhetskopier!",
   "MessageBackupsLocationNoEditNote": "NB: Mappen for sikkerhetskopi settes i en miljøvariabel og kan ikke endres her.",
diff --git a/client/strings/pl.json b/client/strings/pl.json
index e1822755..451112bb 100644
--- a/client/strings/pl.json
+++ b/client/strings/pl.json
@@ -1,5 +1,6 @@
 {
   "ButtonAdd": "Dodaj",
+  "ButtonAddApiKey": "Dodaj klucz API",
   "ButtonAddChapters": "Dodaj rozdziały",
   "ButtonAddDevice": "Dodaj urządzenie",
   "ButtonAddLibrary": "Dodaj bibliotekę",
@@ -20,6 +21,7 @@
   "ButtonChooseAFolder": "Wybierz folder",
   "ButtonChooseFiles": "Wybierz pliki",
   "ButtonClearFilter": "Wyczyść filtr",
+  "ButtonClose": "Zamknij",
   "ButtonCloseFeed": "Zamknij kanał",
   "ButtonCloseSession": "Zamknij otwartą sesję",
   "ButtonCollections": "Kolekcje",
@@ -119,6 +121,7 @@
   "HeaderAccount": "Konto",
   "HeaderAddCustomMetadataProvider": "Dodaj niestandardowego dostawcę metadanych",
   "HeaderAdvanced": "Zaawansowane",
+  "HeaderApiKeys": "Klucze API",
   "HeaderAppriseNotificationSettings": "Ustawienia powiadomień Apprise",
   "HeaderAudioTracks": "Ścieżki audio",
   "HeaderAudiobookTools": "Narzędzia do zarządzania audiobookami",
@@ -162,6 +165,7 @@
   "HeaderMetadataOrderOfPrecedence": "Kolejność metadanych",
   "HeaderMetadataToEmbed": "Metadane do osadzenia",
   "HeaderNewAccount": "Nowe konto",
+  "HeaderNewApiKey": "Nowy klucz API",
   "HeaderNewLibrary": "Nowa biblioteka",
   "HeaderNotificationCreate": "Utwórz powiadomienie",
   "HeaderNotificationUpdate": "Zaktualizuj powiadomienie",
@@ -206,6 +210,7 @@
   "HeaderTableOfContents": "Spis treści",
   "HeaderTools": "Narzędzia",
   "HeaderUpdateAccount": "Zaktualizuj konto",
+  "HeaderUpdateApiKey": "Aktualizuj klucz API",
   "HeaderUpdateAuthor": "Zaktualizuj autorów",
   "HeaderUpdateDetails": "Zaktualizuj szczegóły",
   "HeaderUpdateLibrary": "Zaktualizuj bibliotekę",
@@ -235,6 +240,7 @@
   "LabelAllUsersExcludingGuests": "Wszyscy użytkownicy z wyłączeniem gości",
   "LabelAllUsersIncludingGuests": "Wszyscy użytkownicy, łącznie z gośćmi",
   "LabelAlreadyInYourLibrary": "Już istnieje w twojej bibliotece",
+  "LabelApiKeyCreated": "Klucz API \"{0}\" został pomyślnie utworzony.",
   "LabelApiToken": "API Token",
   "LabelAppend": "Dołącz",
   "LabelAudioBitrate": "Audio Bitrate (np. 128k)",
@@ -324,12 +330,18 @@
   "LabelEmbeddedCover": "Wbudowana okładka",
   "LabelEnable": "Włącz",
   "LabelEncodingBackupLocation": "Kopia zapasowa twoich oryginalnych plików audio będzie się znajdować w:",
+  "LabelEncodingChaptersNotEmbedded": "W audiobookach wielościeżkowych rozdziały nie są osadzone.",
+  "LabelEncodingClearItemCache": "Pamiętaj o okresowym czyszczeniu pamięci podręcznej elementów.",
+  "LabelEncodingFinishedM4B": "Ukończony plik M4B zostanie umieszczony w folderze audiobooka pod adresem:",
+  "LabelEncodingInfoEmbedded": "Metadane zostaną osadzone w ścieżkach audio w folderze z audiobookiem.",
   "LabelEnd": "Zakończ",
   "LabelEndOfChapter": "Koniec rozdziału",
   "LabelEpisode": "Odcinek",
   "LabelEpisodeTitle": "Tytuł odcinka",
   "LabelEpisodeType": "Typ odcinka",
+  "LabelEpisodeUrlFromRssFeed": "Adres URL odcinka z kanału RSS",
   "LabelEpisodes": "Epizody",
+  "LabelEpisodic": "Epizodyczny",
   "LabelExample": "Przykład",
   "LabelExpandSeries": "Rozwiń serie",
   "LabelExpandSubSeries": "Rozwiń podserie",
@@ -357,6 +369,7 @@
   "LabelFontScale": "Rozmiar czcionki",
   "LabelFontStrikethrough": "Przekreślony",
   "LabelFormat": "Format",
+  "LabelFull": "Pełny",
   "LabelGenre": "Gatunek",
   "LabelGenres": "Gatunki",
   "LabelHardDeleteFile": "Usuń trwale plik",
@@ -381,6 +394,7 @@
   "LabelIntervalEvery6Hours": "Co 6 godzin",
   "LabelIntervalEveryDay": "Każdego dnia",
   "LabelIntervalEveryHour": "Każdej godziny",
+  "LabelIntervalEveryMinute": "Co minutę",
   "LabelInvert": "Inversja",
   "LabelItem": "Pozycja",
   "LabelJumpBackwardAmount": "Przeskocz do tyłu o:",
@@ -412,6 +426,9 @@
   "LabelLowestPriority": "Najniższy priorytet",
   "LabelMatchExistingUsersBy": "Dopasuje istniejących użytkowników poprzez",
   "LabelMatchExistingUsersByDescription": "Służy do łączenia istniejących użytkowników. Po połączeniu użytkownicy zostaną dopasowani za pomocą unikalnego identyfikatora od dostawcy SSO",
+  "LabelMaxEpisodesToDownload": "Maksymalna liczba odcinków do pobrania. Użyj 0, aby wyłączyć ograniczenie.",
+  "LabelMaxEpisodesToKeep": "Maksymalna liczba odcinków do zachowania",
+  "LabelMaxEpisodesToKeepHelp": "Wartość 0 wyłącza maksymalny limit. Po automatycznym pobraniu nowego odcinka, najstarszy odcinek zostanie usunięty, jeśli masz ich więcej niż X. Spowoduje to usunięcie tylko 1 odcinka na nowe pobieranie.",
   "LabelMediaPlayer": "Odtwarzacz",
   "LabelMediaType": "Typ mediów",
   "LabelMetaTag": "Tag",
@@ -424,6 +441,7 @@
   "LabelMissingEbook": "Nie posiada ebooka",
   "LabelMissingSupplementaryEbook": "Nie posiada dodatkowego ebooka",
   "LabelMobileRedirectURIs": "Dozwolone URI przekierowań mobilnych",
+  "LabelMobileRedirectURIsDescription": "To jest biała lista prawidłowych adresów URI przekierowań dla aplikacji mobilnych. Domyślny adres to <code>audiobookshelf://oauth</code>, który można usunąć lub dodać inne adresy URI w celu integracji z aplikacjami innych firm. Użycie gwiazdki (<code>*</code>) jako jedynego wpisu zezwala na dowolny URI.",
   "LabelMore": "Więcej",
   "LabelMoreInfo": "Więcej informacji",
   "LabelName": "Nazwa",
@@ -453,12 +471,14 @@
   "LabelNumberOfEpisodes": "# Odcinków",
   "LabelOpenRSSFeed": "Otwórz kanał RSS",
   "LabelOverwrite": "Nadpisz",
+  "LabelPaginationPageXOfY": "Strona {0} z {1}",
   "LabelPassword": "Hasło",
   "LabelPath": "Ścieżka",
   "LabelPermanent": "Stałe",
   "LabelPermissionsAccessAllLibraries": "Ma dostęp do wszystkich bibliotek",
   "LabelPermissionsAccessAllTags": "Ma dostęp do wszystkich tagów",
   "LabelPermissionsAccessExplicitContent": "Ma dostęp do treści oznacznych jako nieprzyzwoite",
+  "LabelPermissionsCreateEreader": "Możliwość stworzenia czytnika e-booków",
   "LabelPermissionsDelete": "Ma możliwość usuwania",
   "LabelPermissionsDownload": "Ma możliwość pobierania",
   "LabelPermissionsUpdate": "Ma możliwość aktualizowania",
@@ -466,19 +486,25 @@
   "LabelPersonalYearReview": "Podsumowanie twojego roku ({0})",
   "LabelPhotoPathURL": "Scieżka/URL do zdjęcia",
   "LabelPlayMethod": "Metoda odtwarzania",
+  "LabelPlayerChapterNumberMarker": "{0} z {1}",
   "LabelPlaylists": "Listy odtwarzania",
+  "LabelPodcast": "Podcast",
   "LabelPodcastSearchRegion": "Obszar wyszukiwania podcastów",
+  "LabelPodcastType": "Typ podcastu",
   "LabelPodcasts": "Podcasty",
+  "LabelPort": "Port",
   "LabelPrefixesToIgnore": "Ignorowane prefiksy (wielkość liter nie ma znaczenia)",
   "LabelPreventIndexing": "Zapobiega indeksowaniu przez iTunes i Google",
   "LabelPrimaryEbook": "Główny ebook",
   "LabelProgress": "Postęp",
   "LabelProvider": "Dostawca",
+  "LabelProviderAuthorizationValue": "Wartość nagłówka autoryzacji",
   "LabelPubDate": "Data publikacji",
   "LabelPublishYear": "Rok publikacji",
+  "LabelPublishedDate": "Opublikowano {0}",
   "LabelPublisher": "Wydawca",
   "LabelPublishers": "Wydawcy",
-  "LabelRSSFeedOpen": "RSS Feed otwarty",
+  "LabelRSSFeedOpen": "Otwarty Kanał RSS",
   "LabelRSSFeedPreventIndexing": "Zapobiegaj indeksowaniu",
   "LabelRSSFeedURL": "URL kanały RSS",
   "LabelRandomly": "Losowo",
@@ -490,15 +516,22 @@
   "LabelRecentlyAdded": "Niedawno dodane",
   "LabelRecommended": "Polecane",
   "LabelRedo": "Wycofaj",
+  "LabelRegion": "Region",
   "LabelReleaseDate": "Data wydania",
+  "LabelRemoveAllMetadataAbs": "Usuń wszystkie pliki metadata.abs",
+  "LabelRemoveAllMetadataJson": "Usuń wszystkie pliki metadata.json",
   "LabelRemoveCover": "Usuń okładkę",
+  "LabelRemoveMetadataFile": "Usuń pliki metadanych z folderów biblioteki",
+  "LabelRemoveMetadataFileHelp": "Usuń wszystkie pliki metadata.json i metadata.abs z {0} folderów.",
   "LabelRowsPerPage": "Wierszy na stronę",
   "LabelSearchTerm": "Wyszukiwanie frazy",
   "LabelSearchTitle": "Wyszukaj tytuł",
   "LabelSearchTitleOrASIN": "Szukaj tytuł lub ASIN",
   "LabelSeason": "Sezon",
+  "LabelSeasonNumber": "Sezon #{0}",
   "LabelSelectAll": "Wybierz wszystko",
   "LabelSelectAllEpisodes": "Wybierz wszystkie odcinki",
+  "LabelSelectEpisodesShowing": "Wybierz {0} wyświetlanych odcinków",
   "LabelSelectUsers": "Wybór użytkowników",
   "LabelSendEbookToDevice": "Wyślij ebook do...",
   "LabelSequence": "Kolejność",
@@ -513,6 +546,8 @@
   "LabelSettingsBookshelfViewHelp": "Widok półki z książkami",
   "LabelSettingsChromecastSupport": "Wsparcie Chromecast",
   "LabelSettingsDateFormat": "Format daty",
+  "LabelSettingsEnableWatcher": "Automatyczne skanowanie bibliotek w poszukiwaniu zmian",
+  "LabelSettingsEnableWatcherForLibrary": "Automatyczne skanowanie biblioteki w poszukiwaniu zmian",
   "LabelSettingsEnableWatcherHelp": "Włącza automatyczne dodawanie/aktualizację pozycji gdy wykryte zostaną zmiany w plikach. Wymaga restartu serwera",
   "LabelSettingsEpubsAllowScriptedContent": "Zezwalanie na skrypty w plikach epub",
   "LabelSettingsEpubsAllowScriptedContentHelp": "Zezwala plikom epub na wykonywanie skryptów. Zaleca się mieć to ustawienie wyłączone, chyba że ma się zaufanie do źródła plików epub.",
@@ -524,6 +559,8 @@
   "LabelSettingsHideSingleBookSeriesHelp": "Serie, które posiadają tylko jedną książkę, nie będą pokazywane na stronie z seriami i na stronie domowej z półkami.",
   "LabelSettingsHomePageBookshelfView": "Widok półki z książkami na stronie głównej",
   "LabelSettingsLibraryBookshelfView": "Widok półki z książkami na stronie biblioteki",
+  "LabelSettingsLibraryMarkAsFinishedWhen": "Oznacz element multimedialny jako ukończony, gdy",
+  "LabelSettingsOnlyShowLaterBooksInContinueSeries": "Pomiń poprzednie książki przy kontynuacji serii",
   "LabelSettingsParseSubtitles": "Przetwarzaj podtytuły",
   "LabelSettingsParseSubtitlesHelp": "Opcja pozwala na pobranie podtytułu z nazwy folderu z audiobookiem. <br>Podtytuł musi być rozdzielony za pomocą separatora \" - \"<br>Przykład: \"Book Title - A Subtitle Here\" podtytuł \"A Subtitle Here\"",
   "LabelSettingsPreferMatchedMetadata": "Preferowanie dopasowanych metadanych",
@@ -547,6 +584,9 @@
   "LabelShowSubtitles": "Pokaż Napisy",
   "LabelSize": "Rozmiar",
   "LabelSleepTimer": "Wyłącznik czasowy",
+  "LabelSortAscending": "Rosnąco",
+  "LabelSortDescending": "Malejąco",
+  "LabelSortPubDate": "Sortuj według daty publikacji",
   "LabelStart": "Rozpocznij",
   "LabelStartTime": "Czas rozpoczęcia",
   "LabelStarted": "Rozpoczęty",
@@ -568,14 +608,21 @@
   "LabelStatsWeekListening": "Tydzień słuchania",
   "LabelSubtitle": "Podtytuł",
   "LabelSupportedFileTypes": "Obsługiwane typy plików",
+  "LabelTag": "Znacznik",
   "LabelTags": "Tagi",
   "LabelTagsAccessibleToUser": "Tagi dostępne dla użytkownika",
+  "LabelTagsNotAccessibleToUser": "Znaczniki niedostępne dla użytkownika",
+  "LabelTasks": "Uruchomione zadania",
+  "LabelTextEditorLink": "Link",
+  "LabelTextEditorNumberedList": "Lista numerowana",
+  "LabelTextEditorUnlink": "Usuń link",
   "LabelThemeDark": "Ciemny",
   "LabelThemeLight": "Jasny",
   "LabelTimeDurationXHours": "{0} godzin",
   "LabelTimeDurationXMinutes": "{0} minuty",
   "LabelTimeDurationXSeconds": "{0} sekundy",
   "LabelTimeInMinutes": "Czas w minutach",
+  "LabelTimeLeft": "pozostało {0}",
   "LabelTimeListened": "Czas odtwarzania",
   "LabelTimeListenedToday": "Czas odtwarzania dzisiaj",
   "LabelTimeRemaining": "Pozostało {0}",
@@ -583,6 +630,7 @@
   "LabelTitle": "Tytuł",
   "LabelToolsEmbedMetadata": "Załącz metadane",
   "LabelToolsEmbedMetadataDescription": "Załącz metadane do plików audio (okładkę oraz znaczniki rozdziałów).",
+  "LabelToolsM4bEncoder": "Enkoder M4B",
   "LabelToolsMakeM4b": "Generuj plik M4B",
   "LabelToolsMakeM4bDescription": "Tworzy plik w formacie .M4B, który zawiera metadane, okładkę oraz rozdziały.",
   "LabelToolsSplitM4b": "Podziel plik .M4B na pliki .MP3",
@@ -595,12 +643,14 @@
   "LabelType": "Typ",
   "LabelUndo": "Wycofaj",
   "LabelUnknown": "Nieznany",
+  "LabelUnknownPublishDate": "Nieznana data publikacji",
   "LabelUpdateCover": "Zaktalizuj odkładkę",
   "LabelUpdateCoverHelp": "Umożliwienie nadpisania istniejących okładek dla wybranych książek w przypadku znalezienia dopasowania",
   "LabelUpdateDetails": "Zaktualizuj szczegóły",
   "LabelUpdateDetailsHelp": "Umożliwienie nadpisania istniejących szczegółów dla wybranych książek w przypadku znalezienia dopasowania",
   "LabelUpdatedAt": "Zaktualizowano",
   "LabelUploaderDragAndDrop": "Przeciągnij i puść foldery lub pliki",
+  "LabelUploaderDragAndDropFilesOnly": "Przeciągnij i upuść pliki",
   "LabelUploaderDropFiles": "Puść pliki",
   "LabelUploaderItemFetchMetadataHelp": "Automatycznie pobierz tytuł, autora i serie",
   "LabelUseChapterTrack": "Użyj ścieżki rozdziału",
diff --git a/client/strings/ru.json b/client/strings/ru.json
index 07a786a1..4caceacf 100644
--- a/client/strings/ru.json
+++ b/client/strings/ru.json
@@ -1,5 +1,6 @@
 {
   "ButtonAdd": "Добавить",
+  "ButtonAddApiKey": "Добавить API ключ",
   "ButtonAddChapters": "Добавить главы",
   "ButtonAddDevice": "Добавить устройство",
   "ButtonAddLibrary": "Добавить библиотеку",
@@ -20,6 +21,7 @@
   "ButtonChooseAFolder": "Выбор папки",
   "ButtonChooseFiles": "Выбор файлов",
   "ButtonClearFilter": "Очистить фильтр",
+  "ButtonClose": "Закрыть",
   "ButtonCloseFeed": "Закрыть канал",
   "ButtonCloseSession": "Закрыть открытый сеанс",
   "ButtonCollections": "Коллекции",
@@ -119,6 +121,7 @@
   "HeaderAccount": "Учетная запись",
   "HeaderAddCustomMetadataProvider": "Добавление пользовательского поставщика метаданных",
   "HeaderAdvanced": "Дополнительно",
+  "HeaderApiKeys": "API ключи",
   "HeaderAppriseNotificationSettings": "Настройки оповещений",
   "HeaderAudioTracks": "Аудио треки",
   "HeaderAudiobookTools": "Инструменты файлов аудиокниг",
@@ -162,6 +165,7 @@
   "HeaderMetadataOrderOfPrecedence": "Порядок приоритета метаданных",
   "HeaderMetadataToEmbed": "Метаинформация для встраивания",
   "HeaderNewAccount": "Новая учетная запись",
+  "HeaderNewApiKey": "Новый API ключ",
   "HeaderNewLibrary": "Новая библиотека",
   "HeaderNotificationCreate": "Создать уведомление",
   "HeaderNotificationUpdate": "Уведомление об обновлении",
@@ -206,6 +210,7 @@
   "HeaderTableOfContents": "Содержание",
   "HeaderTools": "Инструменты",
   "HeaderUpdateAccount": "Обновить учетную запись",
+  "HeaderUpdateApiKey": "Обновить API ключ",
   "HeaderUpdateAuthor": "Обновить автора",
   "HeaderUpdateDetails": "Обновить детали",
   "HeaderUpdateLibrary": "Обновить библиотеку",
@@ -235,6 +240,10 @@
   "LabelAllUsersExcludingGuests": "Все пользователи, кроме гостей",
   "LabelAllUsersIncludingGuests": "Все пользователи, включая гостей",
   "LabelAlreadyInYourLibrary": "Уже в Вашей библиотеке",
+  "LabelApiKeyCreated": "API ключ \"{0}\" успешно создан.",
+  "LabelApiKeyCreatedDescription": "Обязательно скопируйте API-ключ сейчас, так как вы больше не сможете его увидеть.",
+  "LabelApiKeyUser": "Управление от пользователя",
+  "LabelApiKeyUserDescription": "Этот API-ключ будет иметь те же права доступа, что и пользователь, от имени которого он действует. В логах это будет отображаться так же, как если бы пользователь отправлял запрос.",
   "LabelApiToken": "Токен API",
   "LabelAppend": "Добавить",
   "LabelAudioBitrate": "Битрейт (напр. 128k)",
@@ -346,9 +355,13 @@
   "LabelExample": "Пример",
   "LabelExpandSeries": "Развернуть серию",
   "LabelExpandSubSeries": "Развернуть подсерию",
+  "LabelExpired": "Истекший",
+  "LabelExpiresAt": "Истекает в",
+  "LabelExpiresInSeconds": "Истекает через (секунд)",
+  "LabelExpiresNever": "Никогда",
   "LabelExplicit": "18+",
   "LabelExplicitChecked": "18+ (отмечено)",
-  "LabelExplicitUnchecked": "Не явно (не отмечено)",
+  "LabelExplicitUnchecked": "+18 (не отмечено)",
   "LabelExportOPML": "Экспорт OPML",
   "LabelFeedURL": "URL канала",
   "LabelFetchingMetadata": "Извлечение метаданных",
@@ -425,6 +438,7 @@
   "LabelLogLevelWarn": "Предупреждение",
   "LabelLookForNewEpisodesAfterDate": "Искать новые эпизоды после этой даты",
   "LabelLowestPriority": "Самый низкий приоритет",
+  "LabelMatchConfidence": "Уверенность",
   "LabelMatchExistingUsersBy": "Сопоставление существующих пользователей по",
   "LabelMatchExistingUsersByDescription": "Используется для подключения существующих пользователей. После подключения пользователям будет присвоен уникальный идентификатор от поставщика единого входа",
   "LabelMaxEpisodesToDownload": "Максимальное количество эпизодов для загрузки. Используйте 0 для неограниченного количества.",
@@ -455,6 +469,7 @@
   "LabelNewestEpisodes": "Новые эпизоды",
   "LabelNextBackupDate": "Следующая дата бэкапирования",
   "LabelNextScheduledRun": "Следущий запланированный запуск",
+  "LabelNoApiKeys": "API ключи отсутствуют",
   "LabelNoCustomMetadataProviders": "Нет пользовательских поставщиков метаданных",
   "LabelNoEpisodesSelected": "Эпизоды не выбраны",
   "LabelNotFinished": "Не завершено",
@@ -514,7 +529,7 @@
   "LabelPublishers": "Издатели",
   "LabelRSSFeedCustomOwnerEmail": "Пользовательский Email владельца",
   "LabelRSSFeedCustomOwnerName": "Пользовательское Имя владельца",
-  "LabelRSSFeedOpen": "Открыть RSS-канал",
+  "LabelRSSFeedOpen": "Открыть RSS-ленту",
   "LabelRSSFeedPreventIndexing": "Запретить индексирование",
   "LabelRSSFeedSlug": "Встроить RSS-канал",
   "LabelRSSFeedURL": "URL RSS-канала",
@@ -544,6 +559,7 @@
   "LabelSelectAll": "Выбрать все",
   "LabelSelectAllEpisodes": "Выбрать все эпизоды",
   "LabelSelectEpisodesShowing": "Выберите {0} эпизодов для показа",
+  "LabelSelectUser": "Выбрать пользователя",
   "LabelSelectUsers": "Выбор пользователей",
   "LabelSendEbookToDevice": "Отправить e-книгу в...",
   "LabelSequence": "Последовательность",
@@ -708,7 +724,9 @@
   "MessageAddToPlayerQueue": "Добавить в очередь проигрывателя",
   "MessageAppriseDescription": "Для использования этой функции необходимо иметь запущенный экземпляр <a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">Apprise API</a> или api которое обрабатывает те же самые запросы. <br />URL-адрес API Apprise должен быть полным URL-адресом для отправки уведомления, т.е., если API запущено по адресу <code>http://192.168.1.1:8337</code> тогда нужно указать <code>http://192.168.1.1:8337/notify</code>.",
   "MessageAsinCheck": "Убедитесь, что вы используете ASIN из правильной региональной зоны Audible, а не из Amazon.",
+  "MessageAuthenticationLegacyTokenWarning": "Устаревшие токены API в будущем будут удалены. Вместо них используйте <a href=\"/config/api-keys\">API-ключи</a>.",
   "MessageAuthenticationOIDCChangesRestart": "Перезапустите ваш сервер после сохранения для применения изменений в OIDC.",
+  "MessageAuthenticationSecurityMessage": "В целях безопасности была улучшена аутентификация. Всем пользователям необходимо повторно войти в систему.",
   "MessageBackupsDescription": "Бэкап включает пользователей, прогресс пользователей, данные элементов библиотеки, настройки сервера и изображения хранящиеся в <code>/metadata/items</code> и <code>/metadata/authors</code>. Бэкапы <strong>НЕ</strong> сохраняют файлы из папок библиотек.",
   "MessageBackupsLocationEditNote": "Примечание: Обновление местоположения резервной копии не приведет к перемещению или изменению существующих резервных копий",
   "MessageBackupsLocationNoEditNote": "Примечание: Местоположение резервного копирования задается с помощью переменной среды и не может быть изменено здесь.",
@@ -730,6 +748,7 @@
   "MessageChaptersNotFound": "Главы не найденны",
   "MessageCheckingCron": "Проверка cron...",
   "MessageConfirmCloseFeed": "Вы уверены, что хотите закрыть этот канал?",
+  "MessageConfirmDeleteApiKey": "Вы уверены, что хотите удалить API ключ \"{0}\"?",
   "MessageConfirmDeleteBackup": "Вы уверены, что хотите удалить бэкап для {0}?",
   "MessageConfirmDeleteDevice": "Вы уверены, что хотите удалить устройство для чтения электронных книг \"{0}\"?",
   "MessageConfirmDeleteFile": "Это удалит файл из Вашей файловой системы. Вы уверены?",
@@ -757,6 +776,7 @@
   "MessageConfirmRemoveAuthor": "Вы уверены, что хотите удалить автора \"{0}\"?",
   "MessageConfirmRemoveCollection": "Вы уверены, что хотите удалить коллекцию \"{0}\"?",
   "MessageConfirmRemoveEpisode": "Вы уверены, что хотите удалить эпизод \"{0}\"?",
+  "MessageConfirmRemoveEpisodeNote": "Примечание: Это не приведет к удалению аудиофайла, если не включить опцию \"Жесткое удаление файла\"",
   "MessageConfirmRemoveEpisodes": "Вы уверены, что хотите удалить {0} эпизодов?",
   "MessageConfirmRemoveListeningSessions": "Вы уверены, что хотите удалить {0} сеансов прослушивания?",
   "MessageConfirmRemoveMetadataFiles": "Вы уверены, что хотите удалить все файлы metadata. {0} файлов из папок элементов вашей библиотеки?",
@@ -918,6 +938,8 @@
   "NotificationOnBackupCompletedDescription": "Запускается при завершении резервного копирования",
   "NotificationOnBackupFailedDescription": "Срабатывает при сбое резервного копирования",
   "NotificationOnEpisodeDownloadedDescription": "Запускается при автоматической загрузке эпизода подкаста",
+  "NotificationOnRSSFeedDisabledDescription": "Срабатывает, когда автоматическая загрузка эпизодов отключена из-за слишком большого количества неудачных попыток",
+  "NotificationOnRSSFeedFailedDescription": "Срабатывает при сбое запроса RSS-канала на автоматическую загрузку эпизода",
   "NotificationOnTestDescription": "Событие для тестирования системы оповещения",
   "PlaceholderNewCollection": "Новое имя коллекции",
   "PlaceholderNewFolderPath": "Путь к новой папке",
@@ -998,6 +1020,8 @@
   "ToastEpisodeDownloadQueueClearSuccess": "Очередь загрузки эпизода очищена",
   "ToastEpisodeUpdateSuccess": "{0 эпизодов обновлено",
   "ToastErrorCannotShare": "Невозможно предоставить общий доступ на этом устройстве",
+  "ToastFailedToCreate": "Не удалось создать",
+  "ToastFailedToDelete": "Не удалось удалить",
   "ToastFailedToLoadData": "Не удалось загрузить данные",
   "ToastFailedToMatch": "Не удалось найти совпадения",
   "ToastFailedToShare": "Не удалось поделиться",
@@ -1029,6 +1053,7 @@
   "ToastMustHaveAtLeastOnePath": "Должен быть хотя бы один путь",
   "ToastNameEmailRequired": "Имя и адрес электронной почты обязательны",
   "ToastNameRequired": "Имя обязательно для заполнения",
+  "ToastNewApiKeyUserError": "Необходимо выбрать пользователя",
   "ToastNewEpisodesFound": "{0} новых эпизодов найдено",
   "ToastNewUserCreatedFailed": "Не удалось создать учетную запись: \"{0}\"",
   "ToastNewUserCreatedSuccess": "Новая учетная запись создана",
diff --git a/client/strings/sk.json b/client/strings/sk.json
index 39b3c0ae..80170dfc 100644
--- a/client/strings/sk.json
+++ b/client/strings/sk.json
@@ -346,7 +346,7 @@
   "LabelExample": "Príklad",
   "LabelExpandSeries": "Rozbaliť série",
   "LabelExpandSubSeries": "Rozbaliť podsérie",
-  "LabelExplicit": "Explicitné",
+  "LabelExplicit": "Explicitný obsah",
   "LabelExplicitChecked": "Explicitné (zaškrtnuté)",
   "LabelExplicitUnchecked": "Ne-explicitné (nezaškrtnuté)",
   "LabelExportOPML": "Exportovať OPML",
@@ -757,6 +757,7 @@
   "MessageConfirmRemoveAuthor": "Ste si istý, že chcete odstrániť autora \"{0}\"?",
   "MessageConfirmRemoveCollection": "Ste si istý, že chcete odstrániť zbierku \"{0}\"?",
   "MessageConfirmRemoveEpisode": "Ste si istý, že chcete odstrániť epizódu \"{0}\"?",
+  "MessageConfirmRemoveEpisodeNote": "Poznámka: Tento krok neodstráni zvukový súbor, pokiaľ nezaškrtnete voľbu \"Nezvratné zmazanie súborov\"",
   "MessageConfirmRemoveEpisodes": "Ste si istý, že chcete odstrániť {0} epizód?",
   "MessageConfirmRemoveListeningSessions": "Ste si istý, že chcete odstrániť týchto {0} relácií?",
   "MessageConfirmRemoveMetadataFiles": "Ste si istý, že chcete odstrániť všetky súbory metadata.{0} z priečinkov položiek vašej knižnice?",
@@ -918,6 +919,8 @@
   "NotificationOnBackupCompletedDescription": "Spustené po dokončení zálohovania",
   "NotificationOnBackupFailedDescription": "Spustené pri zlyhaní zálohovania",
   "NotificationOnEpisodeDownloadedDescription": "Spustené po automatickom stiahnutí epizódy podcastu",
+  "NotificationOnRSSFeedDisabledDescription": "Spustí sa, keď je automatické sťahovanie epizód pozastavené z dôvodu veľkého počtu zlyhaní",
+  "NotificationOnRSSFeedFailedDescription": "Spustí sa v prípade, keď zlyhá požiadavka RSS zdroja na automatické stiahnutie epizódy",
   "NotificationOnTestDescription": "Udalosť určená na testovanie systému notifikácií",
   "PlaceholderNewCollection": "Názov novej zbierky",
   "PlaceholderNewFolderPath": "Umiestnenie nového priečinka",
diff --git a/client/strings/sl.json b/client/strings/sl.json
index 2f028403..5c3c7d4f 100644
--- a/client/strings/sl.json
+++ b/client/strings/sl.json
@@ -514,7 +514,7 @@
   "LabelPublishers": "Izdajatelji",
   "LabelRSSFeedCustomOwnerEmail": "E-pošta lastnika po meri",
   "LabelRSSFeedCustomOwnerName": "Ime lastnika po meri",
-  "LabelRSSFeedOpen": "Odprt vir RSS",
+  "LabelRSSFeedOpen": "RSS vir je odprt",
   "LabelRSSFeedPreventIndexing": "Prepreči indeksiranje",
   "LabelRSSFeedSlug": "Slug RSS vira",
   "LabelRSSFeedURL": "URL vira RSS",
@@ -757,6 +757,7 @@
   "MessageConfirmRemoveAuthor": "Ali ste prepričani, da želite odstraniti avtorja \"{0}\"?",
   "MessageConfirmRemoveCollection": "Ali ste prepričani, da želite odstraniti zbirko \"{0}\"?",
   "MessageConfirmRemoveEpisode": "Ali ste prepričani, da želite odstraniti epizodo \"{0}\"?",
+  "MessageConfirmRemoveEpisodeNote": "Opomba: S tem se zvočna datoteka ne izbriše, razen če vklopite možnost \"Trdo brisanje datoteke\"",
   "MessageConfirmRemoveEpisodes": "Ali ste prepričani, da želite odstraniti {0} epizod?",
   "MessageConfirmRemoveListeningSessions": "Ali ste prepričani, da želite odstraniti {0} sej poslušanja?",
   "MessageConfirmRemoveMetadataFiles": "Ali ste prepričani, da želite odstraniti vse metapodatke.{0} v mapah elementov knjižnice?",
@@ -918,6 +919,8 @@
   "NotificationOnBackupCompletedDescription": "Sproži se, ko je varnostno kopiranje končano",
   "NotificationOnBackupFailedDescription": "Sproži se, ko varnostno kopiranje ne uspe",
   "NotificationOnEpisodeDownloadedDescription": "Sproži se, ko se epizoda podcasta samodejno prenese",
+  "NotificationOnRSSFeedDisabledDescription": "Sproži se, ko so samodejni prenosi epizod onemogočeni zaradi preveč neuspelih poskusov",
+  "NotificationOnRSSFeedFailedDescription": "Sproži se, ko zahteva za vir RSS za samodejni prenos epizode ne uspe",
   "NotificationOnTestDescription": "Dogodek za testiranje sistema obveščanja",
   "PlaceholderNewCollection": "Novo ime zbirke",
   "PlaceholderNewFolderPath": "Pot nove mape",
diff --git a/client/strings/sv.json b/client/strings/sv.json
index 4fdc400f..17254a50 100644
--- a/client/strings/sv.json
+++ b/client/strings/sv.json
@@ -1,5 +1,6 @@
 {
   "ButtonAdd": "Lägg till",
+  "ButtonAddApiKey": "Addera API-nyckel",
   "ButtonAddChapters": "Lägg till kapitel",
   "ButtonAddDevice": "Lägg till enhet",
   "ButtonAddLibrary": "Lägg till bibliotek",
@@ -20,6 +21,7 @@
   "ButtonChooseAFolder": "Välj en mapp",
   "ButtonChooseFiles": "Välj filer",
   "ButtonClearFilter": "Rensa filter",
+  "ButtonClose": "Stäng",
   "ButtonCloseFeed": "Stäng flöde",
   "ButtonCloseSession": "Stäng öppen session",
   "ButtonCollections": "Samlingar",
@@ -119,6 +121,7 @@
   "HeaderAccount": "Konto",
   "HeaderAddCustomMetadataProvider": "Addera egen källa för metadata",
   "HeaderAdvanced": "Avancerad",
+  "HeaderApiKeys": "API-nyckel",
   "HeaderAppriseNotificationSettings": "Inställningar av meddelanden med Apprise",
   "HeaderAudioTracks": "Ljudfiler",
   "HeaderAudiobookTools": "Hantering av ljudboksfiler",
@@ -162,6 +165,7 @@
   "HeaderMetadataOrderOfPrecedence": "Prioriteringsordning vid inläsning av metadata",
   "HeaderMetadataToEmbed": "Metadata som kommer att adderas",
   "HeaderNewAccount": "Nytt konto",
+  "HeaderNewApiKey": "Ny API-nyckel",
   "HeaderNewLibrary": "Nytt bibliotek",
   "HeaderNotificationCreate": "Addera ett meddelande",
   "HeaderNotificationUpdate": "Uppdateringsnotis",
@@ -205,6 +209,7 @@
   "HeaderTableOfContents": "Innehållsförteckning",
   "HeaderTools": "Verktyg",
   "HeaderUpdateAccount": "Uppdatera konto",
+  "HeaderUpdateApiKey": "Uppdatera API-nyckel",
   "HeaderUpdateAuthor": "Uppdatera författare",
   "HeaderUpdateDetails": "Uppdatera detaljer om boken",
   "HeaderUpdateLibrary": "Uppdatera bibliotek",
@@ -234,6 +239,9 @@
   "LabelAllUsersExcludingGuests": "Alla användare utom gäster",
   "LabelAllUsersIncludingGuests": "Alla användare inklusive gäster",
   "LabelAlreadyInYourLibrary": "Finns redan i samlingen",
+  "LabelApiKeyCreated": "API-nyckel \"{0}\" har adderats.",
+  "LabelApiKeyCreatedDescription": "Se till att kopiera API-nyckeln omedelbart eftersom du inte kommer att kunna se den igen.",
+  "LabelApiKeyUserDescription": "Denna API-nyckel kommer att ha samma behörigheter som användaren den agerar på uppdrag av. Detta kommer att visas på samma sätt i loggarna som om användaren gjorde begäran.",
   "LabelApiToken": "API-token",
   "LabelAppend": "Lägg till",
   "LabelAudioBitrate": "Bitrate (t.ex. 128k)",
@@ -345,7 +353,11 @@
   "LabelExample": "Exempel",
   "LabelExpandSeries": "Expandera serier",
   "LabelExpandSubSeries": "Expandera Underserier",
-  "LabelExplicit": "Explicit version",
+  "LabelExpired": "Upphört",
+  "LabelExpiresAt": "Gäller till och med",
+  "LabelExpiresInSeconds": "Upphör om (sekunder)",
+  "LabelExpiresNever": "Aldrig",
+  "LabelExplicit": "Bestämd",
   "LabelExplicitChecked": "Explicit version (markerad)",
   "LabelExplicitUnchecked": "Ej Explicit version (ej markerad)",
   "LabelExportOPML": "Exportera OPML-information",
@@ -454,6 +466,7 @@
   "LabelNewestEpisodes": "Senaste avsnitten",
   "LabelNextBackupDate": "Nästa tillfälle för säkerhetskopiering",
   "LabelNextScheduledRun": "Nästa schemalagda körning",
+  "LabelNoApiKeys": "Ingen API-nyckel",
   "LabelNoCustomMetadataProviders": "Ingen egen källa för metadata",
   "LabelNoEpisodesSelected": "Inga avsnitt har valts",
   "LabelNotFinished": "Ej avslutad",
@@ -470,11 +483,15 @@
   "LabelNotificationsMaxQueueSizeHelp": "Evenemang är begränsade till att utlösa ett per sekund. Evenemang kommer att ignoreras om kön är full. Detta förhindrar aviseringsspam.",
   "LabelNumberOfBooks": "Antal böcker",
   "LabelNumberOfEpisodes": "# av Avsnitt",
+  "LabelOpenIDAdvancedPermsClaimDescription": "Namn på OpenID-anspråket som innehåller avancerade behörigheter för användaråtgärder i applikationen, vilka gäller för icke-administratörsroller (<b>om konfigurerat</b>). Om anspråket saknas i svaret kommer åtkomst till ABS att nekas. Om ett enskilt alternativ saknas kommer det att behandlas som <code>falskt</code>. Se till att identitetsleverantörens anspråk matchar den förväntade strukturen:",
+  "LabelOpenIDClaims": "Lämna följande alternativ tomma för att inaktivera avancerad grupp- och behörighetstilldelning, och tilldela då automatiskt gruppen 'Användare'.",
+  "LabelOpenIDGroupClaimDescription": "Namn på OpenID-anspråket som innehåller en lista över användarens grupper. Vanligtvis kallat <code>groups</code>. <b>Om det är konfigurerat</b> kommer programmet automatiskt att tilldela roller baserat på användarens gruppmedlemskap, förutsatt att dessa grupper namnges utan att skiftlägeskänsligt tolkas som 'admin', 'user' eller 'guest' i anspråket. Anspråket ska innehålla en lista, och om en användare tillhör flera grupper kommer programmet att tilldela den roll som motsvarar den högsta åtkomstnivån. Om ingen grupp matchar kommer åtkomst att nekas.",
   "LabelOpenRSSFeed": "Öppna RSS-flöde",
   "LabelOverwrite": "Skriv över",
   "LabelPaginationPageXOfY": "Sida {0} av {1}",
   "LabelPassword": "Lösenord",
   "LabelPath": "Sökväg",
+  "LabelPermanent": "Permanent",
   "LabelPermissionsAccessAllLibraries": "Kan komma åt alla bibliotek",
   "LabelPermissionsAccessAllTags": "Kan komma åt alla taggar",
   "LabelPermissionsAccessExplicitContent": "Kan komma åt explicit version",
@@ -486,6 +503,7 @@
   "LabelPersonalYearReview": "En sammanställning av ditt år, sidan {0}",
   "LabelPhotoPathURL": "Bildsökväg/URL",
   "LabelPlayMethod": "Spelläge",
+  "LabelPlaybackRateIncrementDecrement": "Uppspelningshastighetsökning/minskning",
   "LabelPlayerChapterNumberMarker": "{0} av {1}",
   "LabelPlaylists": "Spellistor",
   "LabelPodcast": "Podcast",
@@ -524,6 +542,7 @@
   "LabelReleaseDate": "Utgivningsdatum",
   "LabelRemoveAllMetadataAbs": "Radera alla 'metadata.abs' filer",
   "LabelRemoveAllMetadataJson": "Radera alla 'metadata.json' filer",
+  "LabelRemoveAudibleBranding": "Ta bort Audible intro och outro från kapitel",
   "LabelRemoveCover": "Ta bort omslag",
   "LabelRemoveMetadataFile": "Radera metadata-filer i alla mappar i biblioteket",
   "LabelRemoveMetadataFileHelp": "Radera alla 'metadata.json' och 'metadata.abs' filer i dina {0} mappar.",
@@ -536,6 +555,7 @@
   "LabelSelectAll": "Välj alla",
   "LabelSelectAllEpisodes": "Välj alla avsnitt",
   "LabelSelectEpisodesShowing": "Välj {0} avsnitt som visas",
+  "LabelSelectUser": "Välj användare",
   "LabelSelectUsers": "Välj användare",
   "LabelSendEbookToDevice": "Skicka e-bok till...",
   "LabelSequence": "Ordningsnummer",
@@ -694,6 +714,7 @@
   "LabelYourProgress": "Framsteg",
   "MessageAddToPlayerQueue": "Lägg till i spellistan",
   "MessageAppriseDescription": "För att använda den här funktionen behöver du ha en instans av <a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">Apprise API</a> igång eller en API som hanterar dessa begäranden. <br />Apprise API-urlen bör vara hela URL-sökvägen för att skicka meddelandet, t.ex., om din API-instans är tillgänglig på <code>http://192.168.1.1:8337</code>, bör du ange <code>http://192.168.1.1:8337/notify</code>.",
+  "MessageAuthenticationSecurityMessage": "Identifieringen av användare har förbättrats av säkerhetsskäl. Alla användare måste därför logga in på nytt.",
   "MessageBackupsDescription": "Säkerhetskopior inkluderar användare, användarnas framsteg, biblioteksobjekt,<br>serverinställningar och bilder lagrade i <code>/metadata/items</code> & <code>/metadata/authors</code>.<br>De inkluderar <strong>INTE</strong> några filer lagrade i dina biblioteksmappar.",
   "MessageBackupsLocationEditNote": "OBS: När du ändrar plats för säkerhetskopiorna så flyttas INTE gamla säkerhetskopior dit",
   "MessageBackupsLocationNoEditNote": "OBS: Platsen där säkerhetskopiorna lagras bestäms av en central inställning och kan inte ändras här.",
@@ -714,6 +735,7 @@
   "MessageChapterStartIsAfter": "Kapitlets start är efter din ljudboks slut",
   "MessageCheckingCron": "Kontrollerar cron...",
   "MessageConfirmCloseFeed": "Är du säker på att du vill stänga detta flöde?",
+  "MessageConfirmDeleteApiKey": "Är du säker på att du vill radera API-nyckel \"{0}\"?",
   "MessageConfirmDeleteBackup": "Är du säker på att du vill radera säkerhetskopian för {0}?",
   "MessageConfirmDeleteDevice": "Är du säkert på att du vill radera enheten för e-böcker \"{0}\"?",
   "MessageConfirmDeleteFile": "Detta kommer att radera filen från ditt filsystem. Är du säker?",
@@ -764,6 +786,7 @@
   "MessageForceReScanDescription": "kommer att göra en omgångssökning av alla filer som en färsk sökning. ID3-taggar för ljudfiler, OPF-filer och textfiler kommer att sökas som nya.",
   "MessageImportantNotice": "Viktig meddelande!",
   "MessageInsertChapterBelow": "Infoga kapitel nedanför",
+  "MessageInvalidAsin": "Felaktig ASIN-kod",
   "MessageItemsSelected": "{0} objekt markerade",
   "MessageItemsUpdated": "{0} Objekt uppdaterade",
   "MessageJoinUsOn": "Anslut dig till oss på",
diff --git a/client/strings/tr.json b/client/strings/tr.json
index 1f331a3e..13b2bdf0 100644
--- a/client/strings/tr.json
+++ b/client/strings/tr.json
@@ -1,5 +1,6 @@
 {
   "ButtonAdd": "Ekle",
+  "ButtonAddApiKey": "API Anahtarı Ekle",
   "ButtonAddChapters": "Bölüm Ekle",
   "ButtonAddDevice": "Cihaz Ekle",
   "ButtonAddLibrary": "Kütüphane Ekle",
@@ -20,6 +21,7 @@
   "ButtonChooseAFolder": "Klasör seç",
   "ButtonChooseFiles": "Dosya seç",
   "ButtonClearFilter": "Filtreyi Temizle",
+  "ButtonClose": "Kapat",
   "ButtonCloseFeed": "Akışı Kapat",
   "ButtonCloseSession": "Acık Oturumu Kapat",
   "ButtonCollections": "Koleksiyonlar",
@@ -95,7 +97,17 @@
   "ButtonSearch": "Ara",
   "ButtonSelectFolderPath": "Klasör Yolunu Seç",
   "ButtonSeries": "Seriler",
+  "ButtonShare": "Paylaş",
+  "ButtonStats": "İstatistikler",
   "ButtonSubmit": "Gönder",
+  "ButtonTest": "Dene",
+  "ButtonUnlinkOpenId": "OpenID ilişiğini kaldır",
+  "ButtonUpload": "Yükle",
+  "ButtonUploadBackup": "Yedeği Yükle",
+  "ButtonUploadCover": "Kapağı Yükle",
+  "ButtonUploadOPMLFile": "OPML Dosyası Yükle",
+  "ButtonUserDelete": "{0} kullanıcısını sil.",
+  "ButtonUserEdit": "{0} kullanıcısını düzenle",
   "ButtonViewAll": "Tümünü Görüntüle",
   "ButtonYes": "Evet",
   "ErrorUploadFetchMetadataAPI": "Üst veriyi almakta hata",
@@ -104,6 +116,7 @@
   "HeaderAccount": "Hesap",
   "HeaderAddCustomMetadataProvider": "Özel Üstveri Sağlayıcısı Ekle",
   "HeaderAdvanced": "Gelişmiş",
+  "HeaderApiKeys": "API Anahtarları",
   "HeaderAppriseNotificationSettings": "Bildirim Ayarlarının Haberini Ver",
   "HeaderAudioTracks": "Ses Kanalları",
   "HeaderAudiobookTools": "Sesli Kitap Dosya Yönetim Araçları",
@@ -111,13 +124,23 @@
   "HeaderBackups": "Yedeklemeler",
   "HeaderChangePassword": "Parolayı Değiştir",
   "HeaderChapters": "Bölümler",
+  "HeaderChooseAFolder": "Klasör Seç",
   "HeaderCollection": "Koleksiyon",
   "HeaderCollectionItems": "Koleksiyon Öğeleri",
+  "HeaderCover": "Kapak",
+  "HeaderCurrentDownloads": "Geçerli İndirmeler",
+  "HeaderCustomMessageOnLogin": "Girişteki Kişiselleştirilmiş Mesaj",
+  "HeaderCustomMetadataProviders": "Kişiselleştirilmiş Metadata Sağlayıcıları",
   "HeaderDetails": "Detaylar",
+  "HeaderDownloadQueue": "Kuyruktakileri İndir",
   "HeaderEbookFiles": "Ebook Dosyaları",
+  "HeaderEmail": "Email",
+  "HeaderEmailSettings": "Email Ayarları",
   "HeaderEpisodes": "Bölümler",
+  "HeaderEreaderDevices": "Ekitap Cihazları",
   "HeaderEreaderSettings": "Ereader Ayarları",
   "HeaderFiles": "Dosyalar",
+  "HeaderFindChapters": "Bölümleri Bul",
   "HeaderIgnoredFiles": "Görmezden Gelinen Dosyalar",
   "HeaderItemFiles": "Öğe Dosyaları",
   "HeaderItemMetadataUtils": "Öğe Üstveri Araçları",
diff --git a/client/strings/uk.json b/client/strings/uk.json
index 51e5f69e..94e01e3d 100644
--- a/client/strings/uk.json
+++ b/client/strings/uk.json
@@ -1,9 +1,10 @@
 {
   "ButtonAdd": "Додати",
+  "ButtonAddApiKey": "Додати ключ API",
   "ButtonAddChapters": "Додати глави",
   "ButtonAddDevice": "Додати пристрій",
   "ButtonAddLibrary": "Додати бібліотеку",
-  "ButtonAddPodcasts": "Додати подкаст",
+  "ButtonAddPodcasts": "Додати подкасти",
   "ButtonAddUser": "Додати користувача",
   "ButtonAddYourFirstLibrary": "Додайте вашу першу бібліотеку",
   "ButtonApply": "Застосувати",
@@ -16,10 +17,11 @@
   "ButtonCancel": "Скасувати",
   "ButtonCancelEncode": "Скасувати кодування",
   "ButtonChangeRootPassword": "Змінити кореневий пароль",
-  "ButtonCheckAndDownloadNewEpisodes": "Перевірити та завантажити нові епізоди",
+  "ButtonCheckAndDownloadNewEpisodes": "Перевірити та скачати нові епізоди",
   "ButtonChooseAFolder": "Обрати теку",
   "ButtonChooseFiles": "Обрати файли",
   "ButtonClearFilter": "Очистити фільтр",
+  "ButtonClose": "Закрити",
   "ButtonCloseFeed": "Закрити стрічку",
   "ButtonCloseSession": "Закрити відкритий сеанс",
   "ButtonCollections": "Добірки",
@@ -32,8 +34,8 @@
   "ButtonEditChapters": "Редагувати глави",
   "ButtonEditPodcast": "Редагувати подкаст",
   "ButtonEnable": "Увімкнути",
-  "ButtonFireAndFail": "Вогонь і невдача",
-  "ButtonFireOnTest": "Випробування на вогнестійкість",
+  "ButtonFireAndFail": "Виконати і завершити з помилкою",
+  "ButtonFireOnTest": "Виконати подію onTest",
   "ButtonForceReScan": "Примусово сканувати",
   "ButtonFullPath": "Повний шлях",
   "ButtonHide": "Приховати",
@@ -44,7 +46,7 @@
   "ButtonLatest": "Останні",
   "ButtonLibrary": "Бібліотека",
   "ButtonLogout": "Вийти",
-  "ButtonLookup": "Пошук",
+  "ButtonLookup": "Пошуки",
   "ButtonManageTracks": "Керувати доріжками",
   "ButtonMapChapterTitles": "Призначити назви глав",
   "ButtonMatchAllAuthors": "Віднайти усіх авторів",
@@ -57,7 +59,7 @@
   "ButtonOpenFeed": "Відкрити стрічку",
   "ButtonOpenManager": "Відкрити менеджер",
   "ButtonPause": "Пауза",
-  "ButtonPlay": "Слухати",
+  "ButtonPlay": "Відтворити",
   "ButtonPlayAll": "Відтворити все",
   "ButtonPlaying": "Відтворюється",
   "ButtonPlaylists": "Списки відтворення",
@@ -86,7 +88,7 @@
   "ButtonResetToDefault": "Скинути до стандартних",
   "ButtonRestore": "Відновити",
   "ButtonSave": "Зберегти",
-  "ButtonSaveAndClose": "Зберегти та закрити",
+  "ButtonSaveAndClose": "Зберегти і закрити",
   "ButtonSaveTracklist": "Зберегти порядок",
   "ButtonScan": "Сканувати",
   "ButtonScanLibrary": "Сканувати бібліотеку",
@@ -103,7 +105,7 @@
   "ButtonStartMetadataEmbed": "Почати вбудування метаданих",
   "ButtonStats": "Статистика",
   "ButtonSubmit": "Надіслати",
-  "ButtonTest": "Перевірити",
+  "ButtonTest": "Тест",
   "ButtonUnlinkOpenId": "Вимкнути OpenID",
   "ButtonUpload": "Завантажити",
   "ButtonUploadBackup": "Завантажити резервну копію",
@@ -115,10 +117,11 @@
   "ButtonYes": "Так",
   "ErrorUploadFetchMetadataAPI": "Помилка при отриманні метаданих",
   "ErrorUploadFetchMetadataNoResults": "Не вдалося отримати метадані — спробуйте оновити заголовок та/або автора",
-  "ErrorUploadLacksTitle": "Назва обов'язкова",
+  "ErrorUploadLacksTitle": "Потрібна назва",
   "HeaderAccount": "Профіль",
   "HeaderAddCustomMetadataProvider": "Додати користувацький постачальник метаданих",
   "HeaderAdvanced": "Розширені",
+  "HeaderApiKeys": "Ключі API",
   "HeaderAppriseNotificationSettings": "Налаштування сповіщень Apprise",
   "HeaderAudioTracks": "Аудіодоріжки",
   "HeaderAudiobookTools": "Інструменти керування файлами книг",
@@ -130,11 +133,11 @@
   "HeaderCollection": "Добірка",
   "HeaderCollectionItems": "Елементи добірки",
   "HeaderCover": "Обкладинка",
-  "HeaderCurrentDownloads": "Поточні завантаження",
+  "HeaderCurrentDownloads": "Поточні скачування",
   "HeaderCustomMessageOnLogin": "Повідомлення при вході",
   "HeaderCustomMetadataProviders": "Постачальники метаданих",
   "HeaderDetails": "Подробиці",
-  "HeaderDownloadQueue": "Черга завантажень",
+  "HeaderDownloadQueue": "Черга скачувань",
   "HeaderEbookFiles": "Файли електронних книг",
   "HeaderEmail": "Електронна пошта",
   "HeaderEmailSettings": "Налаштування електронної пошти",
@@ -152,16 +155,17 @@
   "HeaderLibraryFiles": "Файли бібліотеки",
   "HeaderLibraryStats": "Статистика бібліотеки",
   "HeaderListeningSessions": "Сеанси прослуховування",
-  "HeaderListeningStats": "Статистика відтворення",
+  "HeaderListeningStats": "Статистика прослуховування",
   "HeaderLogin": "Вхід",
   "HeaderLogs": "Журнал",
   "HeaderManageGenres": "Керувати жанрами",
   "HeaderManageTags": "Керувати мітками",
   "HeaderMapDetails": "Призначити подробиці",
-  "HeaderMatch": "Пошук",
+  "HeaderMatch": "Допасуй",
   "HeaderMetadataOrderOfPrecedence": "Порядок метаданих",
   "HeaderMetadataToEmbed": "Вбудувати метадані",
   "HeaderNewAccount": "Новий профіль",
+  "HeaderNewApiKey": "Новий ключ API",
   "HeaderNewLibrary": "Нова бібліотека",
   "HeaderNotificationCreate": "Створити сповіщення",
   "HeaderNotificationUpdate": "Оновити сповіщення",
@@ -176,7 +180,7 @@
   "HeaderPlayerSettings": "Налаштування програвача",
   "HeaderPlaylist": "Список відтворення",
   "HeaderPlaylistItems": "Елементи списку відтворення",
-  "HeaderPodcastsToAdd": "Додати подкасти",
+  "HeaderPodcastsToAdd": "Подкасти для додання",
   "HeaderPresets": "Пресети",
   "HeaderPreviewCover": "Попередній перегляд",
   "HeaderRSSFeedGeneral": "Подробиці RSS",
@@ -186,7 +190,7 @@
   "HeaderRemoveEpisodes": "Видалити епізодів: {0}",
   "HeaderSavedMediaProgress": "Збережений прогрес медіа",
   "HeaderSchedule": "Розклад",
-  "HeaderScheduleEpisodeDownloads": "Запланувати автоматичне завантаження епізодів",
+  "HeaderScheduleEpisodeDownloads": "Запланувати автоматичне скачування епізодів",
   "HeaderScheduleLibraryScans": "Розклад автосканування бібліотеки",
   "HeaderSession": "Сеанс",
   "HeaderSetBackupSchedule": "Встановити розклад резервного копіювання",
@@ -206,6 +210,7 @@
   "HeaderTableOfContents": "Зміст",
   "HeaderTools": "Інструменти",
   "HeaderUpdateAccount": "Оновити профіль",
+  "HeaderUpdateApiKey": "Оновити ключ API",
   "HeaderUpdateAuthor": "Оновити автора",
   "HeaderUpdateDetails": "Оновити подробиці",
   "HeaderUpdateLibrary": "Оновити бібліотеку",
@@ -223,21 +228,25 @@
   "LabelActivities": "Діяльність",
   "LabelActivity": "Активність",
   "LabelAddToCollection": "Додати у добірку",
-  "LabelAddToCollectionBatch": "Додати книги до добірки: {0}",
+  "LabelAddToCollectionBatch": "Додати {0} книг до добірки",
   "LabelAddToPlaylist": "Додати до списку відтворення",
-  "LabelAddToPlaylistBatch": "Додано елементів у список відтворення: {0}",
+  "LabelAddToPlaylistBatch": "Додати {0} елементів до списку відтворення",
   "LabelAddedAt": "Дата додавання",
   "LabelAddedDate": "Додано {0}",
   "LabelAdminUsersOnly": "Тільки для адміністраторів",
   "LabelAll": "Усе",
-  "LabelAllEpisodesDownloaded": "Усі серії завантажено",
+  "LabelAllEpisodesDownloaded": "Усі епізоди скачано",
   "LabelAllUsers": "Усі користувачі",
   "LabelAllUsersExcludingGuests": "Усі, крім гостей",
   "LabelAllUsersIncludingGuests": "Усі, включно з гостями",
   "LabelAlreadyInYourLibrary": "Вже у вашій бібліотеці",
+  "LabelApiKeyCreated": "Ключ API \"{0}\" успішно створено.",
+  "LabelApiKeyCreatedDescription": "Обов’язково скопіюйте ключ API зараз, оскільки ви більше не зможете його побачити.",
+  "LabelApiKeyUser": "Діяти від імені користувача",
+  "LabelApiKeyUserDescription": "Цей ключ API матиме ті самі дозволи, що й користувач, від імені якого він діє. Це відображатиметься в журналах так само, як і в разі надсилання запиту користувачем.",
   "LabelApiToken": "Токен API",
   "LabelAppend": "Додати",
-  "LabelAudioBitrate": "Бітрейт аудіо (напр. 128k)",
+  "LabelAudioBitrate": "Бітрейт аудіо (наприклад, 128k)",
   "LabelAudioChannels": "Канали аудіо (1 або 2)",
   "LabelAudioCodec": "Аудіокодек",
   "LabelAuthor": "Автор",
@@ -256,18 +265,18 @@
   "LabelBackupLocation": "Розташування резервних копій",
   "LabelBackupsEnableAutomaticBackups": "Автоматичне резервне копіювання",
   "LabelBackupsEnableAutomaticBackupsHelp": "Резервні копії збережено у /metadata/backups",
-  "LabelBackupsMaxBackupSize": "Максимальний розмір резервної копії (у ГБ) (0 — необмежене)",
+  "LabelBackupsMaxBackupSize": "Максимальний розмір резервної копії (у ГБ) (0 — без обмежень)",
   "LabelBackupsMaxBackupSizeHelp": "У якості захисту від неправильного налаштування, резервну копію не буде збережено, якщо її розмір перевищуватиме вказаний.",
   "LabelBackupsNumberToKeep": "Кількість резервних копій",
-  "LabelBackupsNumberToKeepHelp": "Лиш 1 резервну копію буде видалено за раз, тож якщо їх багато, то вам варто видалити їх вручну.",
+  "LabelBackupsNumberToKeepHelp": "Видаляється лише 1 резервна копія за раз, тому якщо у вас більше копій, видаліть їх вручну.",
   "LabelBitrate": "Бітрейт",
   "LabelBonus": "Бонус",
-  "LabelBooks": "Книги",
+  "LabelBooks": "Книг",
   "LabelButtonText": "Текст кнопки",
   "LabelByAuthor": "від {0}",
   "LabelChangePassword": "Змінити пароль",
   "LabelChannels": "Канали",
-  "LabelChapterCount": "{0} Глав",
+  "LabelChapterCount": "{0} глав",
   "LabelChapterTitle": "Назва глави",
   "LabelChapters": "Глави",
   "LabelChaptersFound": "глав знайдено",
@@ -304,9 +313,9 @@
   "LabelDiscFromFilename": "Диск за назвою файлу",
   "LabelDiscFromMetadata": "Диск за метаданими",
   "LabelDiscover": "Огляд",
-  "LabelDownload": "Завантажити",
-  "LabelDownloadNEpisodes": "Завантажити епізодів: {0}",
-  "LabelDownloadable": "Можна завантажити",
+  "LabelDownload": "Скачати",
+  "LabelDownloadNEpisodes": "Скачати {0} епізодів",
+  "LabelDownloadable": "Можна скачати",
   "LabelDuration": "Тривалість",
   "LabelDurationComparisonExactMatch": "(повний збіг)",
   "LabelDurationComparisonLonger": "(на {0} довше)",
@@ -346,16 +355,20 @@
   "LabelExample": "Приклад",
   "LabelExpandSeries": "Розгорнути серії",
   "LabelExpandSubSeries": "Розгорнути підсерії",
-  "LabelExplicit": "Відверта",
+  "LabelExpired": "Термін дії минув",
+  "LabelExpiresAt": "Термін дії закінчується о",
+  "LabelExpiresInSeconds": "Термін дії закінчується через (секунди)",
+  "LabelExpiresNever": "Ніколи",
+  "LabelExplicit": "Відвертий",
   "LabelExplicitChecked": "Відверта (з прапорцем)",
   "LabelExplicitUnchecked": "Не відверта (без прапорця)",
   "LabelExportOPML": "Експорт OPML",
   "LabelFeedURL": "Адреса стрічки",
   "LabelFetchingMetadata": "Отримання метаданих",
   "LabelFile": "Файл",
-  "LabelFileBirthtime": "Дата створення",
+  "LabelFileBirthtime": "Дата створення файлу",
   "LabelFileBornDate": "Народився {0}",
-  "LabelFileModified": "Дата змінення",
+  "LabelFileModified": "Дата зміни файлу",
   "LabelFileModifiedDate": "Змінено {0}",
   "LabelFilename": "Ім'я файлу",
   "LabelFilterByUser": "Фільтрувати за користувачем",
@@ -395,7 +408,7 @@
   "LabelIntervalEvery6Hours": "Кожні 6 годин",
   "LabelIntervalEveryDay": "Щодня",
   "LabelIntervalEveryHour": "Щогодини",
-  "LabelIntervalEveryMinute": "Кожну хвилину",
+  "LabelIntervalEveryMinute": "Щохвилини",
   "LabelInvert": "Інвертувати",
   "LabelItem": "Елемент",
   "LabelJumpBackwardAmount": "Час переходу назад",
@@ -425,12 +438,13 @@
   "LabelLogLevelWarn": "Увага",
   "LabelLookForNewEpisodesAfterDate": "Шукати нові епізоди після вказаної дати",
   "LabelLowestPriority": "Найнижчий пріоритет",
+  "LabelMatchConfidence": "Впевненість",
   "LabelMatchExistingUsersBy": "Шукати наявних користувачів за",
   "LabelMatchExistingUsersByDescription": "Використовується для підключення наявних користувачів. Після підключення користувач отримає унікальний id від вашого сервісу SSO",
-  "LabelMaxEpisodesToDownload": "Максимальна кількість епізодів для завантаження. Використовуйте 0 для необмеженої кількості.",
-  "LabelMaxEpisodesToDownloadPerCheck": "Максимальна кількість нових епізодів для завантаження за перевірку",
+  "LabelMaxEpisodesToDownload": "Максимальна кількість епізодів для скачування. Використовуйте 0 для необмеженої кількості.",
+  "LabelMaxEpisodesToDownloadPerCheck": "Максимальна кількість нових епізодів для скачування за перевірку",
   "LabelMaxEpisodesToKeep": "Максимальна кількість епізодів для зберігання",
-  "LabelMaxEpisodesToKeepHelp": "Значення 0 не встановлює обмеження. Після автоматичного завантаження нового епізоду, буде видалено найстаріший епізод, якщо у вас більше ніж X епізодів. Видаляється лише 1 епізод за одне нове завантаження.",
+  "LabelMaxEpisodesToKeepHelp": "Значення 0 — без обмежень. Після автоматичного завантаження нового епізоду буде видалено найстаріший, якщо їх більше X. Видаляється лише 1 епізод за одне нове завантаження.",
   "LabelMediaPlayer": "Програвач медіа",
   "LabelMediaType": "Тип медіа",
   "LabelMetaTag": "Метатег",
@@ -455,6 +469,7 @@
   "LabelNewestEpisodes": "Нові епізоди",
   "LabelNextBackupDate": "Дата наступного резервного копіювання",
   "LabelNextScheduledRun": "Наступний запланований запуск",
+  "LabelNoApiKeys": "Без ключів API",
   "LabelNoCustomMetadataProviders": "Без постачальників метаданих",
   "LabelNoEpisodesSelected": "Не вибрано жодного епізоду",
   "LabelNotFinished": "Незавершені",
@@ -485,7 +500,7 @@
   "LabelPermissionsAccessExplicitContent": "Доступ до відвертого вмісту",
   "LabelPermissionsCreateEreader": "Можна створити читалку",
   "LabelPermissionsDelete": "Може видаляти",
-  "LabelPermissionsDownload": "Може завантажувати",
+  "LabelPermissionsDownload": "Може скачувати",
   "LabelPermissionsUpdate": "Може оновлювати",
   "LabelPermissionsUpload": "Може завантажувати",
   "LabelPersonalYearReview": "Ваші підсумки року ({0})",
@@ -514,7 +529,7 @@
   "LabelPublishers": "Видавці",
   "LabelRSSFeedCustomOwnerEmail": "Користувацька електронна адреса власника",
   "LabelRSSFeedCustomOwnerName": "Користувацьке ім'я власника",
-  "LabelRSSFeedOpen": "RSS-канал відкрито",
+  "LabelRSSFeedOpen": "RSS-канал відкритий",
   "LabelRSSFeedPreventIndexing": "Запобігати індексації",
   "LabelRSSFeedSlug": "Назва RSS-каналу",
   "LabelRSSFeedURL": "Адреса RSS-каналу",
@@ -542,8 +557,9 @@
   "LabelSeason": "Сезон",
   "LabelSeasonNumber": "Сезон #{0}",
   "LabelSelectAll": "Вибрати все",
-  "LabelSelectAllEpisodes": "Вибрати всі серії",
-  "LabelSelectEpisodesShowing": "Обрати показані епізоди: {0}",
+  "LabelSelectAllEpisodes": "Вибрати всі епізоди",
+  "LabelSelectEpisodesShowing": "Вибрати {0} показаних епізодів",
+  "LabelSelectUser": "Виберіть користувача",
   "LabelSelectUsers": "Вибрати користувачів",
   "LabelSendEbookToDevice": "Надіслати електронну книгу на...",
   "LabelSequence": "Послідовність",
@@ -595,7 +611,7 @@
   "LabelSettingsStoreMetadataWithItemHelp": "За замовчуванням файли метаданих зберігаються у /metadata/items. Цей параметр увімкне збереження метаданих у теці елемента бібліотеки",
   "LabelSettingsTimeFormat": "Формат часу",
   "LabelShare": "Поділитися",
-  "LabelShareDownloadableHelp": "Дозволяє користувачам із посиланням для спільного доступу завантажувати zip-файл елемента бібліотеки.",
+  "LabelShareDownloadableHelp": "Дозволяє користувачам із посиланням для спільного доступу скачування zip-файлу елемента бібліотеки.",
   "LabelShareOpen": "Поділитися відкрито",
   "LabelShareURL": "Поділитися URL",
   "LabelShowAll": "Показати все",
@@ -708,97 +724,101 @@
   "MessageAddToPlayerQueue": "Додати до черги відтворення",
   "MessageAppriseDescription": "Щоб скористатися цією функцією, вам потрібно мати запущену <a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">Apprise API</a> або API, що оброблятиме ті ж запити. <br />Аби надсилати сповіщення, URL-адреса API Apprise мусить бути повною, наприклад, якщо ваш API розміщено за адресою <code>http://192.168.1.1:8337</code>, то необхідно вказати адресу <code>http://192.168.1.1:8337/notify</code>.",
   "MessageAsinCheck": "Переконайтесь, що ви використовуєте ASIN з правильної регіональної Audible зони, а не з Amazon.",
+  "MessageAuthenticationLegacyTokenWarning": "Застарілі токени API будуть видалені в майбутньому. Натомість використовуйте <a href=\"/config/api-keys\">Ключі API</a>.",
   "MessageAuthenticationOIDCChangesRestart": "Перезавантажте сервер після збереження, щоб застосувати зміни OIDC.",
+  "MessageAuthenticationSecurityMessage": "Автентифікацію покращено для безпеки. Усім користувачам потрібно повторно увійти в систему.",
   "MessageBackupsDescription": "Резервні копії містять користувачів, прогрес, подробиці елементів бібліотеки, налаштування сервера та зображення з <code>/metadata/items</code> та <code>/metadata/authors</code>. Резервні копії <strong>не</strong> містять жодних файлів з тек бібліотеки.",
   "MessageBackupsLocationEditNote": "Примітка: оновлення розташування резервної копії не переносить та не змінює існуючих копій",
   "MessageBackupsLocationNoEditNote": "Примітка: розташування резервної копії встановлюється за допомогою змінної середовища та не може бути змінене тут.",
   "MessageBackupsLocationPathEmpty": "Шлях розташування резервної копії не може бути порожнім",
   "MessageBatchEditPopulateMapDetailsAllHelp": "Заповнити увімкнені поля даними з усіх елементів. Поля з кількома значеннями буде об’єднано",
-  "MessageBatchEditPopulateMapDetailsItemHelp": "Заповніть увімкнені поля деталей карти даними з цього елемента",
+  "MessageBatchEditPopulateMapDetailsItemHelp": "Заповнити увімкнені поля деталізації даними з цього елемента",
   "MessageBatchQuickMatchDescription": "Швидкий пошук спробує знайти відсутні обкладинки та метадані обраних елементів. Увімкніть налаштування нижче, аби дозволити заміну наявних обкладинок та/або метаданих під час швидкого пошуку.",
-  "MessageBookshelfNoCollections": "Ви не створили жодної добірки",
+  "MessageBookshelfNoCollections": "Ви ще не створили жодної добірки",
   "MessageBookshelfNoCollectionsHelp": "Колекції публічні. Їх можуть бачити всі користувачі, які мають доступ до бібліотеки.",
   "MessageBookshelfNoRSSFeeds": "Немає відкритих RSS-каналів",
   "MessageBookshelfNoResultsForFilter": "Немає результатів з фільтром \"{0}: {1}\"",
   "MessageBookshelfNoResultsForQuery": "Немає результатів за запитом",
-  "MessageBookshelfNoSeries": "Серії відсутні",
-  "MessageChapterEndIsAfter": "Кінець глави знаходиться після закінчення книги",
-  "MessageChapterErrorFirstNotZero": "Перша глава мусить починатися з 0",
-  "MessageChapterErrorStartGteDuration": "Час початку мусить бути меншим за тривалість аудіокниги",
-  "MessageChapterErrorStartLtPrev": "Неприпустимий час початку, має бути більшим за час початку попередньої глави",
-  "MessageChapterStartIsAfter": "Початок глави знаходиться після закінчення книги",
+  "MessageBookshelfNoSeries": "У вас немає серій",
+  "MessageChapterEndIsAfter": "Кінець глави після завершення аудіокниги",
+  "MessageChapterErrorFirstNotZero": "Перша глава повинна починатися з 0",
+  "MessageChapterErrorStartGteDuration": "Час початку має бути меншим за тривалість аудіокниги",
+  "MessageChapterErrorStartLtPrev": "Час початку має бути більшим або рівним часу початку попередньої глави",
+  "MessageChapterStartIsAfter": "Початок глави після завершення аудіокниги",
   "MessageChaptersNotFound": "Розділи не знайдені",
   "MessageCheckingCron": "Перевірка планувальника...",
   "MessageConfirmCloseFeed": "Ви дійсно бажаєте закрити цей канал?",
+  "MessageConfirmDeleteApiKey": "Ви впевнені, що хочете видалити ключ API? \"{0}\"?",
   "MessageConfirmDeleteBackup": "Ви дійсно бажаєте видалити резервну копію за {0}?",
   "MessageConfirmDeleteDevice": "Ви впевнені, що хочете видалити пристрій для читання \"{0}\"?",
   "MessageConfirmDeleteFile": "Файл буде видалено з вашої файлової системи. Ви впевнені?",
   "MessageConfirmDeleteLibrary": "Ви дійсно бажаєте назавжди видалити бібліотеку \"{0}\"?",
-  "MessageConfirmDeleteLibraryItem": "Елемент бібліотеки буде видалено з бази даних та вашої файлової системи. Ви впевнені?",
-  "MessageConfirmDeleteLibraryItems": "З бази даних та вашої файлової системи будуть видалені елементи бібліотеки: {0}. Ви впевнені?",
+  "MessageConfirmDeleteLibraryItem": "Елемент бібліотеки буде видалено з бази даних і файлової системи. Ви впевнені?",
+  "MessageConfirmDeleteLibraryItems": "Буде видалено {0} елементів бібліотеки з бази даних і файлової системи. Ви впевнені?",
   "MessageConfirmDeleteMetadataProvider": "Ви впевнені, що хочете видалити користувацького постачальника метаданих \"{0}\"?",
   "MessageConfirmDeleteNotification": "Ви впевнені, що хочете видалити це сповіщення?",
   "MessageConfirmDeleteSession": "Ви дійсно бажаєте видалити цей сеанс?",
-  "MessageConfirmEmbedMetadataInAudioFiles": "Ви впевнені, що хочете вставити метадані в {0} аудіофайлів?",
+  "MessageConfirmEmbedMetadataInAudioFiles": "Ви впевнені, що хочете вбудувати метадані у {0} аудіофайлів?",
   "MessageConfirmForceReScan": "Ви дійсно бажаєте примусово пересканувати?",
-  "MessageConfirmMarkAllEpisodesFinished": "Ви дійсно бажаєте позначити усі епізоди завершеними?",
-  "MessageConfirmMarkAllEpisodesNotFinished": "Ви дійсно бажаєте позначити усі епізоди незавершеними?",
+  "MessageConfirmMarkAllEpisodesFinished": "Ви впевнені, що хочете позначити всі епізоди завершеними?",
+  "MessageConfirmMarkAllEpisodesNotFinished": "Ви впевнені, що хочете позначити всі епізоди незавершеними?",
   "MessageConfirmMarkItemFinished": "Ви впевнені, що хочете позначити \"{0}\" як завершене?",
   "MessageConfirmMarkItemNotFinished": "Ви впевнені, що хочете позначити \"{0}\" як незавершене?",
   "MessageConfirmMarkSeriesFinished": "Ви дійсно бажаєте позначити усі книги серії завершеними?",
   "MessageConfirmMarkSeriesNotFinished": "Ви дійсно бажаєте позначити всі книги серії незавершеними?",
   "MessageConfirmNotificationTestTrigger": "Активувати це сповіщення з тестовими даними?",
-  "MessageConfirmPurgeCache": "Очищення кешу видалить усю теку <code>/metadata/cache</code>. <br /><br />Ви дійсно бажаєте видалити теку кешу?",
-  "MessageConfirmPurgeItemsCache": "Очищення кешу елементів видалить усю теку <code>/metadata/cache/items</code>. <br />Ви певні?",
-  "MessageConfirmQuickEmbed": "Увага! Швидке вбудування не створює резервних копій ваших аудіо. Переконайтеся, що маєте копію ваших файлів.<br><br>Продовжити?",
-  "MessageConfirmQuickMatchEpisodes": "При виявленні співпадінь інформація про епізоди швидкого пошуку буде перезаписана. Будуть оновлені тільки несуперечливі епізоди. Ви впевнені?",
-  "MessageConfirmReScanLibraryItems": "Ви дійсно бажаєте пересканувати елементи: {0}?",
+  "MessageConfirmPurgeCache": "Очищення кешу видалить всю теку <code>/metadata/cache</code>. <br /><br />Ви впевнені, що хочете видалити теку кешу?",
+  "MessageConfirmPurgeItemsCache": "Очищення кешу елементів видалить всю теку <code>/metadata/cache/items</code>.<br />Ви впевнені?",
+  "MessageConfirmQuickEmbed": "Увага! Швидке вбудовування не створює резервних копій ваших аудіофайлів. Переконайтеся, що маєте резервну копію. <br><br>Продовжити?",
+  "MessageConfirmQuickMatchEpisodes": "Швидке співставлення епізодів перезапише подробиці, якщо знайдено відповідність. Оновлюються лише невідповідні епізоди. Ви впевнені?",
+  "MessageConfirmReScanLibraryItems": "Ви впевнені, що хочете пересканувати {0} елементів?",
   "MessageConfirmRemoveAllChapters": "Ви дійсно бажаєте видалити усі глави?",
   "MessageConfirmRemoveAuthor": "Ви дійсно бажаєте видалити автора \"{0}\"?",
   "MessageConfirmRemoveCollection": "Ви дійсно бажаєте видалити добірку \"{0}\"?",
   "MessageConfirmRemoveEpisode": "Ви дійсно бажаєте видалити епізод \"{0}\"?",
+  "MessageConfirmRemoveEpisodeNote": "Примітка: Це не видаляє аудіофайл, якщо не перемикає \"файл жорсткого видалення\"",
   "MessageConfirmRemoveEpisodes": "Ви дійсно бажаєте видалити епізодів: {0}?",
   "MessageConfirmRemoveListeningSessions": "Ви дійсно бажаєте видалити сеанси прослуховування: {0}?",
   "MessageConfirmRemoveMetadataFiles": "Ви впевнені, що хочете видалити всі файли metadata.{0} у папках елементів вашої бібліотеки?",
   "MessageConfirmRemoveNarrator": "Ви дійсно бажаєте видалити читця \"{0}\"?",
-  "MessageConfirmRemovePlaylist": "Ви дійсно бажаєте видалити список відтворення \"{0}\"?",
-  "MessageConfirmRenameGenre": "Ви дійсно бажаєте замінити жанр \"{0}\" на \"{1}\" для усіх елементів?",
-  "MessageConfirmRenameGenreMergeNote": "Примітка: такий жанр вже існує, тож їх буде об'єднано.",
-  "MessageConfirmRenameGenreWarning": "Увага! Вже існує схожий жанр у іншому регістрі \"{0}\".",
-  "MessageConfirmRenameTag": "Ви дійсно бажаєте замінити мітку \"{0}\" на \"{1}\" для усіх елементів?",
-  "MessageConfirmRenameTagMergeNote": "Примітка: така мітка вже існує, тож їх буде об'єднано.",
-  "MessageConfirmRenameTagWarning": "Увага! Вже існує схожа мітка у іншому регістрі \"{0}\".",
+  "MessageConfirmRemovePlaylist": "Ви дійсно бажаєте видалити ваш список відтворення \"{0}\"?",
+  "MessageConfirmRenameGenre": "Ви впевнені, що хочете перейменувати жанр \"{0}\" на \"{1}\" для всіх елементів?",
+  "MessageConfirmRenameGenreMergeNote": "Примітка: Такий жанр вже існує, тому вони будуть об'єднані.",
+  "MessageConfirmRenameGenreWarning": "Увага! Схожий жанр з іншом регістром вже існує \"{0}\".",
+  "MessageConfirmRenameTag": "Ви впевнені, що хочете перейменувати мітку \"{0}\" на \"{1}\" для всіх елементів?",
+  "MessageConfirmRenameTagMergeNote": "Примітка: Така мітка вже існує, тому вони будуть об'єднані.",
+  "MessageConfirmRenameTagWarning": "Увага! Схожа мітка з іншою регістром вже існує \"{0}\".",
   "MessageConfirmResetProgress": "Ви впевнені, що хочете скинути свій прогрес?",
   "MessageConfirmSendEbookToDevice": "Ви дійсно хочете відправити на пристрій \"{2}\" електроні книги: {0}, \"{1}\"?",
   "MessageConfirmUnlinkOpenId": "Ви впевнені, що хочете відв'язати цього користувача від OpenID?",
   "MessageDaysListenedInTheLastYear": "{0} днів, прослуханих за останній рік",
-  "MessageDownloadingEpisode": "Завантаження епізоду",
+  "MessageDownloadingEpisode": "Скачування епізоду",
   "MessageDragFilesIntoTrackOrder": "Перетягніть файли до правильного порядку",
   "MessageEmbedFailed": "Не вдалося вбудувати!",
-  "MessageEmbedFinished": "Вбудовано!",
-  "MessageEmbedQueue": "В черзі на вбудовування метаданих ({0} в черзі)",
-  "MessageEpisodesQueuedForDownload": "Епізодів у черзі завантаження: {0}",
+  "MessageEmbedFinished": "Вбудовування завершено!",
+  "MessageEmbedQueue": "У черзі на вбудовування метаданих ({0} у черзі)",
+  "MessageEpisodesQueuedForDownload": "{0} епізод(ів) у черзі на завантаження",
   "MessageEreaderDevices": "Аби гарантувати отримання електронних книг, вам може знадобитися додати вказану вище адресу електронної пошти як правильного відправника на кожному з пристроїв зі списку нижче.",
   "MessageFeedURLWillBe": "URL-адреса каналу буде {0}",
   "MessageFetching": "Отримання...",
-  "MessageForceReScanDescription": "Просканує усі файли заново, неначе вперше. ID3-мітки, файли OPF та текстові файли будуть проскановані як нові.",
+  "MessageForceReScanDescription": "Просканує всі файли заново, як при першому скануванні. ID3-мітки, OPF-файли та текстові файли будуть проскановані як нові.",
   "MessageImportantNotice": "Важливе повідомлення!",
   "MessageInsertChapterBelow": "Введіть главу нижче",
   "MessageInvalidAsin": "Невірний ASIN",
-  "MessageItemsSelected": "Вибрано елементів: {0}",
-  "MessageItemsUpdated": "Оновлено елементів: {0}",
+  "MessageItemsSelected": "Вибрано {0} елементів",
+  "MessageItemsUpdated": "Оновлено {0} елементів",
   "MessageJoinUsOn": "Приєднуйтесь до",
   "MessageLoading": "Завантаження...",
-  "MessageLoadingFolders": "Завантаження тек...",
+  "MessageLoadingFolders": "Завантаження папок...",
   "MessageLogsDescription": "Журнали зберігаються у <code>/metadata/logs</code> як JSON-файли. Журнали збоїв зберігаються у <code>/metadata/logs/crash_logs.txt</code>.",
   "MessageM4BFailed": "Помилка M4B!",
   "MessageM4BFinished": "M4B створено!",
-  "MessageMapChapterTitles": "Встановіть назви глав вашої аудіокниги без визначення налаштувань тривалості",
+  "MessageMapChapterTitles": "Встановіть назви глав вашої аудіокниги без зміни часових міток",
   "MessageMarkAllEpisodesFinished": "Позначити всі епізоди завершеними",
   "MessageMarkAllEpisodesNotFinished": "Позначити всі епізоди незавершеними",
-  "MessageMarkAsFinished": "Позначити завершеним",
-  "MessageMarkAsNotFinished": "Позначити незавершеним",
-  "MessageMatchBooksDescription": "Спробує віднайти книгу у вказаному джерелі пошуку та встановити подробиці та обкладинку, яких бракує. Не перезаписує подробиці.",
+  "MessageMarkAsFinished": "Позначити як завершене",
+  "MessageMarkAsNotFinished": "Позначити як незавершене",
+  "MessageMatchBooksDescription": "Спробує знайти книги у бібліотеці у вибраному джерелі пошуку та заповнити порожні подробиці й обкладинку. Не перезаписує подробиці.",
   "MessageNoAudioTracks": "Аудіодоріжки відсутні",
   "MessageNoAuthors": "Автори відсутні",
   "MessageNoBackups": "Резервні копії відсутні",
@@ -808,8 +828,8 @@
   "MessageNoCoversFound": "Обкладинок не знайдено",
   "MessageNoDescription": "Без опису",
   "MessageNoDevices": "Немає пристроїв",
-  "MessageNoDownloadsInProgress": "Немає активних завантажень",
-  "MessageNoDownloadsQueued": "Немає завантажень у черзі",
+  "MessageNoDownloadsInProgress": "Немає активних скачувань",
+  "MessageNoDownloadsQueued": "Немає скачувань у черзі",
   "MessageNoEpisodeMatchesFound": "Відповідних епізодів не знайдено",
   "MessageNoEpisodes": "Епізоди відсутні",
   "MessageNoFoldersAvailable": "Немає доступних тек",
@@ -818,21 +838,21 @@
   "MessageNoItems": "Елементи відсутні",
   "MessageNoItemsFound": "Елементів не знайдено",
   "MessageNoListeningSessions": "Сеанси прослуховування відсутні",
-  "MessageNoLogs": "Немає журнали",
+  "MessageNoLogs": "Немає журналів'",
   "MessageNoMediaProgress": "Прогрес відсутній",
   "MessageNoNotifications": "Сповіщення відсутні",
-  "MessageNoPodcastFeed": "Невірний подкаст: Немає каналу",
+  "MessageNoPodcastFeed": "Некоректний подкаст: немає каналу",
   "MessageNoPodcastsFound": "Подкастів не знайдено",
   "MessageNoResults": "Немає результатів",
   "MessageNoSearchResultsFor": "Немає результатів пошуку для \"{0}\"",
-  "MessageNoSeries": "Без серії",
-  "MessageNoTags": "Без міток",
+  "MessageNoSeries": "Немає серій",
+  "MessageNoTags": "Немає міток",
   "MessageNoTasksRunning": "Немає активних завдань",
-  "MessageNoUpdatesWereNecessary": "Оновлень не потрібно",
+  "MessageNoUpdatesWereNecessary": "Оновлення не потрібні",
   "MessageNoUserPlaylists": "У вас немає списків відтворення",
-  "MessageNoUserPlaylistsHelp": "Списки відтворення приватні. Лише користувач, який їх створює, може бачити їх.",
+  "MessageNoUserPlaylistsHelp": "Списки відтворення приватні. Лише користувач, який їх створив, може їх бачити.",
   "MessageNotYetImplemented": "Ще не реалізовано",
-  "MessageOpmlPreviewNote": "Примітка: це попередній перегляд OPML-файлу. Актуальна назва подкасту буде завантажена з RSS-каналу.",
+  "MessageOpmlPreviewNote": "Примітка: це попередній перегляд OPML-файлу. Актуальна назва подкасту буде взята з RSS-каналу.",
   "MessageOr": "або",
   "MessagePauseChapter": "Призупинити відтворення глави",
   "MessagePlayChapter": "Слухати початок глави",
@@ -841,7 +861,7 @@
   "MessagePodcastHasNoRSSFeedForMatching": "Подкаст не має RSS-каналу для пошуку",
   "MessagePodcastSearchField": "Введіть пошуковий запит або URL RSS-стрічки",
   "MessageQuickEmbedInProgress": "Швидке вбудовування в процесі",
-  "MessageQuickEmbedQueue": "В черзі на швидке вбудовування ({0} в черзі)",
+  "MessageQuickEmbedQueue": "У черзі на швидке вбудовування ({0} в черзі)",
   "MessageQuickMatchAllEpisodes": "Швидке співставлення всіх епізодів",
   "MessageQuickMatchDescription": "Заповнити відсутні подробиці та обкладинку першим результатом пошуку '{0}'. Не перезаписує подробиці, якщо не увімкнено параметр \"Надавати перевагу віднайденим метаданим\".",
   "MessageRemoveChapter": "Видалити главу",
@@ -849,9 +869,9 @@
   "MessageRemoveFromPlayerQueue": "Вилучити з черги відтворення",
   "MessageRemoveUserWarning": "Ви дійсно бажаєте назавжди видалити користувача \"{0}\"?",
   "MessageReportBugsAndContribute": "Повідомляйте про помилки, пропонуйте функції та долучайтеся на",
-  "MessageResetChaptersConfirm": "Ви дійсно бажаєте скинути глави та скасувати внесені зміни?",
-  "MessageRestoreBackupConfirm": "Ви дійсно бажаєте відновити резервну копію від",
-  "MessageRestoreBackupWarning": "Відновлення резервної копії перезапише всю базу даних, розташовану в /config, і зображення обкладинок в /metadata/items та /metadata/authors.<br /><br />Резервні копії не змінюють жодних файлів у теках бібліотеки. Якщо у налаштуваннях сервера увімкнено збереження обкладинок і метаданих у теках бібліотеки, вони не створюються під час резервного копіювання і не перезаписуються..<br /><br />Всі клієнти, що користуються вашим сервером, будуть автоматично оновлені.",
+  "MessageResetChaptersConfirm": "Ви впевнені, що хочете скинути глави та скасувати внесені зміни?",
+  "MessageRestoreBackupConfirm": "Ви впевнені, що хочете відновити резервну копію, створену",
+  "MessageRestoreBackupWarning": "Відновлення резервної копії перезапише всю базу даних у /config і зображення обкладинок у /metadata/items та /metadata/authors.<br /><br />Резервні копії не змінюють файли у теках бібліотеки. Якщо у налаштуваннях сервера увімкнено збереження обкладинок і метаданих у теках бібліотеки, вони не створюються під час резервного копіювання і не перезаписуються.<br /><br />Всі клієнти, що користуються вашим сервером, будуть автоматично оновлені.",
   "MessageScheduleLibraryScanNote": "Для більшості користувачів рекомендується залишити цю функцію вимкненою та залишити параметр перегляду папок увімкненим. Засіб спостереження за папками автоматично виявить зміни в папках вашої бібліотеки. Засіб спостереження за папками не працює для кожної файлової системи (наприклад, NFS), тому замість нього можна використовувати сканування бібліотек за розкладом.",
   "MessageScheduleRunEveryWeekdayAtTime": "Запуск кожні {0} о {1}",
   "MessageSearchResultsFor": "Результати пошуку для",
@@ -860,12 +880,12 @@
   "MessageServerCouldNotBeReached": "Не вдалося підключитися до сервера",
   "MessageSetChaptersFromTracksDescription": "Створити глави з аудіодоріжок, встановивши назви файлів за заголовки",
   "MessageShareExpirationWillBe": "Термін сплине за <strong>{0}</strong>",
-  "MessageShareExpiresIn": "Сплине за {0}",
-  "MessageShareURLWillBe": "Поширюваний URL - <strong>{0}</strong>",
+  "MessageShareExpiresIn": "Спливає через {0}",
+  "MessageShareURLWillBe": "URL для спільного доступу — <strong>{0}</strong>",
   "MessageStartPlaybackAtTime": "Почати відтворення \"{0}\" з {1}?",
   "MessageTaskAudioFileNotWritable": "Аудіофайл \"{0}\" недоступний для запису",
-  "MessageTaskCanceledByUser": "Задача скасована користувачем",
-  "MessageTaskDownloadingEpisodeDescription": "Завантаження епізоду \"{0}\"",
+  "MessageTaskCanceledByUser": "Завдання скасовано користувачем",
+  "MessageTaskDownloadingEpisodeDescription": "Скачування епізоду \"{0}\"",
   "MessageTaskEmbeddingMetadata": "Вбудовування метаданих",
   "MessageTaskEmbeddingMetadataDescription": "Вбудовування метаданих у аудіокнигу \"{0}\"",
   "MessageTaskEncodingM4b": "Кодування M4B",
@@ -880,19 +900,19 @@
   "MessageTaskMatchingBooksInLibrary": "Відповідність книг у бібліотеці \"{0}\"",
   "MessageTaskNoFilesToScan": "Немає файлів для сканування",
   "MessageTaskOpmlImport": "Імпорт OPML",
-  "MessageTaskOpmlImportDescription": "Створення подкастів з {0} RSS-стрічок",
-  "MessageTaskOpmlImportFeed": "Канал імпорту OPML",
+  "MessageTaskOpmlImportDescription": "Створення подкастів з {0} RSS-каналів",
+  "MessageTaskOpmlImportFeed": "Імпорт RSS-каналу OPML",
   "MessageTaskOpmlImportFeedDescription": "Імпорт RSS-каналу \"{0}\"",
-  "MessageTaskOpmlImportFeedFailed": "Не вдалося отримати подкаст-стрічку",
+  "MessageTaskOpmlImportFeedFailed": "Не вдалося отримати подкаст-канал",
   "MessageTaskOpmlImportFeedPodcastDescription": "Створення подкасту \"{0}\"",
   "MessageTaskOpmlImportFeedPodcastExists": "Подкаст вже існує за цим шляхом",
   "MessageTaskOpmlImportFeedPodcastFailed": "Не вдалося створити подкаст",
   "MessageTaskOpmlImportFinished": "Додано {0} подкастів",
-  "MessageTaskOpmlParseFailed": "Не вдалося розібрати файл OPML",
-  "MessageTaskOpmlParseFastFail": "Невірний файл OPML: не знайдено тег <opml> або тег <outline>",
-  "MessageTaskOpmlParseNoneFound": "У файлі OPML не знайдено жодного канала",
+  "MessageTaskOpmlParseFailed": "Не вдалося розібрати OPML-файл",
+  "MessageTaskOpmlParseFastFail": "Некоректний OPML-файл: не знайдено тег <opml> або <outline>",
+  "MessageTaskOpmlParseNoneFound": "У OPML-файлі не знайдено жодного каналу",
   "MessageTaskScanItemsAdded": "{0} додано",
-  "MessageTaskScanItemsMissing": "{0} відсутній",
+  "MessageTaskScanItemsMissing": "{0} відсутні",
   "MessageTaskScanItemsUpdated": "{0} оновлено",
   "MessageTaskScanNoChangesNeeded": "Змін не потрібно",
   "MessageTaskScanningFileChanges": "Сканування змін файлів у \"{0}\"",
@@ -902,22 +922,24 @@
   "MessageUploaderItemFailed": "Не вдалося завантажити",
   "MessageUploaderItemSuccess": "Успішно завантажено!",
   "MessageUploading": "Завантаження...",
-  "MessageValidCronExpression": "Допустима команда cron",
-  "MessageWatcherIsDisabledGlobally": "Спостерігача вимкнено в налаштуваннях сервера",
+  "MessageValidCronExpression": "Коректний cron-вираз",
+  "MessageWatcherIsDisabledGlobally": "Спостерігача вимкнено у глобальних налаштуваннях сервера",
   "MessageXLibraryIsEmpty": "Бібліотека {0} порожня!",
-  "MessageYourAudiobookDurationIsLonger": "Тривалість вашої аудіокниги довша за віднайдену",
-  "MessageYourAudiobookDurationIsShorter": "Тривалість вашої аудіокниги коротша за віднайдену",
-  "NoteChangeRootPassword": "Тільки користувач root — єдиний, хто може мати порожній пароль",
-  "NoteChapterEditorTimes": "Примітка: Перша глава мусить починатися з 0:00, а час початку останньої глави не може бути більшим за зазначену тривалість аудіокниги.",
-  "NoteFolderPicker": "Примітка: вже обрані теки не буде показано",
-  "NoteRSSFeedPodcastAppsHttps": "Попередження: Більшість додатків подкастів вимагатимуть використання протоколу HTTPS від RSS-каналу",
-  "NoteRSSFeedPodcastAppsPubDate": "Попередження: 1 або більше ваших епізодів не мають дати публікації. Деякі додатки подкастів вимагають це.",
-  "NoteUploaderFoldersWithMediaFiles": "Теки з медіафайлами буде оброблено як окремі елементи бібліотеки.",
-  "NoteUploaderOnlyAudioFiles": "Якщо завантажувати лише аудіофайли, то кожен файл буде оброблено як окрему книгу.",
-  "NoteUploaderUnsupportedFiles": "Непідтримувані файли пропущено. Під час вибору або перетягування теки, файли, що знаходяться поза текою, пропускаються.",
-  "NotificationOnBackupCompletedDescription": "Запускається після завершення резервного копіювання",
-  "NotificationOnBackupFailedDescription": "Срабатывает при збої резервного копіювання",
-  "NotificationOnEpisodeDownloadedDescription": "Запускається при автоматичному завантаженні епізоду подкасту",
+  "MessageYourAudiobookDurationIsLonger": "Тривалість вашої аудіокниги більша за знайдену",
+  "MessageYourAudiobookDurationIsShorter": "Тривалість вашої аудіокниги менша за знайдену",
+  "NoteChangeRootPassword": "Тільки користувач root може мати порожній пароль",
+  "NoteChapterEditorTimes": "Примітка: Перша глава повинна починатися з 0:00, а час початку останньої глави не може перевищувати тривалість цієї аудіокниги.",
+  "NoteFolderPicker": "Примітка: вже додані папки не відображаються",
+  "NoteRSSFeedPodcastAppsHttps": "Попередження: більшість додатків подкастів вимагають використання HTTPS для RSS-каналу",
+  "NoteRSSFeedPodcastAppsPubDate": "Попередження: один або більше ваших епізодів не мають дати публікації. Деякі додатки подкастів цього вимагають.",
+  "NoteUploaderFoldersWithMediaFiles": "Теки з медіафайлами обробляються як окремі елементи бібліотеки.",
+  "NoteUploaderOnlyAudioFiles": "Якщо завантажувати лише аудіофайли, кожен файл буде окремою аудіокнигою.",
+  "NoteUploaderUnsupportedFiles": "Непідтримувані файли ігноруються. При виборі або перетягуванні теки, файли поза теками елементів ігноруються.",
+  "NotificationOnBackupCompletedDescription": "Виконується після завершення резервного копіювання",
+  "NotificationOnBackupFailedDescription": "Виконується при помилці резервного копіювання",
+  "NotificationOnEpisodeDownloadedDescription": "Виконується при автоматичному завантаженні епізоду подкасту",
+  "NotificationOnRSSFeedDisabledDescription": "Виконується, коли автоматичне завантаження епізодів вимкнено через забагато невдалих спроб",
+  "NotificationOnRSSFeedFailedDescription": "Виконується, коли запит RSS-каналу не вдається для автоматичного завантаження епізоду",
   "NotificationOnTestDescription": "Подія для тестування системи сповіщень",
   "PlaceholderNewCollection": "Нова назва добірки",
   "PlaceholderNewFolderPath": "Новий шлях до теки",
@@ -995,15 +1017,17 @@
   "ToastEncodeCancelFailed": "Не вдалося скасувати кодування",
   "ToastEncodeCancelSucces": "Кодування скасовано",
   "ToastEpisodeDownloadQueueClearFailed": "Не вдалося очистити чергу",
-  "ToastEpisodeDownloadQueueClearSuccess": "Чергу на завантаження епізодів очищено",
+  "ToastEpisodeDownloadQueueClearSuccess": "Чергу на скачування епізодів очищено",
   "ToastEpisodeUpdateSuccess": "{0} епізодів оновлено",
   "ToastErrorCannotShare": "Не можна типово поширити на цей пристрій",
+  "ToastFailedToCreate": "Не вдалося створити",
+  "ToastFailedToDelete": "Не вдалося видалити",
   "ToastFailedToLoadData": "Не вдалося завантажити дані",
   "ToastFailedToMatch": "Не вдалося знайти відповідність",
   "ToastFailedToShare": "Не вдалося поділитися",
   "ToastFailedToUpdate": "Не вдалося оновити",
   "ToastInvalidImageUrl": "Невірний URL зображення",
-  "ToastInvalidMaxEpisodesToDownload": "Невірна кількість епізодів для завантаження",
+  "ToastInvalidMaxEpisodesToDownload": "Невірна кількість епізодів для скачування",
   "ToastInvalidUrl": "Невірний URL",
   "ToastItemCoverUpdateSuccess": "Обкладинку елемента оновлено",
   "ToastItemDeletedFailed": "Не вдалося видалити елемент",
@@ -1029,6 +1053,7 @@
   "ToastMustHaveAtLeastOnePath": "Повинен бути хоча б один шлях",
   "ToastNameEmailRequired": "Ім'я та електронна пошта обов'язкові",
   "ToastNameRequired": "Ім'я обов'язкове",
+  "ToastNewApiKeyUserError": "Потрібно вибрати користувача",
   "ToastNewEpisodesFound": "{0} нових епізодів знайдено",
   "ToastNewUserCreatedFailed": "Не вдалося створити акаунт: \"{0}\"",
   "ToastNewUserCreatedSuccess": "Новий акаунт створено",
@@ -1063,7 +1088,7 @@
   "ToastProviderRemoveSuccess": "Постачальник видалений",
   "ToastRSSFeedCloseFailed": "Не вдалося закрити RSS-канал",
   "ToastRSSFeedCloseSuccess": "RSS-канал закрито",
-  "ToastRemoveFailed": "Не вдалося видалити",
+  "ToastRemoveFailed": "Не вдалося вилучити",
   "ToastRemoveItemFromCollectionFailed": "Не вдалося видалити елемент із добірки",
   "ToastRemoveItemFromCollectionSuccess": "Елемент видалено з добірки",
   "ToastRemoveItemsWithIssuesFailed": "Не вдалося видалити елементи бібліотеки з проблемами",
diff --git a/client/strings/zh-cn.json b/client/strings/zh-cn.json
index 0f9f4a99..4d86781e 100644
--- a/client/strings/zh-cn.json
+++ b/client/strings/zh-cn.json
@@ -1,5 +1,6 @@
 {
   "ButtonAdd": "添加",
+  "ButtonAddApiKey": "添加 API 密钥",
   "ButtonAddChapters": "添加章节",
   "ButtonAddDevice": "添加设备",
   "ButtonAddLibrary": "添加库",
@@ -11,7 +12,7 @@
   "ButtonAuthors": "作者",
   "ButtonBack": "返回",
   "ButtonBatchEditPopulateFromExisting": "用现有内容填充",
-  "ButtonBatchEditPopulateMapDetails": "填充地图详细信息",
+  "ButtonBatchEditPopulateMapDetails": "填入此项详情",
   "ButtonBrowseForFolder": "浏览文件夹",
   "ButtonCancel": "取消",
   "ButtonCancelEncode": "取消编码",
@@ -20,6 +21,7 @@
   "ButtonChooseAFolder": "选择文件夹",
   "ButtonChooseFiles": "选择文件",
   "ButtonClearFilter": "清除过滤器",
+  "ButtonClose": "关闭",
   "ButtonCloseFeed": "关闭源",
   "ButtonCloseSession": "关闭活动会话",
   "ButtonCollections": "收藏",
@@ -73,7 +75,7 @@
   "ButtonQuickMatch": "快速匹配",
   "ButtonReScan": "重新扫描",
   "ButtonRead": "读取",
-  "ButtonReadLess": "阅读较少",
+  "ButtonReadLess": "收起",
   "ButtonReadMore": "阅读更多",
   "ButtonRefresh": "刷新",
   "ButtonRemove": "移除",
@@ -119,6 +121,7 @@
   "HeaderAccount": "帐户",
   "HeaderAddCustomMetadataProvider": "添加自定义元数据提供商",
   "HeaderAdvanced": "高级",
+  "HeaderApiKeys": "API 密钥",
   "HeaderAppriseNotificationSettings": "测试通知设置",
   "HeaderAudioTracks": "音轨",
   "HeaderAudiobookTools": "有声读物文件管理工具",
@@ -162,12 +165,13 @@
   "HeaderMetadataOrderOfPrecedence": "元数据优先级",
   "HeaderMetadataToEmbed": "嵌入元数据",
   "HeaderNewAccount": "新建帐户",
+  "HeaderNewApiKey": "新建 API 密钥",
   "HeaderNewLibrary": "新建媒体库",
   "HeaderNotificationCreate": "创建通知",
   "HeaderNotificationUpdate": "更新通知",
   "HeaderNotifications": "通知",
   "HeaderOpenIDConnectAuthentication": "OpenID 连接身份验证",
-  "HeaderOpenListeningSessions": "打开收听会话",
+  "HeaderOpenListeningSessions": "活动中会话",
   "HeaderOpenRSSFeed": "打开 RSS 源",
   "HeaderOtherFiles": "其他文件",
   "HeaderPasswordAuthentication": "密码认证",
@@ -206,13 +210,14 @@
   "HeaderTableOfContents": "目录",
   "HeaderTools": "工具",
   "HeaderUpdateAccount": "更新帐户",
+  "HeaderUpdateApiKey": "更新 API 密钥",
   "HeaderUpdateAuthor": "更新作者",
   "HeaderUpdateDetails": "更新详情",
   "HeaderUpdateLibrary": "更新媒体库",
   "HeaderUsers": "用户",
   "HeaderYearReview": "{0} 年回顾",
   "HeaderYourStats": "你的统计数据",
-  "LabelAbridged": "概要",
+  "LabelAbridged": "删节版",
   "LabelAbridgedChecked": "删节版 (已勾选)",
   "LabelAbridgedUnchecked": "未删节版 (未勾选)",
   "LabelAccessibleBy": "可访问",
@@ -235,6 +240,10 @@
   "LabelAllUsersExcludingGuests": "除访客外的所有用户",
   "LabelAllUsersIncludingGuests": "包括访客的所有用户",
   "LabelAlreadyInYourLibrary": "已存在你的库中",
+  "LabelApiKeyCreated": "API 密钥 \"{0}\" 创建成功.",
+  "LabelApiKeyCreatedDescription": "请确保现在就复制 API 密钥, 之后将无法再次查看.",
+  "LabelApiKeyUser": "代用户操作",
+  "LabelApiKeyUserDescription": "此 API 密钥将具有与其代理的用户相同的权限. 在日志中, 其请求将被视为由该用户直接发出.",
   "LabelApiToken": "API 令牌",
   "LabelAppend": "附加",
   "LabelAudioBitrate": "音频比特率 (例如: 128k)",
@@ -320,7 +329,7 @@
   "LabelEmailSettingsRejectUnauthorized": "拒绝未经授权的证书",
   "LabelEmailSettingsRejectUnauthorizedHelp": "禁用SSL证书验证可能会使你的连接面临安全风险, 例如中间人攻击. 只有当你了解其中的含义并信任所连接的邮件服务器时, 才能禁用此选项.",
   "LabelEmailSettingsSecure": "安全",
-  "LabelEmailSettingsSecureHelp": "如果选是, 则连接将在连接到服务器时使用TLS. 如果选否, 则若服务器支持STARTTLS扩展, 则使用TLS. 在大多数情况下, 如果连接到端口465, 请将该值设置为是. 对于端口587或25, 请保持为否. (来自nodemailer.com/smtp/#authentication)",
+  "LabelEmailSettingsSecureHelp": "开启此选项时, 将始终通过TLS连接服务器. 关闭此选项时, 仅在服务器支持STARTTLS扩展时使用TLS. 在大多数情况下, 如果连接到端口465, 请将此项设为开启. 如果连接到端口587或25, 请将此设置保持为关闭. (来自nodemailer.com/smtp/#authentication)",
   "LabelEmailSettingsTestAddress": "测试地址",
   "LabelEmbeddedCover": "嵌入封面",
   "LabelEnable": "启用",
@@ -346,15 +355,19 @@
   "LabelExample": "示例",
   "LabelExpandSeries": "展开系列",
   "LabelExpandSubSeries": "展开子系列",
-  "LabelExplicit": "信息准确",
-  "LabelExplicitChecked": "明确（已选中）",
-  "LabelExplicitUnchecked": "不明确 (未选中)",
+  "LabelExpired": "已过期",
+  "LabelExpiresAt": "过期时间",
+  "LabelExpiresInSeconds": "有效期 (秒)",
+  "LabelExpiresNever": "从不",
+  "LabelExplicit": "含成人内容",
+  "LabelExplicitChecked": "成人内容 (已核实)",
+  "LabelExplicitUnchecked": "无成人内容 (未核实)",
   "LabelExportOPML": "导出 OPML",
   "LabelFeedURL": "源 URL",
   "LabelFetchingMetadata": "正在获取元数据",
   "LabelFile": "文件",
   "LabelFileBirthtime": "文件创建时间",
-  "LabelFileBornDate": "生于 {0}",
+  "LabelFileBornDate": "添加于 {0}",
   "LabelFileModified": "文件修改时间",
   "LabelFileModifiedDate": "已修改 {0}",
   "LabelFilename": "文件名",
@@ -425,6 +438,7 @@
   "LabelLogLevelWarn": "警告",
   "LabelLookForNewEpisodesAfterDate": "在此日期后查找新剧集",
   "LabelLowestPriority": "最低优先级",
+  "LabelMatchConfidence": "置信度",
   "LabelMatchExistingUsersBy": "匹配现有用户",
   "LabelMatchExistingUsersByDescription": "用于连接现有用户. 连接后, 用户将通过 SSO 提供商提供的唯一 id 进行匹配",
   "LabelMaxEpisodesToDownload": "可下载的最大集数. 输入 0 表示无限制.",
@@ -455,6 +469,7 @@
   "LabelNewestEpisodes": "最新剧集",
   "LabelNextBackupDate": "下次备份日期",
   "LabelNextScheduledRun": "下次任务运行",
+  "LabelNoApiKeys": "无 API 密钥",
   "LabelNoCustomMetadataProviders": "没有自定义元数据提供商",
   "LabelNoEpisodesSelected": "未选择任何剧集",
   "LabelNotFinished": "未听完",
@@ -482,7 +497,7 @@
   "LabelPermanent": "永久的",
   "LabelPermissionsAccessAllLibraries": "可以访问所有媒体库",
   "LabelPermissionsAccessAllTags": "可以访问所有标签",
-  "LabelPermissionsAccessExplicitContent": "可以访问显式内容",
+  "LabelPermissionsAccessExplicitContent": "可以访问成人内容",
   "LabelPermissionsCreateEreader": "可以创建电子阅读器",
   "LabelPermissionsDelete": "可以删除",
   "LabelPermissionsDownload": "可以下载",
@@ -544,6 +559,7 @@
   "LabelSelectAll": "全选",
   "LabelSelectAllEpisodes": "选择所有剧集",
   "LabelSelectEpisodesShowing": "选择正在播放的 {0} 剧集",
+  "LabelSelectUser": "选择用户",
   "LabelSelectUsers": "选择用户",
   "LabelSendEbookToDevice": "发送电子书到...",
   "LabelSequence": "序列",
@@ -610,15 +626,15 @@
   "LabelStart": "开始",
   "LabelStartTime": "开始时间",
   "LabelStarted": "开始于",
-  "LabelStartedAt": "从这开始",
+  "LabelStartedAt": "收听始于",
   "LabelStatsAudioTracks": "音轨",
   "LabelStatsAuthors": "作者",
-  "LabelStatsBestDay": "最好的一天",
+  "LabelStatsBestDay": "单日最高",
   "LabelStatsDailyAverage": "每日平均值",
-  "LabelStatsDays": "天",
+  "LabelStatsDays": "连续",
   "LabelStatsDaysListened": "收听天数",
   "LabelStatsHours": "小时",
-  "LabelStatsInARow": "在一行",
+  "LabelStatsInARow": "天",
   "LabelStatsItemsFinished": "已完成的项目",
   "LabelStatsItemsInLibrary": "媒体库中的项目",
   "LabelStatsMinutes": "分钟",
@@ -708,13 +724,15 @@
   "MessageAddToPlayerQueue": "添加到播放队列",
   "MessageAppriseDescription": "要使用此功能，你需要运行一个 <a href=\"https://github.com/caronc/apprise-api\" target=\"_blank\">Apprise API</a> 实例或一个可以处理这些相同请求的 API. <br />Apprise API Url 应该是发送通知的完整 URL 路径, 例如: 如果你的 API 实例运行在 <code>http://192.168.1.1:8337</code>, 那么你可以输入 <code>http://192.168.1.1:8337/notify</code>.",
   "MessageAsinCheck": "确保你使用的 ASIN 来自正确的 Audible 地区, 而不是亚马逊.",
+  "MessageAuthenticationLegacyTokenWarning": "旧版 API 令牌将来会被移除. 请改用 <a href=\"/config/api-keys\">API 密钥</a>.",
   "MessageAuthenticationOIDCChangesRestart": "保存后重新启动服务器以应用 OIDC 更改.",
+  "MessageAuthenticationSecurityMessage": "身份验证安全性已增强, 所有用户都需要重新登录.",
   "MessageBackupsDescription": "备份包括用户, 用户进度, 媒体库项目详细信息, 服务器设置和图像, 存储在 <code>/metadata/items</code> & <code>/metadata/authors</code>. 备份不包括存储在你的媒体库文件夹中的任何文件.",
   "MessageBackupsLocationEditNote": "注意: 更新备份位置不会移动或修改现有备份",
   "MessageBackupsLocationNoEditNote": "注意: 备份位置是通过环境变量设置的, 不能在此处更改.",
   "MessageBackupsLocationPathEmpty": "备份位置路径不能为空",
   "MessageBatchEditPopulateMapDetailsAllHelp": "使用所有项目的数据填充已启用的字段. 具有多个值的字段将被合并",
-  "MessageBatchEditPopulateMapDetailsItemHelp": "使用此项目的数据填充已启用的地图详细信息字段",
+  "MessageBatchEditPopulateMapDetailsItemHelp": "提取此项目的信息, 填入上方所有勾选的编辑框中",
   "MessageBatchQuickMatchDescription": "快速匹配将尝试为所选项目添加缺少的封面和元数据. 启用以下选项以允许快速匹配覆盖现有封面和或元数据.",
   "MessageBookshelfNoCollections": "你尚未进行任何收藏",
   "MessageBookshelfNoCollectionsHelp": "收藏是公开的. 所有有权访问图书馆的用户都可以看到它们.",
@@ -730,6 +748,7 @@
   "MessageChaptersNotFound": "未找到章节",
   "MessageCheckingCron": "检查计划任务...",
   "MessageConfirmCloseFeed": "你确定要关闭此订阅源吗?",
+  "MessageConfirmDeleteApiKey": "你确定要删除 API 密钥 \"{0}\" 吗?",
   "MessageConfirmDeleteBackup": "你确定要删除备份 {0}?",
   "MessageConfirmDeleteDevice": "你确定要删除电子阅读器设备 \"{0}\" 吗？",
   "MessageConfirmDeleteFile": "这将从文件系统中删除该文件. 你确定吗?",
@@ -757,6 +776,7 @@
   "MessageConfirmRemoveAuthor": "你确定要删除作者 \"{0}\"?",
   "MessageConfirmRemoveCollection": "你确定要移除收藏 \"{0}\"?",
   "MessageConfirmRemoveEpisode": "你确定要移除剧集 \"{0}\"?",
+  "MessageConfirmRemoveEpisodeNote": "注意: 此操作不会删除音频文件, 除非勾选 \"完全删除文件\" 选项",
   "MessageConfirmRemoveEpisodes": "你确定要移除 {0} 剧集?",
   "MessageConfirmRemoveListeningSessions": "你确定要移除 {0} 收听会话吗?",
   "MessageConfirmRemoveMetadataFiles": "你确实要删除库项目文件夹中的所有 metadata.{0} 文件吗?",
@@ -787,7 +807,7 @@
   "MessageInvalidAsin": "无效的 ASIN",
   "MessageItemsSelected": "已选定 {0} 个项目",
   "MessageItemsUpdated": "已更新 {0} 个项目",
-  "MessageJoinUsOn": "加入我们",
+  "MessageJoinUsOn": "加入我们的",
   "MessageLoading": "正在加载...",
   "MessageLoadingFolders": "加载文件夹...",
   "MessageLogsDescription": "日志以 JSON 文件形式存储在 <code>/metadata/logs</code> 目录中. 崩溃日志存储在 <code>/metadata/logs/crash_logs.txt</code> 目录中.",
@@ -848,12 +868,12 @@
   "MessageRemoveEpisodes": "移除 {0} 剧集",
   "MessageRemoveFromPlayerQueue": "从播放队列中移除",
   "MessageRemoveUserWarning": "是否确实要永久删除用户 \"{0}\"?",
-  "MessageReportBugsAndContribute": "报告错误、请求功能和贡献在",
+  "MessageReportBugsAndContribute": "反馈问题, 建议功能或参与贡献, 请访问",
   "MessageResetChaptersConfirm": "你确定要重置章节并撤消你所做的更改吗?",
   "MessageRestoreBackupConfirm": "你确定要恢复创建的这个备份",
   "MessageRestoreBackupWarning": "恢复备份将覆盖位于 /config 的整个数据库并覆盖 /metadata/items & /metadata/authors 中的图像.<br /><br />备份不会修改媒体库文件夹中的任何文件. 如果你已启用服务器设置将封面和元数据存储在库文件夹中，则不会备份或覆盖这些内容.<br /><br />将自动刷新使用服务器的所有客户端.",
   "MessageScheduleLibraryScanNote": "对于大多数用户, 建议禁用此功能并保持文件夹监视程序设置启用. 文件夹监视程序将自动检测库文件夹中的更改. 文件夹监视程序不适用于每个文件系统 (如 NFS), 因此可以使用计划库扫描.",
-  "MessageScheduleRunEveryWeekdayAtTime": "每隔 {0} 在 {1} 运行一次",
+  "MessageScheduleRunEveryWeekdayAtTime": "每 {0} 的 {1} 执行",
   "MessageSearchResultsFor": "搜索结果",
   "MessageSelected": "{0} 已选择",
   "MessageSeriesSequenceCannotContainSpaces": "系列序列不能包含空格",
@@ -917,7 +937,9 @@
   "NoteUploaderUnsupportedFiles": "不支持的文件将被忽略. 选择或删除文件夹时, 将忽略不在项目文件夹中的其他文件.",
   "NotificationOnBackupCompletedDescription": "备份完成时触发",
   "NotificationOnBackupFailedDescription": "备份失败时触发",
-  "NotificationOnEpisodeDownloadedDescription": "当播客节目自动下载时触发",
+  "NotificationOnEpisodeDownloadedDescription": "当播客节目自动下载完成时触发",
+  "NotificationOnRSSFeedDisabledDescription": "由于尝试失败次数过多而导致剧集自动下载被禁用时触发",
+  "NotificationOnRSSFeedFailedDescription": "当用于自动下载剧集的 RSS 源请求失败时触发",
   "NotificationOnTestDescription": "测试通知系统的事件",
   "PlaceholderNewCollection": "输入收藏夹名称",
   "PlaceholderNewFolderPath": "输入文件夹路径",
@@ -998,6 +1020,8 @@
   "ToastEpisodeDownloadQueueClearSuccess": "剧集下载队列已清空",
   "ToastEpisodeUpdateSuccess": "已更新 {0} 剧集",
   "ToastErrorCannotShare": "无法在此设备上本地共享",
+  "ToastFailedToCreate": "创建失败",
+  "ToastFailedToDelete": "删除失败",
   "ToastFailedToLoadData": "加载数据失败",
   "ToastFailedToMatch": "匹配失败",
   "ToastFailedToShare": "分享失败",
@@ -1029,6 +1053,7 @@
   "ToastMustHaveAtLeastOnePath": "必须至少有一个路径",
   "ToastNameEmailRequired": "姓名和电子邮件为必填项",
   "ToastNameRequired": "姓名为必填项",
+  "ToastNewApiKeyUserError": "必须选择一个用户",
   "ToastNewEpisodesFound": "找到 {0} 个新剧集",
   "ToastNewUserCreatedFailed": "无法创建帐户: \"{0}\"",
   "ToastNewUserCreatedSuccess": "已创建新帐户",
diff --git a/index.js b/index.js
index 2839c238..7379322e 100644
--- a/index.js
+++ b/index.js
@@ -4,7 +4,9 @@ const optionDefinitions = [
   { name: 'port', alias: 'p', type: String },
   { name: 'host', alias: 'h', type: String },
   { name: 'source', alias: 's', type: String },
-  { name: 'dev', alias: 'd', type: Boolean }
+  { name: 'dev', alias: 'd', type: Boolean },
+  // Run in production mode and use dev.js config
+  { name: 'prod-with-dev-env', alias: 'r', type: Boolean }
 ]
 
 const commandLineArgs = require('./server/libs/commandLineArgs')
@@ -17,7 +19,7 @@ const server = require('./server/Server')
 global.appRoot = __dirname
 
 const isDev = process.env.NODE_ENV !== 'production'
-if (isDev) {
+if (isDev || options['prod-with-dev-env']) {
   const devEnv = require('./dev').config
   if (devEnv.Port) process.env.PORT = devEnv.Port
   if (devEnv.ConfigPath) process.env.CONFIG_PATH = devEnv.ConfigPath
@@ -28,6 +30,7 @@ if (isDev) {
   if (devEnv.SkipBinariesCheck) process.env.SKIP_BINARIES_CHECK = '1'
   if (devEnv.AllowIframe) process.env.ALLOW_IFRAME = '1'
   if (devEnv.BackupPath) process.env.BACKUP_PATH = devEnv.BackupPath
+  if (devEnv.ReactClientPath) process.env.REACT_CLIENT_PATH = devEnv.ReactClientPath
   process.env.SOURCE = 'local'
   process.env.ROUTER_BASE_PATH = devEnv.RouterBasePath ?? '/audiobookshelf'
 }
diff --git a/package-lock.json b/package-lock.json
index a8074794..ac3b1f6a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,17 +1,18 @@
 {
   "name": "audiobookshelf",
-  "version": "2.24.0",
+  "version": "2.26.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "audiobookshelf",
-      "version": "2.24.0",
+      "version": "2.26.3",
       "license": "GPL-3.0",
       "dependencies": {
         "axios": "^0.27.2",
         "cookie-parser": "^1.4.6",
         "express": "^4.17.1",
+        "express-rate-limit": "^7.5.1",
         "express-session": "^1.17.3",
         "graceful-fs": "^4.2.10",
         "htmlparser2": "^8.0.1",
@@ -1893,6 +1894,21 @@
         "node": ">= 0.10.0"
       }
     },
+    "node_modules/express-rate-limit": {
+      "version": "7.5.1",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-7.5.1.tgz",
+      "integrity": "sha512-7iN8iPMDzOMHPUYllBEsQdWVB6fPDMPqwjBaFrgr4Jgr/+okjvzAy+UHlYYL/Vs0OsOrMkwS6PJDkFlJwoxUnw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/express-rate-limit"
+      },
+      "peerDependencies": {
+        "express": ">= 4.11"
+      }
+    },
     "node_modules/express-session": {
       "version": "1.17.3",
       "resolved": "https://registry.npmjs.org/express-session/-/express-session-1.17.3.tgz",
diff --git a/package.json b/package.json
index d4831736..87c052c2 100644
--- a/package.json
+++ b/package.json
@@ -1,12 +1,13 @@
 {
   "name": "audiobookshelf",
-  "version": "2.24.0",
+  "version": "2.26.3",
   "buildNumber": 1,
   "description": "Self-hosted audiobook and podcast server",
   "main": "index.js",
   "scripts": {
     "dev": "nodemon --watch server index.js -- --dev",
     "start": "node index.js",
+    "start-dev": "node index.js --prod-with-dev-env",
     "client": "cd client && npm ci && npm run generate",
     "prod": "npm run client && npm ci && node index.js",
     "build-win": "npm run client && pkg -t node20-win-x64 -o ./dist/win/audiobookshelf -C GZip .",
@@ -39,6 +40,7 @@
     "axios": "^0.27.2",
     "cookie-parser": "^1.4.6",
     "express": "^4.17.1",
+    "express-rate-limit": "^7.5.1",
     "express-session": "^1.17.3",
     "graceful-fs": "^4.2.10",
     "htmlparser2": "^8.0.1",
diff --git a/server/Auth.js b/server/Auth.js
index ba72947a..9c0e2fdb 100644
--- a/server/Auth.js
+++ b/server/Auth.js
@@ -1,15 +1,15 @@
-const axios = require('axios')
-const passport = require('passport')
 const { Request, Response, NextFunction } = require('express')
-const bcrypt = require('./libs/bcryptjs')
-const jwt = require('./libs/jsonwebtoken')
-const requestIp = require('./libs/requestIp')
-const LocalStrategy = require('./libs/passportLocal')
+const passport = require('passport')
 const JwtStrategy = require('passport-jwt').Strategy
 const ExtractJwt = require('passport-jwt').ExtractJwt
-const OpenIDClient = require('openid-client')
+
 const Database = require('./Database')
 const Logger = require('./Logger')
+const TokenManager = require('./auth/TokenManager')
+const LocalAuthStrategy = require('./auth/LocalAuthStrategy')
+const OidcAuthStrategy = require('./auth/OidcAuthStrategy')
+
+const RateLimiterFactory = require('./utils/rateLimiterFactory')
 const { escapeRegExp } = require('./utils')
 
 /**
@@ -17,22 +17,31 @@ const { escapeRegExp } = require('./utils')
  */
 class Auth {
   constructor() {
-    // Map of openId sessions indexed by oauth2 state-variable
-    this.openIdAuthSession = new Map()
     const escapedRouterBasePath = escapeRegExp(global.RouterBasePath)
     this.ignorePatterns = [new RegExp(`^(${escapedRouterBasePath}/api)?/items/[^/]+/cover$`), new RegExp(`^(${escapedRouterBasePath}/api)?/authors/[^/]+/image$`)]
+
+    /** @type {import('express-rate-limit').RateLimitRequestHandler} */
+    this.authRateLimiter = RateLimiterFactory.getAuthRateLimiter()
+
+    this.tokenManager = new TokenManager()
+    this.localAuthStrategy = new LocalAuthStrategy()
+    this.oidcAuthStrategy = new OidcAuthStrategy()
   }
 
   /**
    * Checks if the request should not be authenticated.
    * @param {Request} req
    * @returns {boolean}
-   * @private
    */
   authNotNeeded(req) {
     return req.method === 'GET' && this.ignorePatterns.some((pattern) => pattern.test(req.path))
   }
 
+  /**
+   * Middleware to register passport in express-session
+   *
+   * @param {function} middleware
+   */
   ifAuthNeeded(middleware) {
     return (req, res, next) => {
       if (this.authNotNeeded(req)) {
@@ -42,18 +51,72 @@ class Auth {
     }
   }
 
+  /**
+   * middleware to use in express to only allow authenticated users.
+   *
+   * @param {Request} req
+   * @param {Response} res
+   * @param {NextFunction} next
+   */
+  isAuthenticated(req, res, next) {
+    return passport.authenticate('jwt', { session: false })(req, res, next)
+  }
+
+  /**
+   * Function to generate a jwt token for a given user
+   * TODO: Old method with no expiration
+   * @deprecated
+   *
+   * @param {{ id:string, username:string }} user
+   * @returns {string}
+   */
+  generateAccessToken(user) {
+    return this.tokenManager.generateAccessToken(user)
+  }
+
+  /**
+   * Invalidate all JWT sessions for a given user
+   * If user is current user and refresh token is valid, rotate tokens for the current session
+   *
+   * @param {import('./models/User')} user
+   * @param {Request} req
+   * @param {Response} res
+   * @returns {Promise<string>} accessToken only if user is current user and refresh token is valid
+   */
+  async invalidateJwtSessionsForUser(user, req, res) {
+    return this.tokenManager.invalidateJwtSessionsForUser(user, req, res)
+  }
+
+  /**
+   * Return the login info payload for a user
+   *
+   * @param {import('./models/User')} user
+   * @returns {Promise<Object>} jsonPayload
+   */
+  async getUserLoginResponsePayload(user) {
+    const libraryIds = await Database.libraryModel.getAllLibraryIds()
+    return {
+      user: user.toOldJSONForBrowser(),
+      userDefaultLibraryId: user.getDefaultLibraryId(libraryIds),
+      serverSettings: Database.serverSettings.toJSONForBrowser(),
+      ereaderDevices: Database.emailSettings.getEReaderDevices(user),
+      Source: global.Source
+    }
+  }
+
+  // #region Passport strategies
   /**
    * Inializes all passportjs strategies and other passportjs ralated initialization.
    */
   async initPassportJs() {
     // Check if we should load the local strategy (username + password login)
     if (global.ServerSettings.authActiveAuthMethods.includes('local')) {
-      this.initAuthStrategyPassword()
+      this.localAuthStrategy.init()
     }
 
     // Check if we should load the openid strategy
     if (global.ServerSettings.authActiveAuthMethods.includes('openid')) {
-      this.initAuthStrategyOpenID()
+      this.oidcAuthStrategy.init()
     }
 
     // Load the JwtStrategy (always) -> for bearer token auth
@@ -61,9 +124,11 @@ class Auth {
       new JwtStrategy(
         {
           jwtFromRequest: ExtractJwt.fromExtractors([ExtractJwt.fromAuthHeaderAsBearerToken(), ExtractJwt.fromUrlQueryParameter('token')]),
-          secretOrKey: Database.serverSettings.tokenSecret
+          secretOrKey: TokenManager.TokenSecret,
+          // Handle expiration manaully in order to disable api keys that are expired
+          ignoreExpiration: true
         },
-        this.jwtAuthCheck.bind(this)
+        this.tokenManager.jwtAuthCheck.bind(this)
       )
     )
 
@@ -94,248 +159,7 @@ class Auth {
       }.bind(this)
     )
   }
-
-  /**
-   * Passport use LocalStrategy
-   */
-  initAuthStrategyPassword() {
-    passport.use(new LocalStrategy({ passReqToCallback: true }, this.localAuthCheckUserPw.bind(this)))
-  }
-
-  /**
-   * Passport use OpenIDClient.Strategy
-   */
-  initAuthStrategyOpenID() {
-    if (!Database.serverSettings.isOpenIDAuthSettingsValid) {
-      Logger.error(`[Auth] Cannot init openid auth strategy - invalid settings`)
-      return
-    }
-
-    // Custom req timeout see: https://github.com/panva/node-openid-client/blob/main/docs/README.md#customizing
-    OpenIDClient.custom.setHttpOptionsDefaults({ timeout: 10000 })
-
-    const openIdIssuerClient = new OpenIDClient.Issuer({
-      issuer: global.ServerSettings.authOpenIDIssuerURL,
-      authorization_endpoint: global.ServerSettings.authOpenIDAuthorizationURL,
-      token_endpoint: global.ServerSettings.authOpenIDTokenURL,
-      userinfo_endpoint: global.ServerSettings.authOpenIDUserInfoURL,
-      jwks_uri: global.ServerSettings.authOpenIDJwksURL,
-      end_session_endpoint: global.ServerSettings.authOpenIDLogoutURL
-    }).Client
-    const openIdClient = new openIdIssuerClient({
-      client_id: global.ServerSettings.authOpenIDClientID,
-      client_secret: global.ServerSettings.authOpenIDClientSecret,
-      id_token_signed_response_alg: global.ServerSettings.authOpenIDTokenSigningAlgorithm
-    })
-    passport.use(
-      'openid-client',
-      new OpenIDClient.Strategy(
-        {
-          client: openIdClient,
-          params: {
-            redirect_uri: `${global.ServerSettings.authOpenIDSubfolderForRedirectURLs}/auth/openid/callback`,
-            scope: 'openid profile email'
-          }
-        },
-        async (tokenset, userinfo, done) => {
-          try {
-            Logger.debug(`[Auth] openid callback userinfo=`, JSON.stringify(userinfo, null, 2))
-
-            if (!userinfo.sub) {
-              throw new Error('Invalid userinfo, no sub')
-            }
-
-            if (!this.validateGroupClaim(userinfo)) {
-              throw new Error(`Group claim ${Database.serverSettings.authOpenIDGroupClaim} not found or empty in userinfo`)
-            }
-
-            let user = await this.findOrCreateUser(userinfo)
-
-            if (!user?.isActive) {
-              throw new Error('User not active or not found')
-            }
-
-            await this.setUserGroup(user, userinfo)
-            await this.updateUserPermissions(user, userinfo)
-
-            // We also have to save the id_token for later (used for logout) because we cannot set cookies here
-            user.openid_id_token = tokenset.id_token
-
-            return done(null, user)
-          } catch (error) {
-            Logger.error(`[Auth] openid callback error: ${error?.message}\n${error?.stack}`)
-
-            return done(null, null, 'Unauthorized')
-          }
-        }
-      )
-    )
-  }
-
-  /**
-   * Finds an existing user by OpenID subject identifier, or by email/username based on server settings,
-   * or creates a new user if configured to do so.
-   *
-   * @returns {Promise<import('./models/User')|null>}
-   */
-  async findOrCreateUser(userinfo) {
-    let user = await Database.userModel.getUserByOpenIDSub(userinfo.sub)
-
-    // Matched by sub
-    if (user) {
-      Logger.debug(`[Auth] openid: User found by sub`)
-      return user
-    }
-
-    // Match existing user by email
-    if (Database.serverSettings.authOpenIDMatchExistingBy === 'email') {
-      if (userinfo.email) {
-        // Only disallow when email_verified explicitly set to false (allow both if not set or true)
-        if (userinfo.email_verified === false) {
-          Logger.warn(`[Auth] openid: User not found and email "${userinfo.email}" is not verified`)
-          return null
-        } else {
-          Logger.info(`[Auth] openid: User not found, checking existing with email "${userinfo.email}"`)
-          user = await Database.userModel.getUserByEmail(userinfo.email)
-
-          if (user?.authOpenIDSub) {
-            Logger.warn(`[Auth] openid: User found with email "${userinfo.email}" but is already matched with sub "${user.authOpenIDSub}"`)
-            return null // User is linked to a different OpenID subject; do not proceed.
-          }
-        }
-      } else {
-        Logger.warn(`[Auth] openid: User not found and no email in userinfo`)
-        // We deny login, because if the admin whishes to match email, it makes sense to require it
-        return null
-      }
-    }
-    // Match existing user by username
-    else if (Database.serverSettings.authOpenIDMatchExistingBy === 'username') {
-      let username
-
-      if (userinfo.preferred_username) {
-        Logger.info(`[Auth] openid: User not found, checking existing with userinfo.preferred_username "${userinfo.preferred_username}"`)
-        username = userinfo.preferred_username
-      } else if (userinfo.username) {
-        Logger.info(`[Auth] openid: User not found, checking existing with userinfo.username "${userinfo.username}"`)
-        username = userinfo.username
-      } else {
-        Logger.warn(`[Auth] openid: User not found and neither preferred_username nor username in userinfo`)
-        return null
-      }
-
-      user = await Database.userModel.getUserByUsername(username)
-
-      if (user?.authOpenIDSub) {
-        Logger.warn(`[Auth] openid: User found with username "${username}" but is already matched with sub "${user.authOpenIDSub}"`)
-        return null // User is linked to a different OpenID subject; do not proceed.
-      }
-    }
-
-    // Found existing user via email or username
-    if (user) {
-      if (!user.isActive) {
-        Logger.warn(`[Auth] openid: User found but is not active`)
-        return null
-      }
-
-      // Update user with OpenID sub
-      if (!user.extraData) user.extraData = {}
-      user.extraData.authOpenIDSub = userinfo.sub
-      user.changed('extraData', true)
-      await user.save()
-
-      Logger.debug(`[Auth] openid: User found by email/username`)
-      return user
-    }
-
-    // If no existing user was matched, auto-register if configured
-    if (Database.serverSettings.authOpenIDAutoRegister) {
-      Logger.info(`[Auth] openid: Auto-registering user with sub "${userinfo.sub}"`, userinfo)
-      user = await Database.userModel.createUserFromOpenIdUserInfo(userinfo, this)
-      return user
-    }
-
-    Logger.warn(`[Auth] openid: User not found and auto-register is disabled`)
-    return null
-  }
-
-  /**
-   * Validates the presence and content of the group claim in userinfo.
-   */
-  validateGroupClaim(userinfo) {
-    const groupClaimName = Database.serverSettings.authOpenIDGroupClaim
-    if (!groupClaimName)
-      // Allow no group claim when configured like this
-      return true
-
-    // If configured it must exist in userinfo
-    if (!userinfo[groupClaimName]) {
-      return false
-    }
-    return true
-  }
-
-  /**
-   * Sets the user group based on group claim in userinfo.
-   *
-   * @param {import('./models/User')} user
-   * @param {Object} userinfo
-   */
-  async setUserGroup(user, userinfo) {
-    const groupClaimName = Database.serverSettings.authOpenIDGroupClaim
-    if (!groupClaimName)
-      // No group claim configured, don't set anything
-      return
-
-    if (!userinfo[groupClaimName]) throw new Error(`Group claim ${groupClaimName} not found in userinfo`)
-
-    const groupsList = userinfo[groupClaimName].map((group) => group.toLowerCase())
-    const rolesInOrderOfPriority = ['admin', 'user', 'guest']
-
-    let userType = rolesInOrderOfPriority.find((role) => groupsList.includes(role))
-    if (userType) {
-      if (user.type === 'root') {
-        // Check OpenID Group
-        if (userType !== 'admin') {
-          throw new Error(`Root user "${user.username}" cannot be downgraded to ${userType}. Denying login.`)
-        } else {
-          // If root user is logging in via OpenID, we will not change the type
-          return
-        }
-      }
-
-      if (user.type !== userType) {
-        Logger.info(`[Auth] openid callback: Updating user "${user.username}" type to "${userType}" from "${user.type}"`)
-        user.type = userType
-        await user.save()
-      }
-    } else {
-      throw new Error(`No valid group found in userinfo: ${JSON.stringify(userinfo[groupClaimName], null, 2)}`)
-    }
-  }
-
-  /**
-   * Updates user permissions based on the advanced permissions claim.
-   *
-   * @param {import('./models/User')} user
-   * @param {Object} userinfo
-   */
-  async updateUserPermissions(user, userinfo) {
-    const absPermissionsClaim = Database.serverSettings.authOpenIDAdvancedPermsClaim
-    if (!absPermissionsClaim)
-      // No advanced permissions claim configured, don't set anything
-      return
-
-    if (user.type === 'admin' || user.type === 'root') return
-
-    const absPermissions = userinfo[absPermissionsClaim]
-    if (!absPermissions) throw new Error(`Advanced permissions claim ${absPermissionsClaim} not found in userinfo`)
-
-    if (await user.updatePermissionsFromExternalJSON(absPermissions)) {
-      Logger.info(`[Auth] openid callback: Updating advanced perms for user "${user.username}" using "${JSON.stringify(absPermissions)}"`)
-    }
-  }
+  // #endregion
 
   /**
    * Unuse strategy
@@ -343,7 +167,13 @@ class Auth {
    * @param {string} name
    */
   unuseAuthStrategy(name) {
-    passport.unuse(name)
+    if (name === 'openid') {
+      this.oidcAuthStrategy.unuse()
+    } else if (name === 'local') {
+      this.localAuthStrategy.unuse()
+    } else {
+      Logger.error('[Auth] Invalid auth strategy ' + name)
+    }
   }
 
   /**
@@ -353,9 +183,9 @@ class Auth {
    */
   useAuthStrategy(name) {
     if (name === 'openid') {
-      this.initAuthStrategyOpenID()
+      this.oidcAuthStrategy.init()
     } else if (name === 'local') {
-      this.initAuthStrategyPassword()
+      this.localAuthStrategy.init()
     } else {
       Logger.error('[Auth] Invalid auth strategy ' + name)
     }
@@ -414,25 +244,58 @@ class Auth {
    * @param {Response} res
    */
   async handleLoginSuccessBasedOnCookie(req, res) {
-    // get userLogin json (information about the user, server and the session)
-    const data_json = await this.getUserLoginResponsePayload(req.user)
+    // Handle token generation and get userResponse object
+    // For API based auth (e.g. mobile), we will return the refresh token in the response
+    const isApiBased = this.isAuthMethodAPIBased(req.cookies.auth_method)
+    const userResponse = await this.handleLoginSuccess(req, res, isApiBased)
 
-    if (this.isAuthMethodAPIBased(req.cookies.auth_method)) {
+    if (isApiBased) {
       // REST request - send data
-      res.json(data_json)
+      res.json(userResponse)
     } else {
       // UI request -> check if we have a callback url
       // TODO: do we want to somehow limit the values for auth_cb?
       if (req.cookies.auth_cb) {
         let stateQuery = req.cookies.auth_state ? `&state=${req.cookies.auth_state}` : ''
         // UI request -> redirect to auth_cb url and send the jwt token as parameter
-        res.redirect(302, `${req.cookies.auth_cb}?setToken=${data_json.user.token}${stateQuery}`)
+        // TODO: Temporarily continue sending the old token as setToken
+        res.redirect(302, `${req.cookies.auth_cb}?setToken=${userResponse.user.token}&accessToken=${userResponse.user.accessToken}${stateQuery}`)
       } else {
         res.status(400).send('No callback or already expired')
       }
     }
   }
 
+  /**
+   * After login success from local or oidc
+   * req.user is set by passport.authenticate
+   *
+   * attaches the access token to the user in the response
+   * if returnTokens is true, also attaches the refresh token to the user in the response
+   *
+   * if returnTokens is false, sets the refresh token cookie
+   *
+   * @param {Request} req
+   * @param {Response} res
+   * @param {boolean} returnTokens
+   */
+  async handleLoginSuccess(req, res, returnTokens = false) {
+    // Create tokens and session
+    const { accessToken, refreshToken } = await this.tokenManager.createTokensAndSession(req.user, req)
+
+    const userResponse = await this.getUserLoginResponsePayload(req.user)
+
+    userResponse.user.refreshToken = returnTokens ? refreshToken : null
+    userResponse.user.accessToken = accessToken
+
+    if (!returnTokens) {
+      this.tokenManager.setRefreshTokenCookie(req, res, refreshToken)
+    }
+
+    return userResponse
+  }
+
+  // #region Auth routes
   /**
    * Creates all (express) routes required for authentication.
    *
@@ -440,159 +303,68 @@ class Auth {
    */
   async initAuthRoutes(router) {
     // Local strategy login route (takes username and password)
-    router.post('/login', passport.authenticate('local'), async (req, res) => {
-      // return the user login response json if the login was successfull
-      res.json(await this.getUserLoginResponsePayload(req.user))
+    router.post('/login', this.authRateLimiter, passport.authenticate('local'), async (req, res) => {
+      // Check if mobile app wants refresh token in response
+      const returnTokens = req.headers['x-return-tokens'] === 'true'
+
+      const userResponse = await this.handleLoginSuccess(req, res, returnTokens)
+      res.json(userResponse)
+    })
+
+    // Refresh token route
+    router.post('/auth/refresh', this.authRateLimiter, async (req, res) => {
+      let refreshToken = req.cookies.refresh_token
+
+      // If x-refresh-token header is present, use it instead of the cookie
+      // and return the refresh token in the response
+      let shouldReturnRefreshToken = false
+      if (req.headers['x-refresh-token']) {
+        refreshToken = req.headers['x-refresh-token']
+        shouldReturnRefreshToken = true
+      }
+
+      if (!refreshToken) {
+        Logger.error(`[Auth] Failed to refresh token. No refresh token provided`)
+        return res.status(401).json({ error: 'No refresh token provided' })
+      }
+
+      Logger.debug(`[Auth] refreshing token. shouldReturnRefreshToken: ${shouldReturnRefreshToken}`)
+
+      const refreshResponse = await this.tokenManager.handleRefreshToken(refreshToken, req, res)
+      if (refreshResponse.error) {
+        return res.status(401).json({ error: refreshResponse.error })
+      }
+
+      const userResponse = await this.getUserLoginResponsePayload(refreshResponse.user)
+
+      userResponse.user.accessToken = refreshResponse.accessToken
+      userResponse.user.refreshToken = shouldReturnRefreshToken ? refreshResponse.refreshToken : null
+      res.json(userResponse)
     })
 
     // openid strategy login route (this redirects to the configured openid login provider)
-    router.get('/auth/openid', (req, res, next) => {
-      // Get the OIDC client from the strategy
-      // We need to call the client manually, because the strategy does not support forwarding the code challenge
-      //    for API or mobile clients
-      const oidcStrategy = passport._strategy('openid-client')
-      const client = oidcStrategy._client
-      const sessionKey = oidcStrategy._key
+    router.get('/auth/openid', this.authRateLimiter, (req, res) => {
+      const authorizationUrlResponse = this.oidcAuthStrategy.getAuthorizationUrl(req)
 
-      try {
-        const protocol = req.secure || req.get('x-forwarded-proto') === 'https' ? 'https' : 'http'
-        const hostUrl = new URL(`${protocol}://${req.get('host')}`)
-        const isMobileFlow = req.query.response_type === 'code' || req.query.redirect_uri || req.query.code_challenge
-
-        // Only allow code flow (for mobile clients)
-        if (req.query.response_type && req.query.response_type !== 'code') {
-          Logger.debug(`[Auth] OIDC Invalid response_type=${req.query.response_type}`)
-          return res.status(400).send('Invalid response_type, only code supported')
-        }
-
-        // Generate a state on web flow or if no state supplied
-        const state = !isMobileFlow || !req.query.state ? OpenIDClient.generators.random() : req.query.state
-
-        // Redirect URL for the SSO provider
-        let redirectUri
-        if (isMobileFlow) {
-          // Mobile required redirect uri
-          // If it is in the whitelist, we will save into this.openIdAuthSession and set the redirect uri to /auth/openid/mobile-redirect
-          //    where we will handle the redirect to it
-          if (!req.query.redirect_uri || !isValidRedirectUri(req.query.redirect_uri)) {
-            Logger.debug(`[Auth] Invalid redirect_uri=${req.query.redirect_uri}`)
-            return res.status(400).send('Invalid redirect_uri')
-          }
-          // We cannot save the supplied redirect_uri in the session, because it the mobile client uses browser instead of the API
-          //   for the request to mobile-redirect and as such the session is not shared
-          this.openIdAuthSession.set(state, { mobile_redirect_uri: req.query.redirect_uri })
-
-          redirectUri = new URL(`${global.ServerSettings.authOpenIDSubfolderForRedirectURLs}/auth/openid/mobile-redirect`, hostUrl).toString()
-        } else {
-          redirectUri = new URL(`${global.ServerSettings.authOpenIDSubfolderForRedirectURLs}/auth/openid/callback`, hostUrl).toString()
-
-          if (req.query.state) {
-            Logger.debug(`[Auth] Invalid state - not allowed on web openid flow`)
-            return res.status(400).send('Invalid state, not allowed on web flow')
-          }
-        }
-        oidcStrategy._params.redirect_uri = redirectUri
-        Logger.debug(`[Auth] OIDC redirect_uri=${redirectUri}`)
-
-        let { code_challenge, code_challenge_method, code_verifier } = generatePkce(req, isMobileFlow)
-
-        req.session[sessionKey] = {
-          ...req.session[sessionKey],
-          state: state,
-          max_age: oidcStrategy._params.max_age,
-          response_type: 'code',
-          code_verifier: code_verifier, // not null if web flow
-          mobile: req.query.redirect_uri, // Used in the abs callback later, set mobile if redirect_uri is filled out
-          sso_redirect_uri: oidcStrategy._params.redirect_uri // Save the redirect_uri (for the SSO Provider) for the callback
-        }
-
-        var scope = 'openid profile email'
-        if (global.ServerSettings.authOpenIDGroupClaim) {
-          scope += ' ' + global.ServerSettings.authOpenIDGroupClaim
-        }
-        if (global.ServerSettings.authOpenIDAdvancedPermsClaim) {
-          scope += ' ' + global.ServerSettings.authOpenIDAdvancedPermsClaim
-        }
-
-        const authorizationUrl = client.authorizationUrl({
-          ...oidcStrategy._params,
-          state: state,
-          response_type: 'code',
-          scope: scope,
-          code_challenge,
-          code_challenge_method
-        })
-
-        this.paramsToCookies(req, res, isMobileFlow ? 'openid-mobile' : 'openid')
-
-        res.redirect(authorizationUrl)
-      } catch (error) {
-        Logger.error(`[Auth] Error in /auth/openid route: ${error}\n${error?.stack}`)
-        res.status(500).send('Internal Server Error')
+      if (authorizationUrlResponse.error) {
+        return res.status(authorizationUrlResponse.status).send(authorizationUrlResponse.error)
       }
 
-      function generatePkce(req, isMobileFlow) {
-        if (isMobileFlow) {
-          if (!req.query.code_challenge) {
-            throw new Error('code_challenge required for mobile flow (PKCE)')
-          }
-          if (req.query.code_challenge_method && req.query.code_challenge_method !== 'S256') {
-            throw new Error('Only S256 code_challenge_method method supported')
-          }
-          return {
-            code_challenge: req.query.code_challenge,
-            code_challenge_method: req.query.code_challenge_method || 'S256'
-          }
-        } else {
-          const code_verifier = OpenIDClient.generators.codeVerifier()
-          const code_challenge = OpenIDClient.generators.codeChallenge(code_verifier)
-          return { code_challenge, code_challenge_method: 'S256', code_verifier }
-        }
-      }
+      this.paramsToCookies(req, res, authorizationUrlResponse.isMobileFlow ? 'openid-mobile' : 'openid')
 
-      function isValidRedirectUri(uri) {
-        // Check if the redirect_uri is in the whitelist
-        return Database.serverSettings.authOpenIDMobileRedirectURIs.includes(uri) || (Database.serverSettings.authOpenIDMobileRedirectURIs.length === 1 && Database.serverSettings.authOpenIDMobileRedirectURIs[0] === '*')
-      }
+      res.redirect(authorizationUrlResponse.authorizationUrl)
     })
 
     // This will be the oauth2 callback route for mobile clients
     // It will redirect to an app-link like audiobookshelf://oauth
-    router.get('/auth/openid/mobile-redirect', (req, res) => {
-      try {
-        // Extract the state parameter from the request
-        const { state, code } = req.query
-
-        // Check if the state provided is in our list
-        if (!state || !this.openIdAuthSession.has(state)) {
-          Logger.error('[Auth] /auth/openid/mobile-redirect route: State parameter mismatch')
-          return res.status(400).send('State parameter mismatch')
-        }
-
-        let mobile_redirect_uri = this.openIdAuthSession.get(state).mobile_redirect_uri
-
-        if (!mobile_redirect_uri) {
-          Logger.error('[Auth] No redirect URI')
-          return res.status(400).send('No redirect URI')
-        }
-
-        this.openIdAuthSession.delete(state)
-
-        const redirectUri = `${mobile_redirect_uri}?code=${encodeURIComponent(code)}&state=${encodeURIComponent(state)}`
-        // Redirect to the overwrite URI saved in the map
-        res.redirect(redirectUri)
-      } catch (error) {
-        Logger.error(`[Auth] Error in /auth/openid/mobile-redirect route: ${error}\n${error?.stack}`)
-        res.status(500).send('Internal Server Error')
-      }
-    })
+    router.get('/auth/openid/mobile-redirect', this.authRateLimiter, (req, res) => this.oidcAuthStrategy.handleMobileRedirect(req, res))
 
     // openid strategy callback route (this receives the token from the configured openid login provider)
     router.get(
       '/auth/openid/callback',
+      this.authRateLimiter,
       (req, res, next) => {
-        const oidcStrategy = passport._strategy('openid-client')
-        const sessionKey = oidcStrategy._key
+        const sessionKey = this.oidcAuthStrategy.getStrategy()._key
 
         if (!req.session[sessionKey]) {
           return res.status(400).send('No session')
@@ -663,54 +435,41 @@ class Auth {
      *
      * @example /auth/openid/config?issuer=http://192.168.1.66:9000/application/o/audiobookshelf/
      */
-    router.get('/auth/openid/config', this.isAuthenticated, async (req, res) => {
+    router.get('/auth/openid/config', this.authRateLimiter, this.isAuthenticated, async (req, res) => {
       if (!req.user.isAdminOrUp) {
         Logger.error(`[Auth] Non-admin user "${req.user.username}" attempted to get issuer config`)
         return res.sendStatus(403)
       }
 
-      if (!req.query.issuer) {
+      if (!req.query.issuer || typeof req.query.issuer !== 'string') {
         return res.status(400).send("Invalid request. Query param 'issuer' is required")
       }
 
-      // Strip trailing slash
-      let issuerUrl = req.query.issuer
-      if (issuerUrl.endsWith('/')) issuerUrl = issuerUrl.slice(0, -1)
-
-      // Append config pathname and validate URL
-      let configUrl = null
-      try {
-        configUrl = new URL(`${issuerUrl}/.well-known/openid-configuration`)
-        if (!configUrl.pathname.endsWith('/.well-known/openid-configuration')) {
-          throw new Error('Invalid pathname')
-        }
-      } catch (error) {
-        Logger.error(`[Auth] Failed to get openid configuration. Invalid URL "${configUrl}"`, error)
-        return res.status(400).send("Invalid request. Query param 'issuer' is invalid")
+      const openIdIssuerConfig = await this.oidcAuthStrategy.getIssuerConfig(req.query.issuer)
+      if (openIdIssuerConfig.error) {
+        return res.status(openIdIssuerConfig.status).send(openIdIssuerConfig.error)
       }
 
-      axios
-        .get(configUrl.toString())
-        .then(({ data }) => {
-          res.json({
-            issuer: data.issuer,
-            authorization_endpoint: data.authorization_endpoint,
-            token_endpoint: data.token_endpoint,
-            userinfo_endpoint: data.userinfo_endpoint,
-            end_session_endpoint: data.end_session_endpoint,
-            jwks_uri: data.jwks_uri,
-            id_token_signing_alg_values_supported: data.id_token_signing_alg_values_supported
-          })
-        })
-        .catch((error) => {
-          Logger.error(`[Auth] Failed to get openid configuration at "${configUrl}"`, error)
-          res.status(error.statusCode || 400).send(`${error.code || 'UNKNOWN'}: Failed to get openid configuration`)
-        })
+      res.json(openIdIssuerConfig)
     })
 
     // Logout route
-    router.post('/logout', (req, res) => {
-      // TODO: invalidate possible JWTs
+    router.post('/logout', async (req, res) => {
+      // Refresh token be alternatively be sent in the header
+      const refreshToken = req.cookies.refresh_token || req.headers['x-refresh-token']
+
+      // Clear refresh token cookie
+      res.clearCookie('refresh_token', {
+        path: '/'
+      })
+
+      // Invalidate the session in database using refresh token
+      if (refreshToken) {
+        await this.tokenManager.invalidateRefreshToken(refreshToken)
+      } else {
+        Logger.info(`[Auth] logout: No refresh token on request`)
+      }
+
       req.logout((err) => {
         if (err) {
           res.sendStatus(500)
@@ -722,36 +481,7 @@ class Auth {
           let logoutUrl = null
 
           if (authMethod === 'openid' || authMethod === 'openid-mobile') {
-            // If we are using openid, we need to redirect to the logout endpoint
-            // node-openid-client does not support doing it over passport
-            const oidcStrategy = passport._strategy('openid-client')
-            const client = oidcStrategy._client
-
-            if (client.issuer.end_session_endpoint && client.issuer.end_session_endpoint.length > 0) {
-              let postLogoutRedirectUri = null
-
-              if (authMethod === 'openid') {
-                const protocol = req.secure || req.get('x-forwarded-proto') === 'https' ? 'https' : 'http'
-                const host = req.get('host')
-                // TODO: ABS does currently not support subfolders for installation
-                // If we want to support it we need to include a config for the serverurl
-                postLogoutRedirectUri = `${protocol}://${host}${global.RouterBasePath}/login`
-              }
-              // else for openid-mobile we keep postLogoutRedirectUri on null
-              //  nice would be to redirect to the app here, but for example Authentik does not implement
-              //  the post_logout_redirect_uri parameter at all and for other providers
-              //  we would also need again to implement (and even before get to know somehow for 3rd party apps)
-              //  the correct app link like audiobookshelf://login (and maybe also provide a redirect like mobile-redirect).
-              //   Instead because its null (and this way the parameter will be omitted completly), the client/app can simply append something like
-              //  &post_logout_redirect_uri=audiobookshelf://login to the received logout url by itself which is the simplest solution
-              //   (The URL needs to be whitelisted in the config of the SSO/ID provider)
-
-              logoutUrl = client.endSessionUrl({
-                id_token_hint: req.cookies.openid_id_token,
-                post_logout_redirect_uri: postLogoutRedirectUri
-              })
-            }
-
+            logoutUrl = this.oidcAuthStrategy.getEndSessionUrl(req, req.cookies.openid_id_token, authMethod)
             res.clearCookie('openid_id_token')
           }
 
@@ -762,249 +492,7 @@ class Auth {
       })
     })
   }
-
-  /**
-   * middleware to use in express to only allow authenticated users.
-   * @param {Request} req
-   * @param {Response} res
-   * @param {NextFunction} next
-   */
-  isAuthenticated(req, res, next) {
-    // check if session cookie says that we are authenticated
-    if (req.isAuthenticated()) {
-      next()
-    } else {
-      // try JWT to authenticate
-      passport.authenticate('jwt')(req, res, next)
-    }
-  }
-
-  /**
-   * Function to generate a jwt token for a given user
-   *
-   * @param {{ id:string, username:string }} user
-   * @returns {string} token
-   */
-  generateAccessToken(user) {
-    return jwt.sign({ userId: user.id, username: user.username }, global.ServerSettings.tokenSecret)
-  }
-
-  /**
-   * Function to validate a jwt token for a given user
-   *
-   * @param {string} token
-   * @returns {Object} tokens data
-   */
-  static validateAccessToken(token) {
-    try {
-      return jwt.verify(token, global.ServerSettings.tokenSecret)
-    } catch (err) {
-      return null
-    }
-  }
-
-  /**
-   * Generate a token which is used to encrpt/protect the jwts.
-   */
-  async initTokenSecret() {
-    if (process.env.TOKEN_SECRET) {
-      // User can supply their own token secret
-      Database.serverSettings.tokenSecret = process.env.TOKEN_SECRET
-    } else {
-      Database.serverSettings.tokenSecret = require('crypto').randomBytes(256).toString('base64')
-    }
-    await Database.updateServerSettings()
-
-    // New token secret creation added in v2.1.0 so generate new API tokens for each user
-    const users = await Database.userModel.findAll({
-      attributes: ['id', 'username', 'token']
-    })
-    if (users.length) {
-      for (const user of users) {
-        user.token = await this.generateAccessToken(user)
-        await user.save({ hooks: false })
-      }
-    }
-  }
-
-  /**
-   * Checks if the user in the validated jwt_payload really exists and is active.
-   * @param {Object} jwt_payload
-   * @param {function} done
-   */
-  async jwtAuthCheck(jwt_payload, done) {
-    // load user by id from the jwt token
-    const user = await Database.userModel.getUserByIdOrOldId(jwt_payload.userId)
-
-    if (!user?.isActive) {
-      // deny login
-      done(null, null)
-      return
-    }
-    // approve login
-    done(null, user)
-    return
-  }
-
-  /**
-   * Checks if a username and password tuple is valid and the user active.
-   * @param {Request} req
-   * @param {string} username
-   * @param {string} password
-   * @param {Promise<function>} done
-   */
-  async localAuthCheckUserPw(req, username, password, done) {
-    // Load the user given it's username
-    const user = await Database.userModel.getUserByUsername(username.toLowerCase())
-
-    if (!user?.isActive) {
-      if (user) {
-        this.logFailedLocalAuthLoginAttempt(req, user.username, 'User is not active')
-      } else {
-        this.logFailedLocalAuthLoginAttempt(req, username, 'User not found')
-      }
-      done(null, null)
-      return
-    }
-
-    // Check passwordless root user
-    if (user.type === 'root' && !user.pash) {
-      if (password) {
-        // deny login
-        this.logFailedLocalAuthLoginAttempt(req, user.username, 'Root user has no password set')
-        done(null, null)
-        return
-      }
-      // approve login
-      Logger.info(`[Auth] User "${user.username}" logged in from ip ${requestIp.getClientIp(req)}`)
-      done(null, user)
-      return
-    } else if (!user.pash) {
-      this.logFailedLocalAuthLoginAttempt(req, user.username, 'User has no password set. Might have been created with OpenID')
-      done(null, null)
-      return
-    }
-
-    // Check password match
-    const compare = await bcrypt.compare(password, user.pash)
-    if (compare) {
-      // approve login
-      Logger.info(`[Auth] User "${user.username}" logged in from ip ${requestIp.getClientIp(req)}`)
-      done(null, user)
-      return
-    }
-    // deny login
-    this.logFailedLocalAuthLoginAttempt(req, user.username, 'Invalid password')
-    done(null, null)
-    return
-  }
-
-  /**
-   *
-   * @param {Request} req
-   * @param {string} username
-   * @param {string} message
-   */
-  logFailedLocalAuthLoginAttempt(req, username, message) {
-    if (!req || !username || !message) return
-    Logger.error(`[Auth] Failed login attempt for username "${username}" from ip ${requestIp.getClientIp(req)} (${message})`)
-  }
-
-  /**
-   * Hashes a password with bcrypt.
-   * @param {string} password
-   * @returns {Promise<string>} hash
-   */
-  hashPass(password) {
-    return new Promise((resolve) => {
-      bcrypt.hash(password, 8, (err, hash) => {
-        if (err) {
-          resolve(null)
-        } else {
-          resolve(hash)
-        }
-      })
-    })
-  }
-
-  /**
-   * Return the login info payload for a user
-   *
-   * @param {import('./models/User')} user
-   * @returns {Promise<Object>} jsonPayload
-   */
-  async getUserLoginResponsePayload(user) {
-    const libraryIds = await Database.libraryModel.getAllLibraryIds()
-    return {
-      user: user.toOldJSONForBrowser(),
-      userDefaultLibraryId: user.getDefaultLibraryId(libraryIds),
-      serverSettings: Database.serverSettings.toJSONForBrowser(),
-      ereaderDevices: Database.emailSettings.getEReaderDevices(user),
-      Source: global.Source
-    }
-  }
-
-  /**
-   *
-   * @param {string} password
-   * @param {import('./models/User')} user
-   * @returns {Promise<boolean>}
-   */
-  comparePassword(password, user) {
-    if (user.type === 'root' && !password && !user.pash) return true
-    if (!password || !user.pash) return false
-    return bcrypt.compare(password, user.pash)
-  }
-
-  /**
-   * User changes their password from request
-   * TODO: Update responses to use error status codes
-   *
-   * @param {import('./controllers/MeController').RequestWithUser} req
-   * @param {Response} res
-   */
-  async userChangePassword(req, res) {
-    let { password, newPassword } = req.body
-    newPassword = newPassword || ''
-    const matchingUser = req.user
-
-    // Only root can have an empty password
-    if (matchingUser.type !== 'root' && !newPassword) {
-      return res.json({
-        error: 'Invalid new password - Only root can have an empty password'
-      })
-    }
-
-    // Check password match
-    const compare = await this.comparePassword(password, matchingUser)
-    if (!compare) {
-      return res.json({
-        error: 'Invalid password'
-      })
-    }
-
-    let pw = ''
-    if (newPassword) {
-      pw = await this.hashPass(newPassword)
-      if (!pw) {
-        return res.json({
-          error: 'Hash failed'
-        })
-      }
-    }
-    try {
-      await matchingUser.update({ pash: pw })
-      Logger.info(`[Auth] User "${matchingUser.username}" changed password`)
-      res.json({
-        success: true
-      })
-    } catch (error) {
-      Logger.error(`[Auth] User "${matchingUser.username}" failed to change password`, error)
-      res.json({
-        error: 'Unknown error'
-      })
-    }
-  }
+  // #endregion
 }
 
 module.exports = Auth
diff --git a/server/Database.js b/server/Database.js
index 52827e3f..213c2c61 100644
--- a/server/Database.js
+++ b/server/Database.js
@@ -42,6 +42,16 @@ class Database {
     return this.models.user
   }
 
+  /** @type {typeof import('./models/Session')} */
+  get sessionModel() {
+    return this.models.session
+  }
+
+  /** @type {typeof import('./models/ApiKey')} */
+  get apiKeyModel() {
+    return this.models.apiKey
+  }
+
   /** @type {typeof import('./models/Library')} */
   get libraryModel() {
     return this.models.library
@@ -311,6 +321,8 @@ class Database {
 
   buildModels(force = false) {
     require('./models/User').init(this.sequelize)
+    require('./models/Session').init(this.sequelize)
+    require('./models/ApiKey').init(this.sequelize)
     require('./models/Library').init(this.sequelize)
     require('./models/LibraryFolder').init(this.sequelize)
     require('./models/Book').init(this.sequelize)
@@ -656,6 +668,9 @@ class Database {
    * Series should have atleast one Book
    * Book and Podcast must have an associated LibraryItem (and vice versa)
    * Remove playback sessions that are 3 seconds or less
+   * Remove duplicate mediaProgresses
+   * Remove expired auth sessions
+   * Deactivate expired api keys
    */
   async cleanDatabase() {
     // Remove invalid Podcast records
@@ -765,6 +780,60 @@ class Database {
     if (badSessionsRemoved > 0) {
       Logger.warn(`Removed ${badSessionsRemoved} sessions that were 3 seconds or less`)
     }
+
+    // Remove mediaProgresses with duplicate mediaItemId (remove the oldest updatedAt or if updatedAt is the same, remove arbitrary one)
+    const [duplicateMediaProgresses] = await this.sequelize.query(`SELECT mp1.id, mp1.mediaItemId
+FROM mediaProgresses mp1
+WHERE EXISTS (
+    SELECT 1
+    FROM mediaProgresses mp2
+    WHERE mp2.mediaItemId = mp1.mediaItemId
+    AND mp2.userId = mp1.userId
+    AND (
+        mp2.updatedAt > mp1.updatedAt
+        OR (mp2.updatedAt = mp1.updatedAt AND mp2.id < mp1.id)
+    )
+)`)
+    for (const duplicateMediaProgress of duplicateMediaProgresses) {
+      Logger.warn(`Found duplicate mediaProgress for mediaItem "${duplicateMediaProgress.mediaItemId}" - removing it`)
+      await this.mediaProgressModel.destroy({
+        where: { id: duplicateMediaProgress.id }
+      })
+    }
+
+    // Remove expired Session records
+    await this.cleanupExpiredSessions()
+
+    // Deactivate expired api keys
+    await this.deactivateExpiredApiKeys()
+  }
+
+  /**
+   * Deactivate expired api keys
+   */
+  async deactivateExpiredApiKeys() {
+    try {
+      const affectedCount = await this.apiKeyModel.deactivateExpiredApiKeys()
+      if (affectedCount > 0) {
+        Logger.info(`[Database] Deactivated ${affectedCount} expired api keys`)
+      }
+    } catch (error) {
+      Logger.error(`[Database] Error deactivating expired api keys: ${error.message}`)
+    }
+  }
+
+  /**
+   * Clean up expired sessions from the database
+   */
+  async cleanupExpiredSessions() {
+    try {
+      const deletedCount = await this.sessionModel.cleanupExpiredSessions()
+      if (deletedCount > 0) {
+        Logger.info(`[Database] Cleaned up ${deletedCount} expired sessions`)
+      }
+    } catch (error) {
+      Logger.error(`[Database] Error cleaning up expired sessions: ${error.message}`)
+    }
   }
 
   async createTextSearchQuery(query) {
diff --git a/server/Server.js b/server/Server.js
index 5c6f3c16..1a8db406 100644
--- a/server/Server.js
+++ b/server/Server.js
@@ -156,14 +156,11 @@ class Server {
     }
 
     await Database.init(false)
+    // Create or set JWT secret in token manager
+    await this.auth.tokenManager.initTokenSecret()
 
     await Logger.logManager.init()
 
-    // Create token secret if does not exist (Added v2.1.0)
-    if (!Database.serverSettings.tokenSecret) {
-      await this.auth.initTokenSecret()
-    }
-
     await this.cleanUserData() // Remove invalid user item progress
     await CacheManager.ensureCachePaths()
 
@@ -220,6 +217,7 @@ class Server {
 
   async start() {
     Logger.info('=== Starting Server ===')
+
     this.initProcessEventListeners()
     await this.init()
 
@@ -242,7 +240,7 @@ class Server {
        * Running in development allows cors to allow testing the mobile apps in the browser
        * or env variable ALLOW_CORS = '1'
        */
-      if (Logger.isDev || req.path.match(/\/api\/items\/([a-z0-9-]{36})\/(ebook|cover)(\/[0-9]+)?/)) {
+      if (global.AllowCors || Logger.isDev || req.path.match(/\/api\/items\/([a-z0-9-]{36})\/(ebook|cover)(\/[0-9]+)?/)) {
         const allowedOrigins = ['capacitor://localhost', 'http://localhost']
         if (global.AllowCors || Logger.isDev || allowedOrigins.some((o) => o === req.get('origin'))) {
           res.header('Access-Control-Allow-Origin', req.get('origin'))
@@ -263,7 +261,7 @@ class Server {
     // enable express-session
     app.use(
       expressSession({
-        secret: global.ServerSettings.tokenSecret,
+        secret: this.auth.tokenManager.TokenSecret,
         resave: false,
         saveUninitialized: false,
         cookie: {
@@ -281,6 +279,7 @@ class Server {
     await this.auth.initPassportJs()
 
     const router = express.Router()
+
     // if RouterBasePath is set, modify all requests to include the base path
     app.use((req, res, next) => {
       const urlStartsWithRouterBasePath = req.url.startsWith(global.RouterBasePath)
@@ -307,16 +306,14 @@ class Server {
       })
     )
     router.use(express.urlencoded({ extended: true, limit: '5mb' }))
-    router.use(express.json({ limit: '10mb' }))
+
+    // Skip JSON parsing for internal-api routes
+    router.use(/^(?!\/internal-api).*/, express.json({ limit: '10mb' }))
 
     router.use('/api', this.auth.ifAuthNeeded(this.authMiddleware.bind(this)), this.apiRouter.router)
     router.use('/hls', this.hlsRouter.router)
     router.use('/public', this.publicRouter.router)
 
-    // Static path to generated nuxt
-    const distPath = Path.join(global.appRoot, '/client/dist')
-    router.use(express.static(distPath))
-
     // Static folder
     router.use(express.static(Path.join(global.appRoot, 'static')))
 
@@ -336,32 +333,6 @@ class Server {
     // Auth routes
     await this.auth.initAuthRoutes(router)
 
-    // Client dynamic routes
-    const dynamicRoutes = [
-      '/item/:id',
-      '/author/:id',
-      '/audiobook/:id/chapters',
-      '/audiobook/:id/edit',
-      '/audiobook/:id/manage',
-      '/library/:library',
-      '/library/:library/search',
-      '/library/:library/bookshelf/:id?',
-      '/library/:library/authors',
-      '/library/:library/narrators',
-      '/library/:library/stats',
-      '/library/:library/series/:id?',
-      '/library/:library/podcast/search',
-      '/library/:library/podcast/latest',
-      '/library/:library/podcast/download-queue',
-      '/config/users/:id',
-      '/config/users/:id/sessions',
-      '/config/item-metadata-utils/:id',
-      '/collection/:id',
-      '/playlist/:id',
-      '/share/:slug'
-    ]
-    dynamicRoutes.forEach((route) => router.get(route, (req, res) => res.sendFile(Path.join(distPath, 'index.html'))))
-
     router.post('/init', (req, res) => {
       if (Database.hasRootUser) {
         Logger.error(`[Server] attempt to init server when server already has a root user`)
@@ -392,6 +363,49 @@ class Server {
     })
     router.get('/healthcheck', (req, res) => res.sendStatus(200))
 
+    const ReactClientPath = process.env.REACT_CLIENT_PATH
+    if (!ReactClientPath) {
+      // Static path to generated nuxt
+      const distPath = Path.join(global.appRoot, '/client/dist')
+      router.use(express.static(distPath))
+
+      // Client dynamic routes
+      const dynamicRoutes = [
+        '/item/:id',
+        '/author/:id',
+        '/audiobook/:id/chapters',
+        '/audiobook/:id/edit',
+        '/audiobook/:id/manage',
+        '/library/:library',
+        '/library/:library/search',
+        '/library/:library/bookshelf/:id?',
+        '/library/:library/authors',
+        '/library/:library/narrators',
+        '/library/:library/stats',
+        '/library/:library/series/:id?',
+        '/library/:library/podcast/search',
+        '/library/:library/podcast/latest',
+        '/library/:library/podcast/download-queue',
+        '/config/users/:id',
+        '/config/users/:id/sessions',
+        '/config/item-metadata-utils/:id',
+        '/collection/:id',
+        '/playlist/:id',
+        '/share/:slug'
+      ]
+      dynamicRoutes.forEach((route) => router.get(route, (req, res) => res.sendFile(Path.join(distPath, 'index.html'))))
+    } else {
+      // This is for using the experimental Next.js client
+      Logger.info(`Using React client at ${ReactClientPath}`)
+      const nextPath = Path.join(ReactClientPath, 'node_modules/next')
+      const next = require(nextPath)
+      const nextApp = next({ dev: Logger.isDev, dir: ReactClientPath })
+      const handle = nextApp.getRequestHandler()
+      await nextApp.prepare()
+      router.get('*', (req, res) => handle(req, res))
+      router.post('/internal-api/*', (req, res) => handle(req, res))
+    }
+
     const unixSocketPrefix = 'unix/'
     if (this.Host?.startsWith(unixSocketPrefix)) {
       const sockPath = this.Host.slice(unixSocketPrefix.length)
@@ -414,7 +428,7 @@ class Server {
     Logger.info(`[Server] Initializing new server`)
     const newRoot = req.body.newRoot
     const rootUsername = newRoot.username || 'root'
-    const rootPash = newRoot.password ? await this.auth.hashPass(newRoot.password) : ''
+    const rootPash = newRoot.password ? await this.auth.localAuthStrategy.hashPassword(newRoot.password) : ''
     if (!rootPash) Logger.warn(`[Server] Creating root user with no password`)
     await Database.createRootUser(rootUsername, rootPash, this.auth)
 
diff --git a/server/SocketAuthority.js b/server/SocketAuthority.js
index 050e7e2f..da31ba4a 100644
--- a/server/SocketAuthority.js
+++ b/server/SocketAuthority.js
@@ -1,7 +1,7 @@
 const SocketIO = require('socket.io')
 const Logger = require('./Logger')
 const Database = require('./Database')
-const Auth = require('./Auth')
+const TokenManager = require('./auth/TokenManager')
 
 /**
  * @typedef SocketClient
@@ -231,18 +231,22 @@ class SocketAuthority {
    * When setting up a socket connection the user needs to be associated with a socket id
    * for this the client will send a 'auth' event that includes the users API token
    *
+   * Sends event 'init' to the socket. For admins this contains an array of users online.
+   * For failed authentication it sends event 'auth_failed' with a message
+   *
    * @param {SocketIO.Socket} socket
    * @param {string} token JWT
    */
   async authenticateSocket(socket, token) {
     // we don't use passport to authenticate the jwt we get over the socket connection.
     // it's easier to directly verify/decode it.
-    const token_data = Auth.validateAccessToken(token)
+    // TODO: Support API keys for web socket connections
+    const token_data = TokenManager.validateAccessToken(token)
 
     if (!token_data?.userId) {
       // Token invalid
       Logger.error('Cannot validate socket - invalid token')
-      return socket.emit('invalid_token')
+      return socket.emit('auth_failed', { message: 'Invalid token' })
     }
 
     // get the user via the id from the decoded jwt.
@@ -250,7 +254,11 @@ class SocketAuthority {
     if (!user) {
       // user not found
       Logger.error('Cannot validate socket - invalid token')
-      return socket.emit('invalid_token')
+      return socket.emit('auth_failed', { message: 'Invalid token' })
+    }
+    if (!user.isActive) {
+      Logger.error('Cannot validate socket - user is not active')
+      return socket.emit('auth_failed', { message: 'Invalid user' })
     }
 
     const client = this.clients[socket.id]
@@ -260,13 +268,18 @@ class SocketAuthority {
     }
 
     if (client.user !== undefined) {
-      Logger.debug(`[SocketAuthority] Authenticating socket client already has user`, client.user.username)
+      if (client.user.id === user.id) {
+        // Allow re-authentication of a socket to the same user
+        Logger.info(`[SocketAuthority] Authenticating socket already associated to user "${client.user.username}"`)
+      } else {
+        // Allow re-authentication of a socket to a different user but shouldn't happen
+        Logger.warn(`[SocketAuthority] Authenticating socket to user "${user.username}", but is already associated with a different user "${client.user.username}"`)
+      }
+    } else {
+      Logger.debug(`[SocketAuthority] Authenticating socket to user "${user.username}"`)
     }
 
     client.user = user
-
-    Logger.debug(`[SocketAuthority] User Online ${client.user.username}`)
-
     this.adminEmitter('user_online', client.user.toJSONForPublic(this.Server.playbackSessionManager.sessions))
 
     // Update user lastSeen without firing sequelize bulk update hooks
diff --git a/server/auth/LocalAuthStrategy.js b/server/auth/LocalAuthStrategy.js
new file mode 100644
index 00000000..e9499d13
--- /dev/null
+++ b/server/auth/LocalAuthStrategy.js
@@ -0,0 +1,186 @@
+const passport = require('passport')
+const LocalStrategy = require('../libs/passportLocal')
+const Database = require('../Database')
+const Logger = require('../Logger')
+
+const bcrypt = require('../libs/bcryptjs')
+const requestIp = require('../libs/requestIp')
+
+/**
+ * Local authentication strategy using username/password
+ */
+class LocalAuthStrategy {
+  constructor() {
+    this.name = 'local'
+    this.strategy = null
+  }
+
+  /**
+   * Get the passport strategy instance
+   * @returns {LocalStrategy}
+   */
+  getStrategy() {
+    if (!this.strategy) {
+      this.strategy = new LocalStrategy({ passReqToCallback: true }, this.verifyCredentials.bind(this))
+    }
+    return this.strategy
+  }
+
+  /**
+   * Initialize the strategy with passport
+   */
+  init() {
+    passport.use(this.name, this.getStrategy())
+  }
+
+  /**
+   * Remove the strategy from passport
+   */
+  unuse() {
+    passport.unuse(this.name)
+    this.strategy = null
+  }
+
+  /**
+   * Verify user credentials
+   * @param {import('express').Request} req
+   * @param {string} username
+   * @param {string} password
+   * @param {Function} done - Passport callback
+   */
+  async verifyCredentials(req, username, password, done) {
+    // Load the user given it's username
+    const user = await Database.userModel.getUserByUsername(username.toLowerCase())
+
+    if (!user?.isActive) {
+      if (user) {
+        this.logFailedLoginAttempt(req, user.username, 'User is not active')
+      } else {
+        this.logFailedLoginAttempt(req, username, 'User not found')
+      }
+      done(null, null)
+      return
+    }
+
+    // Check passwordless root user
+    if (user.type === 'root' && !user.pash) {
+      if (password) {
+        // deny login
+        this.logFailedLoginAttempt(req, user.username, 'Root user has no password set')
+        done(null, null)
+        return
+      }
+      // approve login
+      Logger.info(`[LocalAuth] User "${user.username}" logged in from ip ${requestIp.getClientIp(req)}`)
+
+      done(null, user)
+      return
+    } else if (!user.pash) {
+      this.logFailedLoginAttempt(req, user.username, 'User has no password set. Might have been created with OpenID')
+      done(null, null)
+      return
+    }
+
+    // Check password match
+    const compare = await bcrypt.compare(password, user.pash)
+    if (compare) {
+      // approve login
+      Logger.info(`[LocalAuth] User "${user.username}" logged in from ip ${requestIp.getClientIp(req)}`)
+
+      done(null, user)
+      return
+    }
+
+    // deny login
+    this.logFailedLoginAttempt(req, user.username, 'Invalid password')
+    done(null, null)
+  }
+
+  /**
+   * Log failed login attempts
+   * @param {import('express').Request} req
+   * @param {string} username
+   * @param {string} message
+   */
+  logFailedLoginAttempt(req, username, message) {
+    if (!req || !username || !message) return
+    Logger.error(`[LocalAuth] Failed login attempt for username "${username}" from ip ${requestIp.getClientIp(req)} (${message})`)
+  }
+
+  /**
+   * Hash a password with bcrypt
+   * @param {string} password
+   * @returns {Promise<string>} hash
+   */
+  hashPassword(password) {
+    return new Promise((resolve) => {
+      bcrypt.hash(password, 8, (err, hash) => {
+        if (err) {
+          resolve(null)
+        } else {
+          resolve(hash)
+        }
+      })
+    })
+  }
+
+  /**
+   * Compare password with user's hashed password
+   * @param {string} password
+   * @param {import('../models/User')} user
+   * @returns {Promise<boolean>}
+   */
+  comparePassword(password, user) {
+    if (user.type === 'root' && !password && !user.pash) return true
+    if (!password || !user.pash) return false
+    return bcrypt.compare(password, user.pash)
+  }
+
+  /**
+   * Change user password
+   * @param {import('../models/User')} user
+   * @param {string} password
+   * @param {string} newPassword
+   */
+  async changePassword(user, password, newPassword) {
+    // Only root can have an empty password
+    if (user.type !== 'root' && !newPassword) {
+      return {
+        error: 'Invalid new password - Only root can have an empty password'
+      }
+    }
+
+    // Check password match
+    const compare = await this.comparePassword(password, user)
+    if (!compare) {
+      return {
+        error: 'Invalid password'
+      }
+    }
+
+    let pw = ''
+    if (newPassword) {
+      pw = await this.hashPassword(newPassword)
+      if (!pw) {
+        return {
+          error: 'Hash failed'
+        }
+      }
+    }
+
+    try {
+      await user.update({ pash: pw })
+      Logger.info(`[LocalAuth] User "${user.username}" changed password`)
+      return {
+        success: true
+      }
+    } catch (error) {
+      Logger.error(`[LocalAuth] User "${user.username}" failed to change password`, error)
+      return {
+        error: 'Unknown error'
+      }
+    }
+  }
+}
+
+module.exports = LocalAuthStrategy
diff --git a/server/auth/OidcAuthStrategy.js b/server/auth/OidcAuthStrategy.js
new file mode 100644
index 00000000..9a515c1a
--- /dev/null
+++ b/server/auth/OidcAuthStrategy.js
@@ -0,0 +1,488 @@
+const { Request, Response } = require('express')
+const passport = require('passport')
+const OpenIDClient = require('openid-client')
+const axios = require('axios')
+const Database = require('../Database')
+const Logger = require('../Logger')
+
+/**
+ * OpenID Connect authentication strategy
+ */
+class OidcAuthStrategy {
+  constructor() {
+    this.name = 'openid-client'
+    this.strategy = null
+    this.client = null
+    // Map of openId sessions indexed by oauth2 state-variable
+    this.openIdAuthSession = new Map()
+  }
+
+  /**
+   * Get the passport strategy instance
+   * @returns {OpenIDClient.Strategy}
+   */
+  getStrategy() {
+    if (!this.strategy) {
+      this.strategy = new OpenIDClient.Strategy(
+        {
+          client: this.getClient(),
+          params: {
+            redirect_uri: `${global.ServerSettings.authOpenIDSubfolderForRedirectURLs}/auth/openid/callback`,
+            scope: this.getScope()
+          }
+        },
+        this.verifyCallback.bind(this)
+      )
+    }
+    return this.strategy
+  }
+
+  /**
+   * Get the OpenID Connect client
+   * @returns {OpenIDClient.Client}
+   */
+  getClient() {
+    if (!this.client) {
+      if (!Database.serverSettings.isOpenIDAuthSettingsValid) {
+        throw new Error('OpenID Connect settings are not valid')
+      }
+
+      // Custom req timeout see: https://github.com/panva/node-openid-client/blob/main/docs/README.md#customizing
+      OpenIDClient.custom.setHttpOptionsDefaults({ timeout: 10000 })
+
+      const openIdIssuerClient = new OpenIDClient.Issuer({
+        issuer: global.ServerSettings.authOpenIDIssuerURL,
+        authorization_endpoint: global.ServerSettings.authOpenIDAuthorizationURL,
+        token_endpoint: global.ServerSettings.authOpenIDTokenURL,
+        userinfo_endpoint: global.ServerSettings.authOpenIDUserInfoURL,
+        jwks_uri: global.ServerSettings.authOpenIDJwksURL,
+        end_session_endpoint: global.ServerSettings.authOpenIDLogoutURL
+      }).Client
+
+      this.client = new openIdIssuerClient({
+        client_id: global.ServerSettings.authOpenIDClientID,
+        client_secret: global.ServerSettings.authOpenIDClientSecret,
+        id_token_signed_response_alg: global.ServerSettings.authOpenIDTokenSigningAlgorithm
+      })
+    }
+    return this.client
+  }
+
+  /**
+   * Get the scope string for the OpenID Connect request
+   * @returns {string}
+   */
+  getScope() {
+    let scope = 'openid profile email'
+    if (global.ServerSettings.authOpenIDGroupClaim) {
+      scope += ' ' + global.ServerSettings.authOpenIDGroupClaim
+    }
+    if (global.ServerSettings.authOpenIDAdvancedPermsClaim) {
+      scope += ' ' + global.ServerSettings.authOpenIDAdvancedPermsClaim
+    }
+    return scope
+  }
+
+  /**
+   * Initialize the strategy with passport
+   */
+  init() {
+    if (!Database.serverSettings.isOpenIDAuthSettingsValid) {
+      Logger.error(`[OidcAuth] Cannot init openid auth strategy - invalid settings`)
+      return
+    }
+    passport.use(this.name, this.getStrategy())
+  }
+
+  /**
+   * Remove the strategy from passport
+   */
+  unuse() {
+    passport.unuse(this.name)
+    this.strategy = null
+    this.client = null
+  }
+
+  /**
+   * Verify callback for OpenID Connect authentication
+   * @param {Object} tokenset
+   * @param {Object} userinfo
+   * @param {Function} done - Passport callback
+   */
+  async verifyCallback(tokenset, userinfo, done) {
+    try {
+      Logger.debug(`[OidcAuth] openid callback userinfo=`, JSON.stringify(userinfo, null, 2))
+
+      if (!userinfo.sub) {
+        throw new Error('Invalid userinfo, no sub')
+      }
+
+      if (!this.validateGroupClaim(userinfo)) {
+        throw new Error(`Group claim ${Database.serverSettings.authOpenIDGroupClaim} not found or empty in userinfo`)
+      }
+
+      let user = await Database.userModel.findOrCreateUserFromOpenIdUserInfo(userinfo)
+
+      if (!user?.isActive) {
+        throw new Error('User not active or not found')
+      }
+
+      await this.setUserGroup(user, userinfo)
+      await this.updateUserPermissions(user, userinfo)
+
+      // We also have to save the id_token for later (used for logout) because we cannot set cookies here
+      user.openid_id_token = tokenset.id_token
+
+      return done(null, user)
+    } catch (error) {
+      Logger.error(`[OidcAuth] openid callback error: ${error?.message}\n${error?.stack}`)
+      return done(null, null, 'Unauthorized')
+    }
+  }
+
+  /**
+   * Validates the presence and content of the group claim in userinfo.
+   * @param {Object} userinfo
+   * @returns {boolean}
+   */
+  validateGroupClaim(userinfo) {
+    const groupClaimName = Database.serverSettings.authOpenIDGroupClaim
+    if (!groupClaimName)
+      // Allow no group claim when configured like this
+      return true
+
+    // If configured it must exist in userinfo
+    if (!userinfo[groupClaimName]) {
+      return false
+    }
+    return true
+  }
+
+  /**
+   * Sets the user group based on group claim in userinfo.
+   * @param {import('../models/User')} user
+   * @param {Object} userinfo
+   */
+  async setUserGroup(user, userinfo) {
+    const groupClaimName = Database.serverSettings.authOpenIDGroupClaim
+    if (!groupClaimName)
+      // No group claim configured, don't set anything
+      return
+
+    if (!userinfo[groupClaimName]) throw new Error(`Group claim ${groupClaimName} not found in userinfo`)
+
+    const groupsList = userinfo[groupClaimName].map((group) => group.toLowerCase())
+    const rolesInOrderOfPriority = ['admin', 'user', 'guest']
+
+    let userType = rolesInOrderOfPriority.find((role) => groupsList.includes(role))
+    if (userType) {
+      if (user.type === 'root') {
+        // Check OpenID Group
+        if (userType !== 'admin') {
+          throw new Error(`Root user "${user.username}" cannot be downgraded to ${userType}. Denying login.`)
+        } else {
+          // If root user is logging in via OpenID, we will not change the type
+          return
+        }
+      }
+
+      if (user.type !== userType) {
+        Logger.info(`[OidcAuth] openid callback: Updating user "${user.username}" type to "${userType}" from "${user.type}"`)
+        user.type = userType
+        await user.save()
+      }
+    } else {
+      throw new Error(`No valid group found in userinfo: ${JSON.stringify(userinfo[groupClaimName], null, 2)}`)
+    }
+  }
+
+  /**
+   * Updates user permissions based on the advanced permissions claim.
+   * @param {import('../models/User')} user
+   * @param {Object} userinfo
+   */
+  async updateUserPermissions(user, userinfo) {
+    const absPermissionsClaim = Database.serverSettings.authOpenIDAdvancedPermsClaim
+    if (!absPermissionsClaim)
+      // No advanced permissions claim configured, don't set anything
+      return
+
+    if (user.type === 'admin' || user.type === 'root') return
+
+    const absPermissions = userinfo[absPermissionsClaim]
+    if (!absPermissions) throw new Error(`Advanced permissions claim ${absPermissionsClaim} not found in userinfo`)
+
+    if (await user.updatePermissionsFromExternalJSON(absPermissions)) {
+      Logger.info(`[OidcAuth] openid callback: Updating advanced perms for user "${user.username}" using "${JSON.stringify(absPermissions)}"`)
+    }
+  }
+
+  /**
+   * Generate PKCE parameters for the authorization request
+   * @param {Request} req
+   * @param {boolean} isMobileFlow
+   * @returns {Object|{error: string}}
+   */
+  generatePkce(req, isMobileFlow) {
+    if (isMobileFlow) {
+      if (!req.query.code_challenge) {
+        return {
+          error: 'code_challenge required for mobile flow (PKCE)'
+        }
+      }
+      if (req.query.code_challenge_method && req.query.code_challenge_method !== 'S256') {
+        return {
+          error: 'Only S256 code_challenge_method method supported'
+        }
+      }
+      return {
+        code_challenge: req.query.code_challenge,
+        code_challenge_method: req.query.code_challenge_method || 'S256'
+      }
+    } else {
+      const code_verifier = OpenIDClient.generators.codeVerifier()
+      const code_challenge = OpenIDClient.generators.codeChallenge(code_verifier)
+      return { code_challenge, code_challenge_method: 'S256', code_verifier }
+    }
+  }
+
+  /**
+   * Check if a redirect URI is valid
+   * @param {string} uri
+   * @returns {boolean}
+   */
+  isValidRedirectUri(uri) {
+    // Check if the redirect_uri is in the whitelist
+    return Database.serverSettings.authOpenIDMobileRedirectURIs.includes(uri) || (Database.serverSettings.authOpenIDMobileRedirectURIs.length === 1 && Database.serverSettings.authOpenIDMobileRedirectURIs[0] === '*')
+  }
+
+  /**
+   * Get the authorization URL for OpenID Connect
+   * Calls client manually because the strategy does not support forwarding the code challenge for the mobile flow
+   * @param {Request} req
+   * @returns {{ authorizationUrl: string }|{status: number, error: string}}
+   */
+  getAuthorizationUrl(req) {
+    const client = this.getClient()
+    const strategy = this.getStrategy()
+    const sessionKey = strategy._key
+
+    try {
+      const protocol = req.secure || req.get('x-forwarded-proto') === 'https' ? 'https' : 'http'
+      const hostUrl = new URL(`${protocol}://${req.get('host')}`)
+      const isMobileFlow = req.query.response_type === 'code' || req.query.redirect_uri || req.query.code_challenge
+
+      // Only allow code flow (for mobile clients)
+      if (req.query.response_type && req.query.response_type !== 'code') {
+        Logger.debug(`[OidcAuth] OIDC Invalid response_type=${req.query.response_type}`)
+        return {
+          status: 400,
+          error: 'Invalid response_type, only code supported'
+        }
+      }
+
+      // Generate a state on web flow or if no state supplied
+      const state = !isMobileFlow || !req.query.state ? OpenIDClient.generators.random() : req.query.state
+
+      // Redirect URL for the SSO provider
+      let redirectUri
+      if (isMobileFlow) {
+        // Mobile required redirect uri
+        // If it is in the whitelist, we will save into this.openIdAuthSession and set the redirect uri to /auth/openid/mobile-redirect
+        //    where we will handle the redirect to it
+        if (!req.query.redirect_uri || !this.isValidRedirectUri(req.query.redirect_uri)) {
+          Logger.debug(`[OidcAuth] Invalid redirect_uri=${req.query.redirect_uri}`)
+          return {
+            status: 400,
+            error: 'Invalid redirect_uri'
+          }
+        }
+        // We cannot save the supplied redirect_uri in the session, because it the mobile client uses browser instead of the API
+        //   for the request to mobile-redirect and as such the session is not shared
+        this.openIdAuthSession.set(state, { mobile_redirect_uri: req.query.redirect_uri })
+
+        redirectUri = new URL(`${global.ServerSettings.authOpenIDSubfolderForRedirectURLs}/auth/openid/mobile-redirect`, hostUrl).toString()
+      } else {
+        redirectUri = new URL(`${global.ServerSettings.authOpenIDSubfolderForRedirectURLs}/auth/openid/callback`, hostUrl).toString()
+
+        if (req.query.state) {
+          Logger.debug(`[OidcAuth] Invalid state - not allowed on web openid flow`)
+          return {
+            status: 400,
+            error: 'Invalid state, not allowed on web flow'
+          }
+        }
+      }
+
+      // Update the strategy's redirect_uri for this request
+      strategy._params.redirect_uri = redirectUri
+      Logger.debug(`[OidcAuth] OIDC redirect_uri=${redirectUri}`)
+
+      const pkceData = this.generatePkce(req, isMobileFlow)
+      if (pkceData.error) {
+        return {
+          status: 400,
+          error: pkceData.error
+        }
+      }
+
+      req.session[sessionKey] = {
+        ...req.session[sessionKey],
+        state: state,
+        max_age: strategy._params.max_age,
+        response_type: 'code',
+        code_verifier: pkceData.code_verifier, // not null if web flow
+        mobile: req.query.redirect_uri, // Used in the abs callback later, set mobile if redirect_uri is filled out
+        sso_redirect_uri: redirectUri // Save the redirect_uri (for the SSO Provider) for the callback
+      }
+
+      const authorizationUrl = client.authorizationUrl({
+        ...strategy._params,
+        redirect_uri: redirectUri,
+        state: state,
+        response_type: 'code',
+        scope: this.getScope(),
+        code_challenge: pkceData.code_challenge,
+        code_challenge_method: pkceData.code_challenge_method
+      })
+
+      return {
+        authorizationUrl,
+        isMobileFlow
+      }
+    } catch (error) {
+      Logger.error(`[OidcAuth] Error generating authorization URL: ${error}\n${error?.stack}`)
+      return {
+        status: 500,
+        error: error.message || 'Unknown error'
+      }
+    }
+  }
+
+  /**
+   * Get the end session URL for logout
+   * @param {Request} req
+   * @param {string} idToken
+   * @param {string} authMethod
+   * @returns {string|null}
+   */
+  getEndSessionUrl(req, idToken, authMethod) {
+    const client = this.getClient()
+
+    if (client.issuer.end_session_endpoint && client.issuer.end_session_endpoint.length > 0) {
+      let postLogoutRedirectUri = null
+
+      if (authMethod === 'openid') {
+        const protocol = req.secure || req.get('x-forwarded-proto') === 'https' ? 'https' : 'http'
+        const host = req.get('host')
+        // TODO: ABS does currently not support subfolders for installation
+        // If we want to support it we need to include a config for the serverurl
+        postLogoutRedirectUri = `${protocol}://${host}${global.RouterBasePath}/login`
+      }
+      // else for openid-mobile we keep postLogoutRedirectUri on null
+      //  nice would be to redirect to the app here, but for example Authentik does not implement
+      //  the post_logout_redirect_uri parameter at all and for other providers
+      //  we would also need again to implement (and even before get to know somehow for 3rd party apps)
+      //  the correct app link like audiobookshelf://login (and maybe also provide a redirect like mobile-redirect).
+      //   Instead because its null (and this way the parameter will be omitted completly), the client/app can simply append something like
+      //  &post_logout_redirect_uri=audiobookshelf://login to the received logout url by itself which is the simplest solution
+      //   (The URL needs to be whitelisted in the config of the SSO/ID provider)
+
+      return client.endSessionUrl({
+        id_token_hint: idToken,
+        post_logout_redirect_uri: postLogoutRedirectUri
+      })
+    }
+
+    return null
+  }
+
+  /**
+   * @typedef {Object} OpenIdIssuerConfig
+   * @property {string} issuer
+   * @property {string} authorization_endpoint
+   * @property {string} token_endpoint
+   * @property {string} userinfo_endpoint
+   * @property {string} end_session_endpoint
+   * @property {string} jwks_uri
+   * @property {string} id_token_signing_alg_values_supported
+   *
+   * Get OpenID Connect configuration from an issuer URL
+   * @param {string} issuerUrl
+   * @returns {Promise<OpenIdIssuerConfig|{status: number, error: string}>}
+   */
+  async getIssuerConfig(issuerUrl) {
+    // Strip trailing slash
+    if (issuerUrl.endsWith('/')) issuerUrl = issuerUrl.slice(0, -1)
+
+    // Append config pathname and validate URL
+    let configUrl = null
+    try {
+      configUrl = new URL(`${issuerUrl}/.well-known/openid-configuration`)
+      if (!configUrl.pathname.endsWith('/.well-known/openid-configuration')) {
+        throw new Error('Invalid pathname')
+      }
+    } catch (error) {
+      Logger.error(`[OidcAuth] Failed to get openid configuration. Invalid URL "${configUrl}"`, error)
+      return {
+        status: 400,
+        error: "Invalid request. Query param 'issuer' is invalid"
+      }
+    }
+
+    try {
+      const { data } = await axios.get(configUrl.toString())
+      return {
+        issuer: data.issuer,
+        authorization_endpoint: data.authorization_endpoint,
+        token_endpoint: data.token_endpoint,
+        userinfo_endpoint: data.userinfo_endpoint,
+        end_session_endpoint: data.end_session_endpoint,
+        jwks_uri: data.jwks_uri,
+        id_token_signing_alg_values_supported: data.id_token_signing_alg_values_supported
+      }
+    } catch (error) {
+      Logger.error(`[OidcAuth] Failed to get openid configuration at "${configUrl}"`, error)
+      return {
+        status: 400,
+        error: 'Failed to get openid configuration'
+      }
+    }
+  }
+
+  /**
+   * Handle mobile redirect for OAuth2 callback
+   * @param {Request} req
+   * @param {Response} res
+   */
+  handleMobileRedirect(req, res) {
+    try {
+      // Extract the state parameter from the request
+      const { state, code } = req.query
+
+      // Check if the state provided is in our list
+      if (!state || !this.openIdAuthSession.has(state)) {
+        Logger.error('[OidcAuth] /auth/openid/mobile-redirect route: State parameter mismatch')
+        return res.status(400).send('State parameter mismatch')
+      }
+
+      let mobile_redirect_uri = this.openIdAuthSession.get(state).mobile_redirect_uri
+
+      if (!mobile_redirect_uri) {
+        Logger.error('[OidcAuth] No redirect URI')
+        return res.status(400).send('No redirect URI')
+      }
+
+      this.openIdAuthSession.delete(state)
+
+      const redirectUri = `${mobile_redirect_uri}?code=${encodeURIComponent(code)}&state=${encodeURIComponent(state)}`
+      // Redirect to the overwrite URI saved in the map
+      res.redirect(redirectUri)
+    } catch (error) {
+      Logger.error(`[OidcAuth] Error in /auth/openid/mobile-redirect route: ${error}\n${error?.stack}`)
+      res.status(500).send('Internal Server Error')
+    }
+  }
+}
+
+module.exports = OidcAuthStrategy
diff --git a/server/auth/TokenManager.js b/server/auth/TokenManager.js
new file mode 100644
index 00000000..d972b534
--- /dev/null
+++ b/server/auth/TokenManager.js
@@ -0,0 +1,418 @@
+const { Op } = require('sequelize')
+
+const Database = require('../Database')
+const Logger = require('../Logger')
+
+const requestIp = require('../libs/requestIp')
+const jwt = require('../libs/jsonwebtoken')
+
+class TokenManager {
+  /** @type {string} JWT secret key */
+  static TokenSecret = null
+
+  constructor() {
+    /** @type {number} Refresh token expiry in seconds */
+    this.RefreshTokenExpiry = parseInt(process.env.REFRESH_TOKEN_EXPIRY) || 7 * 24 * 60 * 60 // 7 days
+    /** @type {number} Access token expiry in seconds */
+    this.AccessTokenExpiry = parseInt(process.env.ACCESS_TOKEN_EXPIRY) || 12 * 60 * 60 // 12 hours
+
+    if (parseInt(process.env.REFRESH_TOKEN_EXPIRY) > 0) {
+      Logger.info(`[TokenManager] Refresh token expiry set from ENV variable to ${this.RefreshTokenExpiry} seconds`)
+    }
+    if (parseInt(process.env.ACCESS_TOKEN_EXPIRY) > 0) {
+      Logger.info(`[TokenManager] Access token expiry set from ENV variable to ${this.AccessTokenExpiry} seconds`)
+    }
+  }
+
+  get TokenSecret() {
+    return TokenManager.TokenSecret
+  }
+
+  /**
+   * Token secret is used to sign and verify JWTs
+   * Set by ENV variable "JWT_SECRET_KEY" or generated and stored on server settings if not set
+   */
+  async initTokenSecret() {
+    if (process.env.JWT_SECRET_KEY) {
+      // Use user supplied token secret
+      Logger.info('[TokenManager] JWT secret key set from ENV variable')
+      TokenManager.TokenSecret = process.env.JWT_SECRET_KEY
+    } else if (!Database.serverSettings.tokenSecret) {
+      // Generate new token secret and store it on server settings
+      Logger.info('[TokenManager] JWT secret key not found, generating one')
+      TokenManager.TokenSecret = require('crypto').randomBytes(256).toString('base64')
+      Database.serverSettings.tokenSecret = TokenManager.TokenSecret
+      await Database.updateServerSettings()
+    } else {
+      // Use existing token secret from server settings
+      TokenManager.TokenSecret = Database.serverSettings.tokenSecret
+    }
+  }
+
+  /**
+   * Sets the refresh token cookie
+   * @param {import('express').Request} req
+   * @param {import('express').Response} res
+   * @param {string} refreshToken
+   */
+  setRefreshTokenCookie(req, res, refreshToken) {
+    res.cookie('refresh_token', refreshToken, {
+      httpOnly: true,
+      secure: req.secure || req.get('x-forwarded-proto') === 'https',
+      sameSite: 'lax',
+      maxAge: this.RefreshTokenExpiry * 1000,
+      path: '/'
+    })
+  }
+
+  /**
+   * Function to validate a jwt token for a given user
+   * Used to authenticate socket connections
+   * TODO: Support API keys for web socket connections
+   *
+   * @param {string} token
+   * @returns {Object} tokens data
+   */
+  static validateAccessToken(token) {
+    try {
+      return jwt.verify(token, TokenManager.TokenSecret)
+    } catch (err) {
+      return null
+    }
+  }
+
+  /**
+   * Generate a JWT token for a given user
+   * TODO: Old method with no expiration
+   * @deprecated
+   *
+   * @param {{ id:string, username:string }} user
+   * @returns {string}
+   */
+  static generateAccessToken(user) {
+    return jwt.sign({ userId: user.id, username: user.username }, TokenManager.TokenSecret)
+  }
+
+  /**
+   * Function to generate a jwt token for a given user
+   * TODO: Old method with no expiration
+   * @deprecated
+   *
+   * @param {{ id:string, username:string }} user
+   * @returns {string}
+   */
+  generateAccessToken(user) {
+    return TokenManager.generateAccessToken(user)
+  }
+
+  /**
+   * Generate access token for a given user
+   *
+   * @param {{ id:string, username:string }} user
+   * @returns {string}
+   */
+  generateTempAccessToken(user) {
+    const payload = {
+      userId: user.id,
+      username: user.username,
+      type: 'access'
+    }
+    const options = {
+      expiresIn: this.AccessTokenExpiry
+    }
+    try {
+      return jwt.sign(payload, TokenManager.TokenSecret, options)
+    } catch (error) {
+      Logger.error(`[TokenManager] Error generating access token for user ${user.id}: ${error}`)
+      return null
+    }
+  }
+
+  /**
+   * Generate refresh token for a given user
+   *
+   * @param {{ id:string, username:string }} user
+   * @returns {string}
+   */
+  generateRefreshToken(user) {
+    const payload = {
+      userId: user.id,
+      username: user.username,
+      type: 'refresh'
+    }
+    const options = {
+      expiresIn: this.RefreshTokenExpiry
+    }
+    try {
+      return jwt.sign(payload, TokenManager.TokenSecret, options)
+    } catch (error) {
+      Logger.error(`[TokenManager] Error generating refresh token for user ${user.id}: ${error}`)
+      return null
+    }
+  }
+
+  /**
+   * Create tokens and session for a given user
+   *
+   * @param {{ id:string, username:string }} user
+   * @param {import('express').Request} req
+   * @returns {Promise<{ accessToken:string, refreshToken:string, session:import('../models/Session') }>}
+   */
+  async createTokensAndSession(user, req) {
+    const ipAddress = requestIp.getClientIp(req)
+    const userAgent = req.headers['user-agent']
+    const accessToken = this.generateTempAccessToken(user)
+    const refreshToken = this.generateRefreshToken(user)
+
+    // Calculate expiration time for the refresh token
+    const expiresAt = new Date(Date.now() + this.RefreshTokenExpiry * 1000)
+
+    const session = await Database.sessionModel.createSession(user.id, ipAddress, userAgent, refreshToken, expiresAt)
+
+    return {
+      accessToken,
+      refreshToken,
+      session
+    }
+  }
+
+  /**
+   * Rotate tokens for a given session
+   *
+   * @param {import('../models/Session')} session
+   * @param {import('../models/User')} user
+   * @param {import('express').Request} req
+   * @param {import('express').Response} res
+   * @returns {Promise<{ accessToken:string, refreshToken:string }>}
+   */
+  async rotateTokensForSession(session, user, req, res) {
+    // Generate new tokens
+    const newAccessToken = this.generateTempAccessToken(user)
+    const newRefreshToken = this.generateRefreshToken(user)
+
+    // Calculate new expiration time
+    const newExpiresAt = new Date(Date.now() + this.RefreshTokenExpiry * 1000)
+
+    // Update the session with the new refresh token and expiration
+    session.refreshToken = newRefreshToken
+    session.expiresAt = newExpiresAt
+    await session.save()
+
+    // Set new refresh token cookie
+    this.setRefreshTokenCookie(req, res, newRefreshToken)
+
+    return {
+      accessToken: newAccessToken,
+      refreshToken: newRefreshToken
+    }
+  }
+
+  /**
+   * Check if the jwt is valid
+   *
+   * @param {Object} jwt_payload
+   * @param {Function} done - passportjs callback
+   */
+  async jwtAuthCheck(jwt_payload, done) {
+    if (jwt_payload.type === 'api') {
+      // Api key based authentication
+      const apiKey = await Database.apiKeyModel.getById(jwt_payload.keyId)
+
+      if (!apiKey?.isActive) {
+        done(null, null)
+        return
+      }
+
+      // Check if the api key is expired and deactivate it
+      if (jwt_payload.exp && jwt_payload.exp < Date.now() / 1000) {
+        done(null, null)
+
+        apiKey.isActive = false
+        await apiKey.save()
+        Logger.info(`[TokenManager] API key ${apiKey.id} is expired - deactivated`)
+        return
+      }
+
+      const user = await Database.userModel.getUserById(apiKey.userId)
+      done(null, user)
+    } else {
+      // JWT based authentication
+
+      // Check if the jwt is expired
+      if (jwt_payload.exp && jwt_payload.exp < Date.now() / 1000) {
+        done(null, null)
+        return
+      }
+
+      // load user by id from the jwt token
+      const user = await Database.userModel.getUserByIdOrOldId(jwt_payload.userId)
+
+      if (!user?.isActive) {
+        // deny login
+        done(null, null)
+        return
+      }
+
+      // TODO: Temporary flag to report old tokens to users
+      // May be a better place for this but here means we dont have to decode the token again
+      if (!jwt_payload.exp && !user.isOldToken) {
+        Logger.debug(`[TokenManager] User ${user.username} is using an access token without an expiration`)
+        user.isOldToken = true
+      } else if (jwt_payload.exp && user.isOldToken !== undefined) {
+        delete user.isOldToken
+      }
+
+      // approve login
+      done(null, user)
+    }
+  }
+
+  /**
+   * Handle refresh token
+   *
+   * @param {string} refreshToken
+   * @param {import('express').Request} req
+   * @param {import('express').Response} res
+   * @returns {Promise<{ accessToken?:string, refreshToken?:string, user?:import('../models/User'), error?:string }>}
+   */
+  async handleRefreshToken(refreshToken, req, res) {
+    try {
+      // Verify the refresh token
+      const decoded = jwt.verify(refreshToken, TokenManager.TokenSecret)
+
+      if (decoded.type !== 'refresh') {
+        Logger.error(`[TokenManager] Failed to refresh token. Invalid token type: ${decoded.type}`)
+        return {
+          error: 'Invalid token type'
+        }
+      }
+
+      const session = await Database.sessionModel.findOne({
+        where: { refreshToken: refreshToken }
+      })
+
+      if (!session) {
+        Logger.error(`[TokenManager] Failed to refresh token. Session not found for refresh token: ${refreshToken}`)
+        return {
+          error: 'Invalid refresh token'
+        }
+      }
+
+      // Check if session is expired in database
+      if (session.expiresAt < new Date()) {
+        Logger.info(`[TokenManager] Session expired in database, cleaning up`)
+        await session.destroy()
+        return {
+          error: 'Refresh token expired'
+        }
+      }
+
+      const user = await Database.userModel.getUserById(decoded.userId)
+      if (!user?.isActive) {
+        Logger.error(`[TokenManager] Failed to refresh token. User not found or inactive for user id: ${decoded.userId}`)
+        return {
+          error: 'User not found or inactive'
+        }
+      }
+
+      const newTokens = await this.rotateTokensForSession(session, user, req, res)
+      return {
+        accessToken: newTokens.accessToken,
+        refreshToken: newTokens.refreshToken,
+        user
+      }
+    } catch (error) {
+      if (error.name === 'TokenExpiredError') {
+        Logger.info(`[TokenManager] Refresh token expired, cleaning up session`)
+
+        // Clean up the expired session from database
+        try {
+          await Database.sessionModel.destroy({
+            where: { refreshToken: refreshToken }
+          })
+          Logger.info(`[TokenManager] Expired session cleaned up`)
+        } catch (cleanupError) {
+          Logger.error(`[TokenManager] Error cleaning up expired session: ${cleanupError.message}`)
+        }
+
+        return {
+          error: 'Refresh token expired'
+        }
+      } else if (error.name === 'JsonWebTokenError') {
+        Logger.error(`[TokenManager] Invalid refresh token format: ${error.message}`)
+        return {
+          error: 'Invalid refresh token'
+        }
+      } else {
+        Logger.error(`[TokenManager] Refresh token error: ${error.message}`)
+        return {
+          error: 'Invalid refresh token'
+        }
+      }
+    }
+  }
+
+  /**
+   * Invalidate all JWT sessions for a given user
+   * If user is current user and refresh token is valid, rotate tokens for the current session
+   *
+   * @param {import('../models/User')} user
+   * @param {import('express').Request} req
+   * @param {import('express').Response} res
+   * @returns {Promise<string>} accessToken only if user is current user and refresh token is valid
+   */
+  async invalidateJwtSessionsForUser(user, req, res) {
+    const currentRefreshToken = req.cookies.refresh_token
+    if (req.user.id === user.id && currentRefreshToken) {
+      // Current user is the same as the user to invalidate sessions for
+      // So rotate token for current session
+      const currentSession = await Database.sessionModel.findOne({ where: { refreshToken: currentRefreshToken } })
+      if (currentSession) {
+        const newTokens = await this.rotateTokensForSession(currentSession, user, req, res)
+
+        // Invalidate all sessions for the user except the current one
+        await Database.sessionModel.destroy({
+          where: {
+            id: {
+              [Op.ne]: currentSession.id
+            },
+            userId: user.id
+          }
+        })
+
+        return newTokens.accessToken
+      } else {
+        Logger.error(`[TokenManager] No session found to rotate tokens for refresh token ${currentRefreshToken}`)
+      }
+    }
+
+    // Current user is not the same as the user to invalidate sessions for (or no refresh token)
+    // So invalidate all sessions for the user
+    await Database.sessionModel.destroy({ where: { userId: user.id } })
+    return null
+  }
+
+  /**
+   * Invalidate a refresh token - used for logout
+   *
+   * @param {string} refreshToken
+   * @returns {Promise<boolean>}
+   */
+  async invalidateRefreshToken(refreshToken) {
+    if (!refreshToken) {
+      Logger.error(`[TokenManager] No refresh token provided to invalidate`)
+      return false
+    }
+
+    try {
+      const numDeleted = await Database.sessionModel.destroy({ where: { refreshToken: refreshToken } })
+      Logger.info(`[TokenManager] Refresh token ${refreshToken} invalidated, ${numDeleted} sessions deleted`)
+      return true
+    } catch (error) {
+      Logger.error(`[TokenManager] Error invalidating refresh token: ${error.message}`)
+      return false
+    }
+  }
+}
+
+module.exports = TokenManager
diff --git a/server/controllers/ApiKeyController.js b/server/controllers/ApiKeyController.js
new file mode 100644
index 00000000..c09d0736
--- /dev/null
+++ b/server/controllers/ApiKeyController.js
@@ -0,0 +1,207 @@
+const { Request, Response, NextFunction } = require('express')
+const uuidv4 = require('uuid').v4
+const Logger = require('../Logger')
+const Database = require('../Database')
+
+/**
+ * @typedef RequestUserObject
+ * @property {import('../models/User')} user
+ *
+ * @typedef {Request & RequestUserObject} RequestWithUser
+ */
+
+class ApiKeyController {
+  constructor() {}
+
+  /**
+   * GET: /api/api-keys
+   *
+   * @param {RequestWithUser} req
+   * @param {Response} res
+   */
+  async getAll(req, res) {
+    const apiKeys = await Database.apiKeyModel.findAll({
+      include: [
+        {
+          model: Database.userModel,
+          attributes: ['id', 'username', 'type']
+        },
+        {
+          model: Database.userModel,
+          as: 'createdByUser',
+          attributes: ['id', 'username', 'type']
+        }
+      ]
+    })
+
+    return res.json({
+      apiKeys: apiKeys.map((a) => a.toJSON())
+    })
+  }
+
+  /**
+   * POST: /api/api-keys
+   *
+   * @this {import('../routers/ApiRouter')}
+   *
+   * @param {RequestWithUser} req
+   * @param {Response} res
+   */
+  async create(req, res) {
+    if (!req.body.name || typeof req.body.name !== 'string') {
+      Logger.warn(`[ApiKeyController] create: Invalid name: ${req.body.name}`)
+      return res.sendStatus(400)
+    }
+    if (req.body.expiresIn && (typeof req.body.expiresIn !== 'number' || req.body.expiresIn <= 0)) {
+      Logger.warn(`[ApiKeyController] create: Invalid expiresIn: ${req.body.expiresIn}`)
+      return res.sendStatus(400)
+    }
+    if (!req.body.userId || typeof req.body.userId !== 'string') {
+      Logger.warn(`[ApiKeyController] create: Invalid userId: ${req.body.userId}`)
+      return res.sendStatus(400)
+    }
+    const user = await Database.userModel.getUserById(req.body.userId)
+    if (!user) {
+      Logger.warn(`[ApiKeyController] create: User not found: ${req.body.userId}`)
+      return res.sendStatus(400)
+    }
+    if (user.type === 'root' && !req.user.isRoot) {
+      Logger.warn(`[ApiKeyController] create: Root user API key cannot be created by non-root user`)
+      return res.sendStatus(403)
+    }
+
+    const keyId = uuidv4() // Generate key id ahead of time to use in JWT
+    const apiKey = await Database.apiKeyModel.generateApiKey(this.auth.tokenManager.TokenSecret, keyId, req.body.name, req.body.expiresIn)
+
+    if (!apiKey) {
+      Logger.error(`[ApiKeyController] create: Error generating API key`)
+      return res.sendStatus(500)
+    }
+
+    // Calculate expiration time for the api key
+    const expiresAt = req.body.expiresIn ? new Date(Date.now() + req.body.expiresIn * 1000) : null
+
+    const apiKeyInstance = await Database.apiKeyModel.create({
+      id: keyId,
+      name: req.body.name,
+      expiresAt,
+      userId: req.body.userId,
+      isActive: !!req.body.isActive,
+      createdByUserId: req.user.id
+    })
+    apiKeyInstance.dataValues.user = await apiKeyInstance.getUser({
+      attributes: ['id', 'username', 'type']
+    })
+
+    Logger.info(`[ApiKeyController] Created API key "${apiKeyInstance.name}"`)
+    return res.json({
+      apiKey: {
+        apiKey, // Actual key only shown to user on creation
+        ...apiKeyInstance.toJSON()
+      }
+    })
+  }
+
+  /**
+   * PATCH: /api/api-keys/:id
+   * Only isActive and userId can be updated because name and expiresIn are in the JWT
+   *
+   * @param {RequestWithUser} req
+   * @param {Response} res
+   */
+  async update(req, res) {
+    const apiKey = await Database.apiKeyModel.findByPk(req.params.id, {
+      include: {
+        model: Database.userModel
+      }
+    })
+    if (!apiKey) {
+      return res.sendStatus(404)
+    }
+    // Only root user can update root user API keys
+    if (apiKey.user.type === 'root' && !req.user.isRoot) {
+      Logger.warn(`[ApiKeyController] update: Root user API key cannot be updated by non-root user`)
+      return res.sendStatus(403)
+    }
+
+    let hasUpdates = false
+    if (req.body.userId !== undefined) {
+      if (typeof req.body.userId !== 'string') {
+        Logger.warn(`[ApiKeyController] update: Invalid userId: ${req.body.userId}`)
+        return res.sendStatus(400)
+      }
+      const user = await Database.userModel.getUserById(req.body.userId)
+      if (!user) {
+        Logger.warn(`[ApiKeyController] update: User not found: ${req.body.userId}`)
+        return res.sendStatus(400)
+      }
+      if (user.type === 'root' && !req.user.isRoot) {
+        Logger.warn(`[ApiKeyController] update: Root user API key cannot be created by non-root user`)
+        return res.sendStatus(403)
+      }
+      if (apiKey.userId !== req.body.userId) {
+        apiKey.userId = req.body.userId
+        hasUpdates = true
+      }
+    }
+
+    if (req.body.isActive !== undefined) {
+      if (typeof req.body.isActive !== 'boolean') {
+        return res.sendStatus(400)
+      }
+      if (apiKey.isActive !== req.body.isActive) {
+        apiKey.isActive = req.body.isActive
+        hasUpdates = true
+      }
+    }
+
+    if (hasUpdates) {
+      await apiKey.save()
+      apiKey.dataValues.user = await apiKey.getUser({
+        attributes: ['id', 'username', 'type']
+      })
+      Logger.info(`[ApiKeyController] Updated API key "${apiKey.name}"`)
+    } else {
+      Logger.info(`[ApiKeyController] No updates needed to API key "${apiKey.name}"`)
+    }
+
+    return res.json({
+      apiKey: apiKey.toJSON()
+    })
+  }
+
+  /**
+   * DELETE: /api/api-keys/:id
+   *
+   * @param {RequestWithUser} req
+   * @param {Response} res
+   */
+  async delete(req, res) {
+    const apiKey = await Database.apiKeyModel.findByPk(req.params.id)
+    if (!apiKey) {
+      return res.sendStatus(404)
+    }
+
+    await apiKey.destroy()
+    Logger.info(`[ApiKeyController] Deleted API key "${apiKey.name}"`)
+
+    return res.sendStatus(200)
+  }
+
+  /**
+   *
+   * @param {RequestWithUser} req
+   * @param {Response} res
+   * @param {NextFunction} next
+   */
+  middleware(req, res, next) {
+    if (!req.user.isAdminOrUp) {
+      Logger.error(`[ApiKeyController] Non-admin user "${req.user.username}" attempting to access api keys`)
+      return res.sendStatus(403)
+    }
+
+    next()
+  }
+}
+
+module.exports = new ApiKeyController()
diff --git a/server/controllers/FileSystemController.js b/server/controllers/FileSystemController.js
index 7629f9ee..4b0a94b3 100644
--- a/server/controllers/FileSystemController.js
+++ b/server/controllers/FileSystemController.js
@@ -89,7 +89,6 @@ class FileSystemController {
     }
 
     const { directory, folderPath } = req.body
-
     if (!directory?.length || typeof directory !== 'string' || !folderPath?.length || typeof folderPath !== 'string') {
       Logger.error(`[FileSystemController] Invalid request body: ${JSON.stringify(req.body)}`)
       return res.status(400).json({
@@ -109,7 +108,14 @@ class FileSystemController {
       return res.sendStatus(404)
     }
 
-    const filepath = Path.posix.join(libraryFolder.path, directory)
+    if (!req.user.checkCanAccessLibrary(libraryFolder.libraryId)) {
+      Logger.error(`[FileSystemController] User "${req.user.username}" attempting to check path exists for library "${libraryFolder.libraryId}" without access`)
+      return res.sendStatus(403)
+    }
+
+    let filepath = Path.join(libraryFolder.path, directory)
+    filepath = fileUtils.filePathToPOSIX(filepath)
+
     // Ensure filepath is inside library folder (prevents directory traversal)
     if (!filepath.startsWith(libraryFolder.path)) {
       Logger.error(`[FileSystemController] Filepath is not inside library folder: ${filepath}`)
diff --git a/server/controllers/MeController.js b/server/controllers/MeController.js
index 87acd221..51773a5a 100644
--- a/server/controllers/MeController.js
+++ b/server/controllers/MeController.js
@@ -273,12 +273,24 @@ class MeController {
    * @param {RequestWithUser} req
    * @param {Response} res
    */
-  updatePassword(req, res) {
+  async updatePassword(req, res) {
     if (req.user.isGuest) {
       Logger.error(`[MeController] Guest user "${req.user.username}" attempted to change password`)
-      return res.sendStatus(500)
+      return res.sendStatus(403)
     }
-    this.auth.userChangePassword(req, res)
+
+    const { password, newPassword } = req.body
+    if ((typeof password !== 'string' && password !== null) || (typeof newPassword !== 'string' && newPassword !== null)) {
+      return res.status(400).send('Missing or invalid password or new password')
+    }
+
+    const result = await this.auth.localAuthStrategy.changePassword(req.user, password, newPassword)
+
+    if (result.error) {
+      return res.status(400).send(result.error)
+    }
+
+    res.sendStatus(200)
   }
 
   /**
@@ -438,7 +450,7 @@ class MeController {
     if (updated) {
       await Database.updateSetting(Database.emailSettings)
       SocketAuthority.clientEmitter(req.user.id, 'ereader-devices-updated', {
-        ereaderDevices: Database.emailSettings.ereaderDevices
+        ereaderDevices: Database.emailSettings.getEReaderDevices(req.user)
       })
     }
     res.json({
diff --git a/server/controllers/MiscController.js b/server/controllers/MiscController.js
index 0e5ad141..c779bdd6 100644
--- a/server/controllers/MiscController.js
+++ b/server/controllers/MiscController.js
@@ -59,6 +59,12 @@ class MiscController {
     if (!library) {
       return res.status(404).send('Library not found')
     }
+
+    if (!req.user.checkCanAccessLibrary(library.id)) {
+      Logger.error(`[MiscController] User "${req.user.username}" attempting to upload to library "${library.id}" without access`)
+      return res.sendStatus(403)
+    }
+
     const folder = library.libraryFolders.find((fold) => fold.id === folderId)
     if (!folder) {
       return res.status(404).send('Folder not found')
diff --git a/server/controllers/SessionController.js b/server/controllers/SessionController.js
index 8cebdd35..ed662ee8 100644
--- a/server/controllers/SessionController.js
+++ b/server/controllers/SessionController.js
@@ -57,26 +57,24 @@ class SessionController {
     }
 
     let where = null
-    const include = [
-      {
-        model: Database.models.device
-      }
-    ]
 
     if (userId) {
       where = {
         userId
       }
-    } else {
-      include.push({
-        model: Database.userModel,
-        attributes: ['id', 'username']
-      })
     }
 
     const { rows, count } = await Database.playbackSessionModel.findAndCountAll({
       where,
-      include,
+      include: [
+        {
+          model: Database.deviceModel
+        },
+        {
+          model: Database.userModel,
+          attributes: ['id', 'username']
+        }
+      ],
       order: [[orderKey, orderDesc]],
       limit: itemsPerPage,
       offset: itemsPerPage * page
@@ -290,7 +288,12 @@ class SessionController {
       return res.sendStatus(404)
     }
 
-    const audioTrack = playbackSession.audioTracks.find((t) => t.index === audioTrackIndex)
+    let audioTrack = playbackSession.audioTracks.find((t) => toNumber(t.index, 1) === audioTrackIndex)
+
+    // Support clients passing 0 or 1 for podcast episode audio track index (handles old episodes pre-v2.21.0 having null index)
+    if (!audioTrack && playbackSession.mediaType === 'podcast' && audioTrackIndex === 0) {
+      audioTrack = playbackSession.audioTracks[0]
+    }
     if (!audioTrack) {
       Logger.error(`[SessionController] Unable to find audio track with index=${audioTrackIndex}`)
       return res.sendStatus(404)
diff --git a/server/controllers/UserController.js b/server/controllers/UserController.js
index 0fb10513..3ec10539 100644
--- a/server/controllers/UserController.js
+++ b/server/controllers/UserController.js
@@ -127,8 +127,8 @@ class UserController {
     }
 
     const userId = uuidv4()
-    const pash = await this.auth.hashPass(req.body.password)
-    const token = await this.auth.generateAccessToken({ id: userId, username: req.body.username })
+    const pash = await this.auth.localAuthStrategy.hashPassword(req.body.password)
+    const token = this.auth.generateAccessToken({ id: userId, username: req.body.username })
     const userType = req.body.type || 'user'
 
     // librariesAccessible and itemTagsSelected can be on req.body or req.body.permissions
@@ -237,6 +237,7 @@ class UserController {
 
     let hasUpdates = false
     let shouldUpdateToken = false
+    let shouldInvalidateJwtSessions = false
     // When changing username create a new API token
     if (updatePayload.username && updatePayload.username !== user.username) {
       const usernameExists = await Database.userModel.checkUserExistsWithUsername(updatePayload.username)
@@ -245,12 +246,13 @@ class UserController {
       }
       user.username = updatePayload.username
       shouldUpdateToken = true
+      shouldInvalidateJwtSessions = true
       hasUpdates = true
     }
 
     // Updating password
     if (updatePayload.password) {
-      user.pash = await this.auth.hashPass(updatePayload.password)
+      user.pash = await this.auth.localAuthStrategy.hashPassword(updatePayload.password)
       hasUpdates = true
     }
 
@@ -325,9 +327,24 @@ class UserController {
 
     if (hasUpdates) {
       if (shouldUpdateToken) {
-        user.token = await this.auth.generateAccessToken(user)
+        user.token = this.auth.generateAccessToken(user)
         Logger.info(`[UserController] User ${user.username} has generated a new api token`)
       }
+
+      // Handle JWT session invalidation for username changes
+      if (shouldInvalidateJwtSessions) {
+        const newAccessToken = await this.auth.invalidateJwtSessionsForUser(user, req, res)
+        if (newAccessToken) {
+          user.accessToken = newAccessToken
+          // Refresh tokens are only returned for mobile clients
+          // Mobile apps currently do not use this API endpoint so always set to null
+          user.refreshToken = null
+          Logger.info(`[UserController] Invalidated JWT sessions for user ${user.username} and rotated tokens for current session`)
+        } else {
+          Logger.info(`[UserController] Invalidated JWT sessions for user ${user.username}`)
+        }
+      }
+
       await user.save()
       SocketAuthority.clientEmitter(req.user.id, 'user_updated', user.toOldJSONForBrowser())
     }
@@ -422,7 +439,16 @@ class UserController {
     const page = toNumber(req.query.page, 0)
 
     const start = page * itemsPerPage
-    const sessions = listeningSessions.slice(start, start + itemsPerPage)
+    // Map user to sessions to match the format of the sessions endpoint
+    const sessions = listeningSessions.slice(start, start + itemsPerPage).map((session) => {
+      return {
+        ...session,
+        user: {
+          id: req.reqUser.id,
+          username: req.reqUser.username
+        }
+      }
+    })
 
     const payload = {
       total: listeningSessions.length,
diff --git a/server/finders/BookFinder.js b/server/finders/BookFinder.js
index 8fde7bc4..2d7b57f1 100644
--- a/server/finders/BookFinder.js
+++ b/server/finders/BookFinder.js
@@ -7,7 +7,7 @@ const FantLab = require('../providers/FantLab')
 const AudiobookCovers = require('../providers/AudiobookCovers')
 const CustomProviderAdapter = require('../providers/CustomProviderAdapter')
 const Logger = require('../Logger')
-const { levenshteinDistance, escapeRegExp } = require('../utils/index')
+const { levenshteinDistance, levenshteinSimilarity, escapeRegExp, isValidASIN } = require('../utils/index')
 const htmlSanitizer = require('../utils/htmlSanitizer')
 
 class BookFinder {
@@ -385,7 +385,11 @@ class BookFinder {
 
     if (!title) return books
 
-    books = await this.runSearch(title, author, provider, asin, maxTitleDistance, maxAuthorDistance)
+    const isTitleAsin = isValidASIN(title.toUpperCase())
+
+    let actualTitleQuery = title
+    let actualAuthorQuery = author
+    books = await this.runSearch(actualTitleQuery, actualAuthorQuery, provider, asin, maxTitleDistance, maxAuthorDistance)
 
     if (!books.length && maxFuzzySearches > 0) {
       // Normalize title and author
@@ -408,19 +412,26 @@ class BookFinder {
         for (const titlePart of titleParts) titleCandidates.add(titlePart)
         titleCandidates = titleCandidates.getCandidates()
         for (const titleCandidate of titleCandidates) {
-          if (titleCandidate == title && authorCandidate == author) continue // We already tried this
+          if (titleCandidate == actualTitleQuery && authorCandidate == actualAuthorQuery) continue // We already tried this
           if (++numFuzzySearches > maxFuzzySearches) break loop_author
-          books = await this.runSearch(titleCandidate, authorCandidate, provider, asin, maxTitleDistance, maxAuthorDistance)
+          actualTitleQuery = titleCandidate
+          actualAuthorQuery = authorCandidate
+          books = await this.runSearch(actualTitleQuery, actualAuthorQuery, provider, asin, maxTitleDistance, maxAuthorDistance)
           if (books.length) break loop_author
         }
       }
     }
 
     if (books.length) {
-      const resultsHaveDuration = provider.startsWith('audible')
-      if (resultsHaveDuration && libraryItem?.media?.duration) {
-        const libraryItemDurationMinutes = libraryItem.media.duration / 60
-        // If provider results have duration, sort by ascendinge duration difference from libraryItem
+      const isAudibleProvider = provider.startsWith('audible')
+      const libraryItemDurationMinutes = libraryItem?.media?.duration ? libraryItem.media.duration / 60 : null
+
+      books.forEach((book) => {
+        if (typeof book !== 'object' || !isAudibleProvider) return
+        book.matchConfidence = this.calculateMatchConfidence(book, libraryItemDurationMinutes, actualTitleQuery, actualAuthorQuery, isTitleAsin)
+      })
+
+      if (isAudibleProvider && libraryItemDurationMinutes) {
         books.sort((a, b) => {
           const aDuration = a.duration || Number.POSITIVE_INFINITY
           const bDuration = b.duration || Number.POSITIVE_INFINITY
@@ -433,6 +444,120 @@ class BookFinder {
     return books
   }
 
+  /**
+   * Calculate match confidence score for a book
+   * @param {Object} book - The book object to calculate confidence for
+   * @param {number|null} libraryItemDurationMinutes - Duration of library item in minutes
+   * @param {string} actualTitleQuery - Actual title query
+   * @param {string} actualAuthorQuery - Actual author query
+   * @param {boolean} isTitleAsin - Whether the title is an ASIN
+   * @returns {number|null} - Match confidence score or null if not applicable
+   */
+  calculateMatchConfidence(book, libraryItemDurationMinutes, actualTitleQuery, actualAuthorQuery, isTitleAsin) {
+    // ASIN results are always a match
+    if (isTitleAsin) return 1.0
+
+    let durationScore
+    if (libraryItemDurationMinutes && typeof book.duration === 'number') {
+      const durationDiff = Math.abs(book.duration - libraryItemDurationMinutes)
+      // Duration scores:
+      // diff | score
+      // 0    | 1.0
+      // 1    | 1.0
+      // 2    | 0.9
+      // 3    | 0.8
+      // 4    | 0.7
+      // 5    | 0.6
+      // 6    | 0.48
+      // 7    | 0.36
+      // 8    | 0.24
+      // 9    | 0.12
+      // 10   | 0.0
+      if (durationDiff <= 1) {
+        // Covers durationDiff = 0 for score 1.0
+        durationScore = 1.0
+      } else if (durationDiff <= 5) {
+        // (1, 5] - Score from 1.0 down to 0.6
+        // Linearly interpolates between (1, 1.0) and (5, 0.6)
+        // Equation: y = 1.0 - 0.08 * x
+        durationScore = 1.1 - 0.1 * durationDiff
+      } else if (durationDiff <= 10) {
+        // (5, 10] - Score from 0.6 down to 0.0
+        // Linearly interpolates between (5, 0.6) and (10, 0.0)
+        // Equation: y = 1.2 - 0.12 * x
+        durationScore = 1.2 - 0.12 * durationDiff
+      } else {
+        // durationDiff > 10 - Score is 0.0
+        durationScore = 0.0
+      }
+      Logger.debug(`[BookFinder] Duration diff: ${durationDiff}, durationScore: ${durationScore}`)
+    } else {
+      // Default score if library item duration or book duration is not available
+      durationScore = 0.1
+    }
+
+    const calculateTitleScore = (titleQuery, book, keepSubtitle = false) => {
+      const cleanTitle = cleanTitleForCompares(book.title || '', keepSubtitle)
+      const cleanSubtitle = keepSubtitle && book.subtitle ? `: ${book.subtitle}` : ''
+      const normBookTitle = `${cleanTitle}${cleanSubtitle}`
+      const normTitleQuery = cleanTitleForCompares(titleQuery, keepSubtitle)
+      const titleSimilarity = levenshteinSimilarity(normTitleQuery, normBookTitle)
+      Logger.debug(`[BookFinder] keepSubtitle: ${keepSubtitle}, normBookTitle: ${normBookTitle}, normTitleQuery: ${normTitleQuery}, titleSimilarity: ${titleSimilarity}`)
+      return titleSimilarity
+    }
+    const titleQueryHasSubtitle = hasSubtitle(actualTitleQuery)
+    const titleScore = calculateTitleScore(actualTitleQuery, book, titleQueryHasSubtitle)
+
+    let authorScore
+    const normAuthorQuery = cleanAuthorForCompares(actualAuthorQuery)
+    const normBookAuthor = cleanAuthorForCompares(book.author || '')
+    if (!normAuthorQuery) {
+      // Original query had no author
+      authorScore = 1.0 // Neutral score
+    } else {
+      // Original query HAS an author (cleanedQueryAuthorForScore is not empty)
+      if (normBookAuthor) {
+        const bookAuthorParts = normBookAuthor.split(',').map((name) => name.trim().toLowerCase())
+        // Filter out empty parts that might result from ", ," or trailing/leading commas
+        const validBookAuthorParts = bookAuthorParts.filter((p) => p.length > 0)
+
+        if (validBookAuthorParts.length === 0) {
+          // Book author string was present but effectively empty (e.g. ",,")
+          // Since cleanedQueryAuthorForScore is non-empty here, this is a mismatch.
+          authorScore = 0.0
+        } else {
+          let maxPartScore = levenshteinSimilarity(normAuthorQuery, normBookAuthor)
+          Logger.debug(`[BookFinder] normAuthorQuery: ${normAuthorQuery}, normBookAuthor: ${normBookAuthor}, similarity: ${maxPartScore}`)
+          if (validBookAuthorParts.length > 1 || normBookAuthor.includes(',')) {
+            validBookAuthorParts.forEach((part) => {
+              // part is guaranteed to be non-empty here
+              // cleanedQueryAuthorForScore is also guaranteed non-empty here.
+              // levenshteinDistance lowercases by default, but part is already lowercased.
+              const similarity = levenshteinSimilarity(normAuthorQuery, part)
+              Logger.debug(`[BookFinder] normAuthorQuery: ${normAuthorQuery}, bookAuthorPart: ${part}, similarity: ${similarity}`)
+              const currentPartScore = similarity
+              maxPartScore = Math.max(maxPartScore, currentPartScore)
+            })
+          }
+          authorScore = maxPartScore
+        }
+      } else {
+        // Book has NO author (or not a string, or empty string)
+        // Query has an author (cleanedQueryAuthorForScore is non-empty), book does not.
+        authorScore = 0.0
+      }
+    }
+
+    const W_DURATION = 0.7
+    const W_TITLE = 0.2
+    const W_AUTHOR = 0.1
+
+    Logger.debug(`[BookFinder] Duration score: ${durationScore}, Title score: ${titleScore}, Author score: ${authorScore}`)
+    const confidence = W_DURATION * durationScore + W_TITLE * titleScore + W_AUTHOR * authorScore
+    Logger.debug(`[BookFinder] Confidence: ${confidence}`)
+    return Math.max(0, Math.min(1, confidence))
+  }
+
   /**
    * Search for books
    *
@@ -464,6 +589,7 @@ class BookFinder {
     } else {
       books = await this.getGoogleBooksResults(title, author)
     }
+
     books.forEach((book) => {
       if (book.description) {
         book.description = htmlSanitizer.sanitize(book.description)
@@ -505,6 +631,9 @@ class BookFinder {
 }
 module.exports = new BookFinder()
 
+function hasSubtitle(title) {
+  return title.includes(':') || title.includes(' - ')
+}
 function stripSubtitle(title) {
   if (title.includes(':')) {
     return title.split(':')[0].trim()
@@ -523,12 +652,12 @@ function replaceAccentedChars(str) {
   }
 }
 
-function cleanTitleForCompares(title) {
+function cleanTitleForCompares(title, keepSubtitle = false) {
   if (!title) return ''
   title = stripRedundantSpaces(title)
 
   // Remove subtitle if there (i.e. "Cool Book: Coolest Ever" becomes "Cool Book")
-  let stripped = stripSubtitle(title)
+  let stripped = keepSubtitle ? title : stripSubtitle(title)
 
   // Remove text in paranthesis (i.e. "Ender's Game (Ender's Saga)" becomes "Ender's Game")
   let cleaned = stripped.replace(/ *\([^)]*\) */g, '')
diff --git a/server/libs/fusejs/index.js b/server/libs/fusejs/index.js
new file mode 100644
index 00000000..23d7f045
--- /dev/null
+++ b/server/libs/fusejs/index.js
@@ -0,0 +1,13 @@
+/**
+ * Source: https://github.com/krisk/Fuse/blob/main/dist/fuse.basic.min.js
+ */
+
+/**
+ * Fuse.js v7.1.0 - Lightweight fuzzy-search (http://fusejs.io)
+ *
+ * Copyright (c) 2025 Kiro Risk (http://kiro.me)
+ * All Rights Reserved. Apache Software License 2.0
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ */
+var e,t;e=this,t=function(){"use strict";function e(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function t(t){for(var n=1;n<arguments.length;n++){var r=null!=arguments[n]?arguments[n]:{};n%2?e(Object(r),!0).forEach((function(e){o(t,e,r[e])})):Object.getOwnPropertyDescriptors?Object.defineProperties(t,Object.getOwnPropertyDescriptors(r)):e(Object(r)).forEach((function(e){Object.defineProperty(t,e,Object.getOwnPropertyDescriptor(r,e))}))}return t}function n(e){return n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},n(e)}function r(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function u(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable||!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,s(r.key),r)}}function i(e,t,n){return t&&u(e.prototype,t),n&&u(e,n),Object.defineProperty(e,"prototype",{writable:!1}),e}function o(e,t,n){return(t=s(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function a(e){return function(e){if(Array.isArray(e))return c(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(e){if("string"==typeof e)return c(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?c(e,t):void 0}}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function c(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function s(e){var t=function(e,t){if("object"!=typeof e||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!=typeof r)return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"==typeof t?t:String(t)}function h(e){return Array.isArray?Array.isArray(e):"[object Array]"===p(e)}var l=1/0;function f(e){return null==e?"":function(e){if("string"==typeof e)return e;var t=e+"";return"0"==t&&1/e==-l?"-0":t}(e)}function d(e){return"string"==typeof e}function v(e){return"number"==typeof e}function g(e){return!0===e||!1===e||function(e){return function(e){return"object"===n(e)}(e)&&null!==e}(e)&&"[object Boolean]"==p(e)}function A(e){return null!=e}function y(e){return!e.trim().length}function p(e){return null==e?void 0===e?"[object Undefined]":"[object Null]":Object.prototype.toString.call(e)}var m=function(e){return"Missing ".concat(e," property in key")},C=function(e){return"Property 'weight' in key '".concat(e,"' must be a positive integer")},F=Object.prototype.hasOwnProperty,E=function(){function e(t){var n=this;r(this,e),this._keys=[],this._keyMap={};var u=0;t.forEach((function(e){var t=B(e);n._keys.push(t),n._keyMap[t.id]=t,u+=t.weight})),this._keys.forEach((function(e){e.weight/=u}))}return i(e,[{key:"get",value:function(e){return this._keyMap[e]}},{key:"keys",value:function(){return this._keys}},{key:"toJSON",value:function(){return JSON.stringify(this._keys)}}]),e}();function B(e){var t=null,n=null,r=null,u=1,i=null;if(d(e)||h(e))r=e,t=D(e),n=b(e);else{if(!F.call(e,"name"))throw new Error(m("name"));var o=e.name;if(r=o,F.call(e,"weight")&&(u=e.weight)<=0)throw new Error(C(o));t=D(o),n=b(o),i=e.getFn}return{path:t,id:n,weight:u,src:r,getFn:i}}function D(e){return h(e)?e:e.split(".")}function b(e){return h(e)?e.join("."):e}var k={useExtendedSearch:!1,getFn:function(e,t){var n=[],r=!1;return function e(t,u,i){if(A(t))if(u[i]){var o=t[u[i]];if(!A(o))return;if(i===u.length-1&&(d(o)||v(o)||g(o)))n.push(f(o));else if(h(o)){r=!0;for(var a=0,c=o.length;a<c;a+=1)e(o[a],u,i+1)}else u.length&&e(o,u,i+1)}else n.push(t)}(e,d(t)?t.split("."):t,0),r?n:n[0]},ignoreLocation:!1,ignoreFieldNorm:!1,fieldNormWeight:1},M=t(t(t(t({},{isCaseSensitive:!1,ignoreDiacritics:!1,includeScore:!1,keys:[],shouldSort:!0,sortFn:function(e,t){return e.score===t.score?e.idx<t.idx?-1:1:e.score<t.score?-1:1}}),{includeMatches:!1,findAllMatches:!1,minMatchCharLength:1}),{location:0,threshold:.6,distance:100}),k),w=/[^ ]+/g,x=function(){function e(){var t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},n=t.getFn,u=void 0===n?M.getFn:n,i=t.fieldNormWeight,o=void 0===i?M.fieldNormWeight:i;r(this,e),this.norm=function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:1,t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:3,n=new Map,r=Math.pow(10,t);return{get:function(t){var u=t.match(w).length;if(n.has(u))return n.get(u);var i=1/Math.pow(u,.5*e),o=parseFloat(Math.round(i*r)/r);return n.set(u,o),o},clear:function(){n.clear()}}}(o,3),this.getFn=u,this.isCreated=!1,this.setIndexRecords()}return i(e,[{key:"setSources",value:function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:[];this.docs=e}},{key:"setIndexRecords",value:function(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:[];this.records=e}},{key:"setKeys",value:function(){var e=this,t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:[];this.keys=t,this._keysMap={},t.forEach((function(t,n){e._keysMap[t.id]=n}))}},{key:"create",value:function(){var e=this;!this.isCreated&&this.docs.length&&(this.isCreated=!0,d(this.docs[0])?this.docs.forEach((function(t,n){e._addString(t,n)})):this.docs.forEach((function(t,n){e._addObject(t,n)})),this.norm.clear())}},{key:"add",value:function(e){var t=this.size();d(e)?this._addString(e,t):this._addObject(e,t)}},{key:"removeAt",value:function(e){this.records.splice(e,1);for(var t=e,n=this.size();t<n;t+=1)this.records[t].i-=1}},{key:"getValueForItemAtKeyId",value:function(e,t){return e[this._keysMap[t]]}},{key:"size",value:function(){return this.records.length}},{key:"_addString",value:function(e,t){if(A(e)&&!y(e)){var n={v:e,i:t,n:this.norm.get(e)};this.records.push(n)}}},{key:"_addObject",value:function(e,t){var n=this,r={i:t,$:{}};this.keys.forEach((function(t,u){var i=t.getFn?t.getFn(e):n.getFn(e,t.path);if(A(i))if(h(i)){for(var o=[],a=[{nestedArrIndex:-1,value:i}];a.length;){var c=a.pop(),s=c.nestedArrIndex,l=c.value;if(A(l))if(d(l)&&!y(l)){var f={v:l,i:s,n:n.norm.get(l)};o.push(f)}else h(l)&&l.forEach((function(e,t){a.push({nestedArrIndex:t,value:e})}))}r.$[u]=o}else if(d(i)&&!y(i)){var v={v:i,n:n.norm.get(i)};r.$[u]=v}})),this.records.push(r)}},{key:"toJSON",value:function(){return{keys:this.keys,records:this.records}}}]),e}();function L(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{},r=n.getFn,u=void 0===r?M.getFn:r,i=n.fieldNormWeight,o=void 0===i?M.fieldNormWeight:i,a=new x({getFn:u,fieldNormWeight:o});return a.setKeys(e.map(B)),a.setSources(t),a.create(),a}function S(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},n=t.errors,r=void 0===n?0:n,u=t.currentLocation,i=void 0===u?0:u,o=t.expectedLocation,a=void 0===o?0:o,c=t.distance,s=void 0===c?M.distance:c,h=t.ignoreLocation,l=void 0===h?M.ignoreLocation:h,f=r/e.length;if(l)return f;var d=Math.abs(a-i);return s?f+d/s:d?1:f}var _=32;function O(e,t,n){var r=arguments.length>3&&void 0!==arguments[3]?arguments[3]:{},u=r.location,i=void 0===u?M.location:u,o=r.distance,a=void 0===o?M.distance:o,c=r.threshold,s=void 0===c?M.threshold:c,h=r.findAllMatches,l=void 0===h?M.findAllMatches:h,f=r.minMatchCharLength,d=void 0===f?M.minMatchCharLength:f,v=r.includeMatches,g=void 0===v?M.includeMatches:v,A=r.ignoreLocation,y=void 0===A?M.ignoreLocation:A;if(t.length>_)throw new Error("Pattern length exceeds max of ".concat(_,"."));for(var p,m=t.length,C=e.length,F=Math.max(0,Math.min(i,C)),E=s,B=F,D=d>1||g,b=D?Array(C):[];(p=e.indexOf(t,B))>-1;){var k=S(t,{currentLocation:p,expectedLocation:F,distance:a,ignoreLocation:y});if(E=Math.min(k,E),B=p+m,D)for(var w=0;w<m;)b[p+w]=1,w+=1}B=-1;for(var x=[],L=1,O=m+C,j=1<<m-1,I=0;I<m;I+=1){for(var N=0,P=O;N<P;)S(t,{errors:I,currentLocation:F+P,expectedLocation:F,distance:a,ignoreLocation:y})<=E?N=P:O=P,P=Math.floor((O-N)/2+N);O=P;var W=Math.max(1,F-P+1),z=l?C:Math.min(F+P,C)+m,T=Array(z+2);T[z+1]=(1<<I)-1;for(var $=z;$>=W;$-=1){var K=$-1,J=n[e.charAt(K)];if(D&&(b[K]=+!!J),T[$]=(T[$+1]<<1|1)&J,I&&(T[$]|=(x[$+1]|x[$])<<1|1|x[$+1]),T[$]&j&&(L=S(t,{errors:I,currentLocation:K,expectedLocation:F,distance:a,ignoreLocation:y}))<=E){if(E=L,(B=K)<=F)break;W=Math.max(1,2*F-B)}}if(S(t,{errors:I+1,currentLocation:F,expectedLocation:F,distance:a,ignoreLocation:y})>E)break;x=T}var R={isMatch:B>=0,score:Math.max(.001,L)};if(D){var U=function(){for(var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:[],t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:M.minMatchCharLength,n=[],r=-1,u=-1,i=0,o=e.length;i<o;i+=1){var a=e[i];a&&-1===r?r=i:a||-1===r||((u=i-1)-r+1>=t&&n.push([r,u]),r=-1)}return e[i-1]&&i-r>=t&&n.push([r,i-1]),n}(b,d);U.length?g&&(R.indices=U):R.isMatch=!1}return R}function j(e){for(var t={},n=0,r=e.length;n<r;n+=1){var u=e.charAt(n);t[u]=(t[u]||0)|1<<r-n-1}return t}var I=String.prototype.normalize?function(e){return e.normalize("NFD").replace(/[\u0300-\u036F\u0483-\u0489\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5\u05C7\u0610-\u061A\u064B-\u065F\u0670\u06D6-\u06DC\u06DF-\u06E4\u06E7\u06E8\u06EA-\u06ED\u0711\u0730-\u074A\u07A6-\u07B0\u07EB-\u07F3\u07FD\u0816-\u0819\u081B-\u0823\u0825-\u0827\u0829-\u082D\u0859-\u085B\u08D3-\u08E1\u08E3-\u0903\u093A-\u093C\u093E-\u094F\u0951-\u0957\u0962\u0963\u0981-\u0983\u09BC\u09BE-\u09C4\u09C7\u09C8\u09CB-\u09CD\u09D7\u09E2\u09E3\u09FE\u0A01-\u0A03\u0A3C\u0A3E-\u0A42\u0A47\u0A48\u0A4B-\u0A4D\u0A51\u0A70\u0A71\u0A75\u0A81-\u0A83\u0ABC\u0ABE-\u0AC5\u0AC7-\u0AC9\u0ACB-\u0ACD\u0AE2\u0AE3\u0AFA-\u0AFF\u0B01-\u0B03\u0B3C\u0B3E-\u0B44\u0B47\u0B48\u0B4B-\u0B4D\u0B56\u0B57\u0B62\u0B63\u0B82\u0BBE-\u0BC2\u0BC6-\u0BC8\u0BCA-\u0BCD\u0BD7\u0C00-\u0C04\u0C3E-\u0C44\u0C46-\u0C48\u0C4A-\u0C4D\u0C55\u0C56\u0C62\u0C63\u0C81-\u0C83\u0CBC\u0CBE-\u0CC4\u0CC6-\u0CC8\u0CCA-\u0CCD\u0CD5\u0CD6\u0CE2\u0CE3\u0D00-\u0D03\u0D3B\u0D3C\u0D3E-\u0D44\u0D46-\u0D48\u0D4A-\u0D4D\u0D57\u0D62\u0D63\u0D82\u0D83\u0DCA\u0DCF-\u0DD4\u0DD6\u0DD8-\u0DDF\u0DF2\u0DF3\u0E31\u0E34-\u0E3A\u0E47-\u0E4E\u0EB1\u0EB4-\u0EB9\u0EBB\u0EBC\u0EC8-\u0ECD\u0F18\u0F19\u0F35\u0F37\u0F39\u0F3E\u0F3F\u0F71-\u0F84\u0F86\u0F87\u0F8D-\u0F97\u0F99-\u0FBC\u0FC6\u102B-\u103E\u1056-\u1059\u105E-\u1060\u1062-\u1064\u1067-\u106D\u1071-\u1074\u1082-\u108D\u108F\u109A-\u109D\u135D-\u135F\u1712-\u1714\u1732-\u1734\u1752\u1753\u1772\u1773\u17B4-\u17D3\u17DD\u180B-\u180D\u1885\u1886\u18A9\u1920-\u192B\u1930-\u193B\u1A17-\u1A1B\u1A55-\u1A5E\u1A60-\u1A7C\u1A7F\u1AB0-\u1ABE\u1B00-\u1B04\u1B34-\u1B44\u1B6B-\u1B73\u1B80-\u1B82\u1BA1-\u1BAD\u1BE6-\u1BF3\u1C24-\u1C37\u1CD0-\u1CD2\u1CD4-\u1CE8\u1CED\u1CF2-\u1CF4\u1CF7-\u1CF9\u1DC0-\u1DF9\u1DFB-\u1DFF\u20D0-\u20F0\u2CEF-\u2CF1\u2D7F\u2DE0-\u2DFF\u302A-\u302F\u3099\u309A\uA66F-\uA672\uA674-\uA67D\uA69E\uA69F\uA6F0\uA6F1\uA802\uA806\uA80B\uA823-\uA827\uA880\uA881\uA8B4-\uA8C5\uA8E0-\uA8F1\uA8FF\uA926-\uA92D\uA947-\uA953\uA980-\uA983\uA9B3-\uA9C0\uA9E5\uAA29-\uAA36\uAA43\uAA4C\uAA4D\uAA7B-\uAA7D\uAAB0\uAAB2-\uAAB4\uAAB7\uAAB8\uAABE\uAABF\uAAC1\uAAEB-\uAAEF\uAAF5\uAAF6\uABE3-\uABEA\uABEC\uABED\uFB1E\uFE00-\uFE0F\uFE20-\uFE2F]/g,"")}:function(e){return e},N=function(){function e(t){var n=this,u=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},i=u.location,o=void 0===i?M.location:i,a=u.threshold,c=void 0===a?M.threshold:a,s=u.distance,h=void 0===s?M.distance:s,l=u.includeMatches,f=void 0===l?M.includeMatches:l,d=u.findAllMatches,v=void 0===d?M.findAllMatches:d,g=u.minMatchCharLength,A=void 0===g?M.minMatchCharLength:g,y=u.isCaseSensitive,p=void 0===y?M.isCaseSensitive:y,m=u.ignoreDiacritics,C=void 0===m?M.ignoreDiacritics:m,F=u.ignoreLocation,E=void 0===F?M.ignoreLocation:F;if(r(this,e),this.options={location:o,threshold:c,distance:h,includeMatches:f,findAllMatches:v,minMatchCharLength:A,isCaseSensitive:p,ignoreDiacritics:C,ignoreLocation:E},t=p?t:t.toLowerCase(),t=C?I(t):t,this.pattern=t,this.chunks=[],this.pattern.length){var B=function(e,t){n.chunks.push({pattern:e,alphabet:j(e),startIndex:t})},D=this.pattern.length;if(D>_){for(var b=0,k=D%_,w=D-k;b<w;)B(this.pattern.substr(b,_),b),b+=_;if(k){var x=D-_;B(this.pattern.substr(x),x)}}else B(this.pattern,0)}}return i(e,[{key:"searchIn",value:function(e){var t=this.options,n=t.isCaseSensitive,r=t.ignoreDiacritics,u=t.includeMatches;if(e=n?e:e.toLowerCase(),e=r?I(e):e,this.pattern===e){var i={isMatch:!0,score:0};return u&&(i.indices=[[0,e.length-1]]),i}var o=this.options,c=o.location,s=o.distance,h=o.threshold,l=o.findAllMatches,f=o.minMatchCharLength,d=o.ignoreLocation,v=[],g=0,A=!1;this.chunks.forEach((function(t){var n=t.pattern,r=t.alphabet,i=t.startIndex,o=O(e,n,r,{location:c+i,distance:s,threshold:h,findAllMatches:l,minMatchCharLength:f,includeMatches:u,ignoreLocation:d}),y=o.isMatch,p=o.score,m=o.indices;y&&(A=!0),g+=p,y&&m&&(v=[].concat(a(v),a(m)))}));var y={isMatch:A,score:A?g/this.chunks.length:1};return A&&u&&(y.indices=v),y}}]),e}(),P=[];function W(e,t){for(var n=0,r=P.length;n<r;n+=1){var u=P[n];if(u.condition(e,t))return new u(e,t)}return new N(e,t)}function z(e,t){var n=e.matches;t.matches=[],A(n)&&n.forEach((function(e){if(A(e.indices)&&e.indices.length){var n={indices:e.indices,value:e.value};e.key&&(n.key=e.key.src),e.idx>-1&&(n.refIndex=e.idx),t.matches.push(n)}}))}function T(e,t){t.score=e.score}var $=function(){function e(n){var u=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},i=arguments.length>2?arguments[2]:void 0;if(r(this,e),this.options=t(t({},M),u),this.options.useExtendedSearch)throw new Error("Extended search is not available");this._keyStore=new E(this.options.keys),this.setCollection(n,i)}return i(e,[{key:"setCollection",value:function(e,t){if(this._docs=e,t&&!(t instanceof x))throw new Error("Incorrect 'index' type");this._myIndex=t||L(this.options.keys,this._docs,{getFn:this.options.getFn,fieldNormWeight:this.options.fieldNormWeight})}},{key:"add",value:function(e){A(e)&&(this._docs.push(e),this._myIndex.add(e))}},{key:"remove",value:function(){for(var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:function(){return!1},t=[],n=0,r=this._docs.length;n<r;n+=1){var u=this._docs[n];e(u,n)&&(this.removeAt(n),n-=1,r-=1,t.push(u))}return t}},{key:"removeAt",value:function(e){this._docs.splice(e,1),this._myIndex.removeAt(e)}},{key:"getIndex",value:function(){return this._myIndex}},{key:"search",value:function(e){var t=(arguments.length>1&&void 0!==arguments[1]?arguments[1]:{}).limit,n=void 0===t?-1:t,r=this.options,u=r.includeMatches,i=r.includeScore,o=r.shouldSort,a=r.sortFn,c=r.ignoreFieldNorm,s=d(e)?d(this._docs[0])?this._searchStringList(e):this._searchObjectList(e):this._searchLogical(e);return function(e,t){var n=t.ignoreFieldNorm,r=void 0===n?M.ignoreFieldNorm:n;e.forEach((function(e){var t=1;e.matches.forEach((function(e){var n=e.key,u=e.norm,i=e.score,o=n?n.weight:null;t*=Math.pow(0===i&&o?Number.EPSILON:i,(o||1)*(r?1:u))})),e.score=t}))}(s,{ignoreFieldNorm:c}),o&&s.sort(a),v(n)&&n>-1&&(s=s.slice(0,n)),function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{},r=n.includeMatches,u=void 0===r?M.includeMatches:r,i=n.includeScore,o=void 0===i?M.includeScore:i,a=[];return u&&a.push(z),o&&a.push(T),e.map((function(e){var n=e.idx,r={item:t[n],refIndex:n};return a.length&&a.forEach((function(t){t(e,r)})),r}))}(s,this._docs,{includeMatches:u,includeScore:i})}},{key:"_searchStringList",value:function(e){var t=W(e,this.options),n=this._myIndex.records,r=[];return n.forEach((function(e){var n=e.v,u=e.i,i=e.n;if(A(n)){var o=t.searchIn(n),a=o.isMatch,c=o.score,s=o.indices;a&&r.push({item:n,idx:u,matches:[{score:c,value:n,norm:i,indices:s}]})}})),r}},{key:"_searchLogical",value:function(e){throw new Error("Logical search is not available")}},{key:"_searchObjectList",value:function(e){var t=this,n=W(e,this.options),r=this._myIndex,u=r.keys,i=r.records,o=[];return i.forEach((function(e){var r=e.$,i=e.i;if(A(r)){var c=[];u.forEach((function(e,u){c.push.apply(c,a(t._findMatches({key:e,value:r[u],searcher:n})))})),c.length&&o.push({idx:i,item:r,matches:c})}})),o}},{key:"_findMatches",value:function(e){var t=e.key,n=e.value,r=e.searcher;if(!A(n))return[];var u=[];if(h(n))n.forEach((function(e){var n=e.v,i=e.i,o=e.n;if(A(n)){var a=r.searchIn(n),c=a.isMatch,s=a.score,h=a.indices;c&&u.push({score:s,key:t,value:n,idx:i,norm:o,indices:h})}}));else{var i=n.v,o=n.n,a=r.searchIn(i),c=a.isMatch,s=a.score,l=a.indices;c&&u.push({score:s,key:t,value:i,norm:o,indices:l})}return u}}]),e}();return $.version="7.1.0",$.createIndex=L,$.parseIndex=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},n=t.getFn,r=void 0===n?M.getFn:n,u=t.fieldNormWeight,i=void 0===u?M.fieldNormWeight:u,o=e.keys,a=e.records,c=new x({getFn:r,fieldNormWeight:i});return c.setKeys(o),c.setIndexRecords(a),c},$.config=M,$},"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).Fuse=t();
\ No newline at end of file
diff --git a/server/managers/CronManager.js b/server/managers/CronManager.js
index 3f948583..d3e65212 100644
--- a/server/managers/CronManager.js
+++ b/server/managers/CronManager.js
@@ -31,10 +31,12 @@ class CronManager {
   }
 
   /**
-   * Initialize open session cleanup cron
+   * Initialize open session & auth session cleanup cron
    * Runs every day at 00:30
    * Closes open share sessions that have not been updated in 24 hours
    * Closes open playback sessions that have not been updated in 36 hours
+   * Cleans up expired auth sessions
+   * Deactivates expired api keys
    * TODO: Clients should re-open the session if it is closed so that stale sessions can be closed sooner
    */
   initOpenSessionCleanupCron() {
@@ -42,6 +44,8 @@ class CronManager {
       Logger.debug('[CronManager] Open session cleanup cron executing')
       ShareManager.closeStaleOpenShareSessions()
       await this.playbackSessionManager.closeStaleOpenSessions()
+      await Database.cleanupExpiredSessions()
+      await Database.deactivateExpiredApiKeys()
     })
   }
 
diff --git a/server/managers/NotificationManager.js b/server/managers/NotificationManager.js
index 8edcf428..567da38e 100644
--- a/server/managers/NotificationManager.js
+++ b/server/managers/NotificationManager.js
@@ -71,6 +71,54 @@ class NotificationManager {
     this.triggerNotification('onBackupCompleted', eventData)
   }
 
+  /**
+   * Handles scheduled episode download RSS feed request failed
+   *
+   * @param {string} feedUrl
+   * @param {number} numFailed
+   * @param {string} title
+   */
+  async onRSSFeedFailed(feedUrl, numFailed, title) {
+    if (!Database.notificationSettings.isUseable) return
+
+    if (!Database.notificationSettings.getHasActiveNotificationsForEvent('onRSSFeedFailed')) {
+      Logger.debug(`[NotificationManager] onRSSFeedFailed: No active notifications`)
+      return
+    }
+
+    Logger.debug(`[NotificationManager] onRSSFeedFailed: RSS feed request failed for ${feedUrl}`)
+    const eventData = {
+      feedUrl: feedUrl,
+      numFailed: numFailed || 0,
+      title: title || 'Unknown Title'
+    }
+    this.triggerNotification('onRSSFeedFailed', eventData)
+  }
+
+  /**
+   * Handles scheduled episode downloads disabled due to too many failed attempts
+   *
+   * @param {string} feedUrl
+   * @param {number} numFailed
+   * @param {string} title
+   */
+  async onRSSFeedDisabled(feedUrl, numFailed, title) {
+    if (!Database.notificationSettings.isUseable) return
+
+    if (!Database.notificationSettings.getHasActiveNotificationsForEvent('onRSSFeedDisabled')) {
+      Logger.debug(`[NotificationManager] onRSSFeedDisabled: No active notifications`)
+      return
+    }
+
+    Logger.debug(`[NotificationManager] onRSSFeedDisabled: Podcast scheduled episode download disabled due to ${numFailed} failed requests for ${feedUrl}`)
+    const eventData = {
+      feedUrl: feedUrl,
+      numFailed: numFailed || 0,
+      title: title || 'Unknown Title'
+    }
+    this.triggerNotification('onRSSFeedDisabled', eventData)
+  }
+
   /**
    *
    * @param {string} errorMsg
diff --git a/server/managers/PlaybackSessionManager.js b/server/managers/PlaybackSessionManager.js
index 39bd2e8f..fb12feda 100644
--- a/server/managers/PlaybackSessionManager.js
+++ b/server/managers/PlaybackSessionManager.js
@@ -107,7 +107,7 @@ class PlaybackSessionManager {
 
     const syncResults = []
     for (const sessionJson of sessions) {
-      Logger.info(`[PlaybackSessionManager] Syncing local session "${sessionJson.displayTitle}" (${sessionJson.id})`)
+      Logger.info(`[PlaybackSessionManager] Syncing local session "${sessionJson.displayTitle}" (${sessionJson.id}) (updatedAt: ${sessionJson.updatedAt})`)
       const result = await this.syncLocalSession(user, sessionJson, deviceInfo)
       syncResults.push(result)
     }
@@ -230,9 +230,9 @@ class PlaybackSessionManager {
     let userProgressForItem = user.getMediaProgress(mediaItemId)
     if (userProgressForItem) {
       if (userProgressForItem.updatedAt.valueOf() > session.updatedAt) {
-        Logger.debug(`[PlaybackSessionManager] Not updating progress for "${session.displayTitle}" because it has been updated more recently`)
+        Logger.info(`[PlaybackSessionManager] Not updating progress for "${session.displayTitle}" because it has been updated more recently (${userProgressForItem.updatedAt.valueOf()} > ${session.updatedAt}) (incoming currentTime: ${session.currentTime}) (current currentTime: ${userProgressForItem.currentTime})`)
       } else {
-        Logger.debug(`[PlaybackSessionManager] Updating progress for "${session.displayTitle}" with current time ${session.currentTime} (previously ${userProgressForItem.currentTime})`)
+        Logger.info(`[PlaybackSessionManager] Updating progress for "${session.displayTitle}" with current time ${session.currentTime} (previously ${userProgressForItem.currentTime})`)
         const updateResponse = await user.createUpdateMediaProgressFromPayload({
           libraryItemId: libraryItem.id,
           episodeId: session.episodeId,
@@ -246,7 +246,7 @@ class PlaybackSessionManager {
         }
       }
     } else {
-      Logger.debug(`[PlaybackSessionManager] Creating new media progress for media item "${session.displayTitle}"`)
+      Logger.info(`[PlaybackSessionManager] Creating new media progress for media item "${session.displayTitle}"`)
       const updateResponse = await user.createUpdateMediaProgressFromPayload({
         libraryItemId: libraryItem.id,
         episodeId: session.episodeId,
diff --git a/server/managers/PodcastManager.js b/server/managers/PodcastManager.js
index 8aedc314..1b6617ac 100644
--- a/server/managers/PodcastManager.js
+++ b/server/managers/PodcastManager.js
@@ -347,10 +347,12 @@ class PodcastManager {
       this.failedCheckMap[libraryItem.id]++
       if (this.MaxFailedEpisodeChecks !== 0 && this.failedCheckMap[libraryItem.id] >= this.MaxFailedEpisodeChecks) {
         Logger.error(`[PodcastManager] runEpisodeCheck ${this.failedCheckMap[libraryItem.id]} failed attempts at checking episodes for "${libraryItem.media.title}" - disabling auto download`)
+        void NotificationManager.onRSSFeedDisabled(libraryItem.media.feedURL, this.failedCheckMap[libraryItem.id], libraryItem.media.title)
         libraryItem.media.autoDownloadEpisodes = false
         delete this.failedCheckMap[libraryItem.id]
       } else {
         Logger.warn(`[PodcastManager] runEpisodeCheck ${this.failedCheckMap[libraryItem.id]} failed attempts at checking episodes for "${libraryItem.media.title}"`)
+        void NotificationManager.onRSSFeedFailed(libraryItem.media.feedURL, this.failedCheckMap[libraryItem.id], libraryItem.media.title)
       }
     } else if (newEpisodes.length) {
       delete this.failedCheckMap[libraryItem.id]
diff --git a/server/migrations/v2.26.0-create-auth-tables.js b/server/migrations/v2.26.0-create-auth-tables.js
new file mode 100644
index 00000000..a1480462
--- /dev/null
+++ b/server/migrations/v2.26.0-create-auth-tables.js
@@ -0,0 +1,163 @@
+/**
+ * @typedef MigrationContext
+ * @property {import('sequelize').QueryInterface} queryInterface - a suquelize QueryInterface object.
+ * @property {import('../Logger')} logger - a Logger object.
+ *
+ * @typedef MigrationOptions
+ * @property {MigrationContext} context - an object containing the migration context.
+ */
+
+const migrationVersion = '2.26.0'
+const migrationName = `${migrationVersion}-create-auth-tables`
+const loggerPrefix = `[${migrationVersion} migration]`
+
+/**
+ * This upward migration creates a sessions table and apiKeys table.
+ *
+ * @param {MigrationOptions} options - an object containing the migration context.
+ * @returns {Promise<void>} - A promise that resolves when the migration is complete.
+ */
+async function up({ context: { queryInterface, logger } }) {
+  // Upwards migration script
+  logger.info(`${loggerPrefix} UPGRADE BEGIN: ${migrationName}`)
+
+  // Check if table exists
+  if (await queryInterface.tableExists('sessions')) {
+    logger.info(`${loggerPrefix} table "sessions" already exists`)
+  } else {
+    // Create table
+    logger.info(`${loggerPrefix} creating table "sessions"`)
+    const DataTypes = queryInterface.sequelize.Sequelize.DataTypes
+    await queryInterface.createTable('sessions', {
+      id: {
+        type: DataTypes.UUID,
+        defaultValue: DataTypes.UUIDV4,
+        primaryKey: true
+      },
+      ipAddress: DataTypes.STRING,
+      userAgent: DataTypes.STRING,
+      refreshToken: {
+        type: DataTypes.STRING,
+        allowNull: false
+      },
+      expiresAt: {
+        type: DataTypes.DATE,
+        allowNull: false
+      },
+      createdAt: {
+        type: DataTypes.DATE,
+        allowNull: false
+      },
+      updatedAt: {
+        type: DataTypes.DATE,
+        allowNull: false
+      },
+      userId: {
+        type: DataTypes.UUID,
+        references: {
+          model: {
+            tableName: 'users'
+          },
+          key: 'id'
+        },
+        allowNull: false,
+        onDelete: 'CASCADE'
+      }
+    })
+    logger.info(`${loggerPrefix} created table "sessions"`)
+  }
+
+  // Check if table exists
+  if (await queryInterface.tableExists('apiKeys')) {
+    logger.info(`${loggerPrefix} table "apiKeys" already exists`)
+  } else {
+    // Create table
+    logger.info(`${loggerPrefix} creating table "apiKeys"`)
+    const DataTypes = queryInterface.sequelize.Sequelize.DataTypes
+    await queryInterface.createTable('apiKeys', {
+      id: {
+        type: DataTypes.UUID,
+        defaultValue: DataTypes.UUIDV4,
+        primaryKey: true
+      },
+      name: {
+        type: DataTypes.STRING,
+        allowNull: false
+      },
+      description: DataTypes.TEXT,
+      expiresAt: DataTypes.DATE,
+      lastUsedAt: DataTypes.DATE,
+      isActive: {
+        type: DataTypes.BOOLEAN,
+        allowNull: false,
+        defaultValue: false
+      },
+      permissions: DataTypes.JSON,
+      createdAt: {
+        type: DataTypes.DATE,
+        allowNull: false
+      },
+      updatedAt: {
+        type: DataTypes.DATE,
+        allowNull: false
+      },
+      userId: {
+        type: DataTypes.UUID,
+        references: {
+          model: {
+            tableName: 'users'
+          },
+          key: 'id'
+        },
+        onDelete: 'CASCADE'
+      },
+      createdByUserId: {
+        type: DataTypes.UUID,
+        references: {
+          model: {
+            tableName: 'users',
+            as: 'createdByUser'
+          },
+          key: 'id'
+        },
+        onDelete: 'SET NULL'
+      }
+    })
+    logger.info(`${loggerPrefix} created table "apiKeys"`)
+  }
+
+  logger.info(`${loggerPrefix} UPGRADE END: ${migrationName}`)
+}
+
+/**
+ * This downward migration script removes the sessions table and apiKeys table.
+ *
+ * @param {MigrationOptions} options - an object containing the migration context.
+ * @returns {Promise<void>} - A promise that resolves when the migration is complete.
+ */
+async function down({ context: { queryInterface, logger } }) {
+  // Downward migration script
+  logger.info(`${loggerPrefix} DOWNGRADE BEGIN: ${migrationName}`)
+
+  // Check if table exists
+  if (await queryInterface.tableExists('sessions')) {
+    logger.info(`${loggerPrefix} dropping table "sessions"`)
+    // Drop table
+    await queryInterface.dropTable('sessions')
+    logger.info(`${loggerPrefix} dropped table "sessions"`)
+  } else {
+    logger.info(`${loggerPrefix} table "sessions" does not exist`)
+  }
+
+  if (await queryInterface.tableExists('apiKeys')) {
+    logger.info(`${loggerPrefix} dropping table "apiKeys"`)
+    await queryInterface.dropTable('apiKeys')
+    logger.info(`${loggerPrefix} dropped table "apiKeys"`)
+  } else {
+    logger.info(`${loggerPrefix} table "apiKeys" does not exist`)
+  }
+
+  logger.info(`${loggerPrefix} DOWNGRADE END: ${migrationName}`)
+}
+
+module.exports = { up, down }
diff --git a/server/models/ApiKey.js b/server/models/ApiKey.js
new file mode 100644
index 00000000..7c61611d
--- /dev/null
+++ b/server/models/ApiKey.js
@@ -0,0 +1,272 @@
+const { DataTypes, Model, Op } = require('sequelize')
+const jwt = require('jsonwebtoken')
+const { LRUCache } = require('lru-cache')
+const Logger = require('../Logger')
+
+/**
+ * @typedef {Object} ApiKeyPermissions
+ * @property {boolean} download
+ * @property {boolean} update
+ * @property {boolean} delete
+ * @property {boolean} upload
+ * @property {boolean} createEreader
+ * @property {boolean} accessAllLibraries
+ * @property {boolean} accessAllTags
+ * @property {boolean} accessExplicitContent
+ * @property {boolean} selectedTagsNotAccessible
+ * @property {string[]} librariesAccessible
+ * @property {string[]} itemTagsSelected
+ */
+
+class ApiKeyCache {
+  constructor() {
+    this.cache = new LRUCache({ max: 100 })
+  }
+
+  getById(id) {
+    const apiKey = this.cache.get(id)
+    return apiKey
+  }
+
+  set(apiKey) {
+    apiKey.fromCache = true
+    this.cache.set(apiKey.id, apiKey)
+  }
+
+  delete(apiKeyId) {
+    this.cache.delete(apiKeyId)
+  }
+
+  maybeInvalidate(apiKey) {
+    if (!apiKey.fromCache) this.delete(apiKey.id)
+  }
+}
+
+const apiKeyCache = new ApiKeyCache()
+
+class ApiKey extends Model {
+  constructor(values, options) {
+    super(values, options)
+
+    /** @type {UUIDV4} */
+    this.id
+    /** @type {string} */
+    this.name
+    /** @type {string} */
+    this.description
+    /** @type {Date} */
+    this.expiresAt
+    /** @type {Date} */
+    this.lastUsedAt
+    /** @type {boolean} */
+    this.isActive
+    /** @type {ApiKeyPermissions} */
+    this.permissions
+    /** @type {Date} */
+    this.createdAt
+    /** @type {Date} */
+    this.updatedAt
+    /** @type {UUIDV4} */
+    this.userId
+    /** @type {UUIDV4} */
+    this.createdByUserId
+
+    // Expanded properties
+
+    /** @type {import('./User').User} */
+    this.user
+  }
+
+  /**
+   * Same properties as User.getDefaultPermissions
+   * @returns {ApiKeyPermissions}
+   */
+  static getDefaultPermissions() {
+    return {
+      download: true,
+      update: true,
+      delete: true,
+      upload: true,
+      createEreader: true,
+      accessAllLibraries: true,
+      accessAllTags: true,
+      accessExplicitContent: true,
+      selectedTagsNotAccessible: false, // Inverts itemTagsSelected
+      librariesAccessible: [],
+      itemTagsSelected: []
+    }
+  }
+
+  /**
+   * Merge permissions from request with default permissions
+   * @param {ApiKeyPermissions} reqPermissions
+   * @returns {ApiKeyPermissions}
+   */
+  static mergePermissionsWithDefault(reqPermissions) {
+    const permissions = this.getDefaultPermissions()
+
+    if (!reqPermissions || typeof reqPermissions !== 'object') {
+      Logger.warn(`[ApiKey] mergePermissionsWithDefault: Invalid permissions: ${reqPermissions}`)
+      return permissions
+    }
+
+    for (const key in reqPermissions) {
+      if (reqPermissions[key] === undefined) {
+        Logger.warn(`[ApiKey] mergePermissionsWithDefault: Invalid permission key: ${key}`)
+        continue
+      }
+
+      if (key === 'librariesAccessible' || key === 'itemTagsSelected') {
+        if (!Array.isArray(reqPermissions[key]) || reqPermissions[key].some((value) => typeof value !== 'string')) {
+          Logger.warn(`[ApiKey] mergePermissionsWithDefault: Invalid ${key} value: ${reqPermissions[key]}`)
+          continue
+        }
+
+        permissions[key] = reqPermissions[key]
+      } else if (typeof reqPermissions[key] !== 'boolean') {
+        Logger.warn(`[ApiKey] mergePermissionsWithDefault: Invalid permission value for key ${key}. Should be boolean`)
+        continue
+      }
+
+      permissions[key] = reqPermissions[key]
+    }
+
+    return permissions
+  }
+
+  /**
+   * Deactivate expired api keys
+   * @returns {Promise<number>} Number of api keys affected
+   */
+  static async deactivateExpiredApiKeys() {
+    const [affectedCount] = await ApiKey.update(
+      {
+        isActive: false
+      },
+      {
+        where: {
+          isActive: true,
+          expiresAt: {
+            [Op.lt]: new Date()
+          }
+        }
+      }
+    )
+    return affectedCount
+  }
+
+  /**
+   * Generate a new api key
+   * @param {string} tokenSecret
+   * @param {string} keyId
+   * @param {string} name
+   * @param {number} [expiresIn] - Seconds until the api key expires or undefined for no expiration
+   * @returns {Promise<string>}
+   */
+  static async generateApiKey(tokenSecret, keyId, name, expiresIn) {
+    const options = {}
+    if (expiresIn && !isNaN(expiresIn) && expiresIn > 0) {
+      options.expiresIn = expiresIn
+    }
+
+    return new Promise((resolve) => {
+      jwt.sign(
+        {
+          keyId,
+          name,
+          type: 'api'
+        },
+        tokenSecret,
+        options,
+        (err, token) => {
+          if (err) {
+            Logger.error(`[ApiKey] Error generating API key: ${err}`)
+            resolve(null)
+          } else {
+            resolve(token)
+          }
+        }
+      )
+    })
+  }
+
+  /**
+   * Get an api key by id, from cache or database
+   * @param {string} apiKeyId
+   * @returns {Promise<ApiKey | null>}
+   */
+  static async getById(apiKeyId) {
+    if (!apiKeyId) return null
+
+    const cachedApiKey = apiKeyCache.getById(apiKeyId)
+    if (cachedApiKey) return cachedApiKey
+
+    const apiKey = await ApiKey.findByPk(apiKeyId)
+    if (!apiKey) return null
+
+    apiKeyCache.set(apiKey)
+    return apiKey
+  }
+
+  /**
+   * Initialize model
+   * @param {import('../Database').sequelize} sequelize
+   */
+  static init(sequelize) {
+    super.init(
+      {
+        id: {
+          type: DataTypes.UUID,
+          defaultValue: DataTypes.UUIDV4,
+          primaryKey: true
+        },
+        name: {
+          type: DataTypes.STRING,
+          allowNull: false
+        },
+        description: DataTypes.TEXT,
+        expiresAt: DataTypes.DATE,
+        lastUsedAt: DataTypes.DATE,
+        isActive: {
+          type: DataTypes.BOOLEAN,
+          allowNull: false,
+          defaultValue: false
+        },
+        permissions: DataTypes.JSON
+      },
+      {
+        sequelize,
+        modelName: 'apiKey'
+      }
+    )
+
+    const { user } = sequelize.models
+    user.hasMany(ApiKey, {
+      onDelete: 'CASCADE'
+    })
+    ApiKey.belongsTo(user)
+
+    user.hasMany(ApiKey, {
+      foreignKey: 'createdByUserId',
+      onDelete: 'SET NULL'
+    })
+    ApiKey.belongsTo(user, { as: 'createdByUser', foreignKey: 'createdByUserId' })
+  }
+
+  async update(values, options) {
+    apiKeyCache.maybeInvalidate(this)
+    return await super.update(values, options)
+  }
+
+  async save(options) {
+    apiKeyCache.maybeInvalidate(this)
+    return await super.save(options)
+  }
+
+  async destroy(options) {
+    apiKeyCache.delete(this.id)
+    await super.destroy(options)
+  }
+}
+
+module.exports = ApiKey
diff --git a/server/models/MediaProgress.js b/server/models/MediaProgress.js
index af3cbc5f..0ebe2f59 100644
--- a/server/models/MediaProgress.js
+++ b/server/models/MediaProgress.js
@@ -183,7 +183,7 @@ class MediaProgress extends Model {
    * @param {import('./User').ProgressUpdatePayload} progressPayload
    * @returns {Promise<MediaProgress>}
    */
-  applyProgressUpdate(progressPayload) {
+  async applyProgressUpdate(progressPayload) {
     if (!this.extraData) this.extraData = {}
     if (progressPayload.isFinished !== undefined) {
       if (progressPayload.isFinished && !this.isFinished) {
@@ -222,13 +222,13 @@ class MediaProgress extends Model {
         const markAsFinishedPercentComplete = Number(progressPayload.markAsFinishedPercentComplete) / 100
         shouldMarkAsFinished = markAsFinishedPercentComplete < this.progress
         if (shouldMarkAsFinished) {
-          Logger.debug(`[MediaProgress] Marking media progress as finished because progress (${this.progress}) is greater than ${markAsFinishedPercentComplete}`)
+          Logger.info(`[MediaProgress] Marking media progress as finished because progress (${this.progress}) is greater than ${markAsFinishedPercentComplete} (media item ${this.mediaItemId})`)
         }
       } else {
         const markAsFinishedTimeRemaining = isNullOrNaN(progressPayload.markAsFinishedTimeRemaining) ? 10 : Number(progressPayload.markAsFinishedTimeRemaining)
         shouldMarkAsFinished = timeRemaining < markAsFinishedTimeRemaining
         if (shouldMarkAsFinished) {
-          Logger.debug(`[MediaProgress] Marking media progress as finished because time remaining (${timeRemaining}) is less than ${markAsFinishedTimeRemaining} seconds`)
+          Logger.info(`[MediaProgress] Marking media progress as finished because time remaining (${timeRemaining}) is less than ${markAsFinishedTimeRemaining} seconds (media item ${this.mediaItemId})`)
         }
       }
     }
@@ -243,13 +243,23 @@ class MediaProgress extends Model {
       this.finishedAt = null
     }
 
+    await this.save()
+
     // For local sync
     if (progressPayload.lastUpdate) {
-      this.updatedAt = progressPayload.lastUpdate
-      this.changed('updatedAt', true)
+      if (isNaN(new Date(progressPayload.lastUpdate))) {
+        Logger.warn(`[MediaProgress] Invalid date provided for lastUpdate: ${progressPayload.lastUpdate} (media item ${this.mediaItemId})`)
+      } else {
+        const escapedDate = this.sequelize.escape(new Date(progressPayload.lastUpdate))
+        Logger.info(`[MediaProgress] Manually setting updatedAt to ${escapedDate} (media item ${this.mediaItemId})`)
+
+        await this.sequelize.query(`UPDATE "mediaProgresses" SET "updatedAt" = ${escapedDate} WHERE "id" = '${this.id}'`)
+
+        await this.reload()
+      }
     }
 
-    return this.save({ silent: !!progressPayload.lastUpdate })
+    return this
   }
 }
 
diff --git a/server/models/PodcastEpisode.js b/server/models/PodcastEpisode.js
index 27e702a1..996f55f5 100644
--- a/server/models/PodcastEpisode.js
+++ b/server/models/PodcastEpisode.js
@@ -185,6 +185,7 @@ class PodcastEpisode extends Model {
     const track = structuredClone(this.audioFile)
     track.startOffset = 0
     track.title = this.audioFile.metadata.filename
+    track.index = 1 // Podcast episodes only have one track
     track.contentUrl = `/api/items/${libraryItemId}/file/${track.ino}`
     return track
   }
diff --git a/server/models/Session.js b/server/models/Session.js
new file mode 100644
index 00000000..fe9dd542
--- /dev/null
+++ b/server/models/Session.js
@@ -0,0 +1,88 @@
+const { DataTypes, Model, Op } = require('sequelize')
+
+class Session extends Model {
+  constructor(values, options) {
+    super(values, options)
+
+    /** @type {UUIDV4} */
+    this.id
+    /** @type {string} */
+    this.ipAddress
+    /** @type {string} */
+    this.userAgent
+    /** @type {Date} */
+    this.createdAt
+    /** @type {Date} */
+    this.updatedAt
+    /** @type {UUIDV4} */
+    this.userId
+    /** @type {Date} */
+    this.expiresAt
+
+    // Expanded properties
+
+    /** @type {import('./User').User} */
+    this.user
+  }
+
+  static async createSession(userId, ipAddress, userAgent, refreshToken, expiresAt) {
+    const session = await Session.create({ userId, ipAddress, userAgent, refreshToken, expiresAt })
+    return session
+  }
+
+  /**
+   * Clean up expired sessions from the database
+   * @returns {Promise<number>} Number of sessions deleted
+   */
+  static async cleanupExpiredSessions() {
+    const deletedCount = await Session.destroy({
+      where: {
+        expiresAt: {
+          [Op.lt]: new Date()
+        }
+      }
+    })
+    return deletedCount
+  }
+
+  /**
+   * Initialize model
+   * @param {import('../Database').sequelize} sequelize
+   */
+  static init(sequelize) {
+    super.init(
+      {
+        id: {
+          type: DataTypes.UUID,
+          defaultValue: DataTypes.UUIDV4,
+          primaryKey: true
+        },
+        ipAddress: DataTypes.STRING,
+        userAgent: DataTypes.STRING,
+        refreshToken: {
+          type: DataTypes.STRING,
+          allowNull: false
+        },
+        expiresAt: {
+          type: DataTypes.DATE,
+          allowNull: false
+        }
+      },
+      {
+        sequelize,
+        modelName: 'session'
+      }
+    )
+
+    const { user } = sequelize.models
+    user.hasMany(Session, {
+      onDelete: 'CASCADE',
+      foreignKey: {
+        allowNull: false
+      }
+    })
+    Session.belongsTo(user)
+  }
+}
+
+module.exports = Session
diff --git a/server/models/User.js b/server/models/User.js
index 999c80b2..bc8a9f6a 100644
--- a/server/models/User.js
+++ b/server/models/User.js
@@ -1,9 +1,11 @@
 const uuidv4 = require('uuid').v4
 const sequelize = require('sequelize')
+const { LRUCache } = require('lru-cache')
+
 const Logger = require('../Logger')
 const SocketAuthority = require('../SocketAuthority')
 const { isNullOrNaN } = require('../utils')
-const { LRUCache } = require('lru-cache')
+const TokenManager = require('../auth/TokenManager')
 
 class UserCache {
   constructor() {
@@ -190,7 +192,7 @@ class User extends Model {
   static async createRootUser(username, pash, auth) {
     const userId = uuidv4()
 
-    const token = await auth.generateAccessToken({ id: userId, username })
+    const token = auth.generateAccessToken({ id: userId, username })
 
     const newUser = {
       id: userId,
@@ -209,18 +211,106 @@ class User extends Model {
   }
 
   /**
-   * Create user from openid userinfo
+   * Finds an existing user by OpenID subject identifier, or by email/username based on server settings,
+   * or creates a new user if configured to do so.
+   *
    * @param {Object} userinfo
-   * @param {import('../Auth')} auth
    * @returns {Promise<User>}
    */
-  static async createUserFromOpenIdUserInfo(userinfo, auth) {
+  static async findOrCreateUserFromOpenIdUserInfo(userinfo) {
+    let user = await this.getUserByOpenIDSub(userinfo.sub)
+
+    // Matched by sub
+    if (user) {
+      Logger.debug(`[User] openid: User found by sub`)
+      return user
+    }
+
+    // Match existing user by email
+    if (global.ServerSettings.authOpenIDMatchExistingBy === 'email') {
+      if (userinfo.email) {
+        // Only disallow when email_verified explicitly set to false (allow both if not set or true)
+        if (userinfo.email_verified === false) {
+          Logger.warn(`[User] openid: User not found and email "${userinfo.email}" is not verified`)
+          return null
+        } else {
+          Logger.info(`[User] openid: User not found, checking existing with email "${userinfo.email}"`)
+          user = await this.getUserByEmail(userinfo.email)
+
+          if (user?.authOpenIDSub) {
+            Logger.warn(`[User] openid: User found with email "${userinfo.email}" but is already matched with sub "${user.authOpenIDSub}"`)
+            return null // User is linked to a different OpenID subject; do not proceed.
+          }
+        }
+      } else {
+        Logger.warn(`[User] openid: User not found and no email in userinfo`)
+        // We deny login, because if the admin whishes to match email, it makes sense to require it
+        return null
+      }
+    }
+    // Match existing user by username
+    else if (global.ServerSettings.authOpenIDMatchExistingBy === 'username') {
+      let username
+
+      if (userinfo.preferred_username) {
+        Logger.info(`[User] openid: User not found, checking existing with userinfo.preferred_username "${userinfo.preferred_username}"`)
+        username = userinfo.preferred_username
+      } else if (userinfo.username) {
+        Logger.info(`[User] openid: User not found, checking existing with userinfo.username "${userinfo.username}"`)
+        username = userinfo.username
+      } else {
+        Logger.warn(`[User] openid: User not found and neither preferred_username nor username in userinfo`)
+        return null
+      }
+
+      user = await this.getUserByUsername(username)
+
+      if (user?.authOpenIDSub) {
+        Logger.warn(`[User] openid: User found with username "${username}" but is already matched with sub "${user.authOpenIDSub}"`)
+        return null // User is linked to a different OpenID subject; do not proceed.
+      }
+    }
+
+    // Found existing user via email or username
+    if (user) {
+      if (!user.isActive) {
+        Logger.warn(`[User] openid: User found but is not active`)
+        return null
+      }
+
+      // Update user with OpenID sub
+      if (!user.extraData) user.extraData = {}
+      user.extraData.authOpenIDSub = userinfo.sub
+      user.changed('extraData', true)
+      await user.save()
+
+      Logger.debug(`[User] openid: User found by email/username`)
+      return user
+    }
+
+    // If no existing user was matched, auto-register if configured
+    if (global.ServerSettings.authOpenIDAutoRegister) {
+      Logger.info(`[User] openid: Auto-registering user with sub "${userinfo.sub}"`, userinfo)
+      user = await this.createUserFromOpenIdUserInfo(userinfo)
+      return user
+    }
+
+    Logger.warn(`[User] openid: User not found and auto-register is disabled`)
+    return null
+  }
+
+  /**
+   * Create user from openid userinfo
+   * @param {Object} userinfo
+   * @returns {Promise<User>}
+   */
+  static async createUserFromOpenIdUserInfo(userinfo) {
     const userId = uuidv4()
     // TODO: Ensure username is unique?
     const username = userinfo.preferred_username || userinfo.name || userinfo.sub
     const email = userinfo.email && userinfo.email_verified ? userinfo.email : null
 
-    const token = await auth.generateAccessToken({ id: userId, username })
+    const token = TokenManager.generateAccessToken({ id: userId, username })
 
     const newUser = {
       id: userId,
@@ -520,7 +610,11 @@ class User extends Model {
       username: this.username,
       email: this.email,
       type: this.type,
+      // TODO: Old non-expiring token
       token: this.type === 'root' && hideRootToken ? '' : this.token,
+      // TODO: Temporary flag not saved in db that is set in Auth.js jwtAuthCheck
+      // Necessary to detect apps using old tokens that no longer match the old token stored on the user
+      isOldToken: this.isOldToken,
       mediaProgress: this.mediaProgresses?.map((mp) => mp.getOldMediaProgress()) || [],
       seriesHideFromContinueListening: [...seriesHideFromContinueListening],
       bookmarks: this.bookmarks?.map((b) => ({ ...b })) || [],
diff --git a/server/objects/settings/ServerSettings.js b/server/objects/settings/ServerSettings.js
index 29913e44..4f0aa97b 100644
--- a/server/objects/settings/ServerSettings.js
+++ b/server/objects/settings/ServerSettings.js
@@ -7,6 +7,7 @@ const User = require('../../models/User')
 class ServerSettings {
   constructor(settings) {
     this.id = 'server-settings'
+    /** @type {string} JWT secret key ONLY used when JWT_SECRET_KEY is not set in ENV */
     this.tokenSecret = null
 
     // Scanner
diff --git a/server/providers/Audible.js b/server/providers/Audible.js
index e6816082..18879e91 100644
--- a/server/providers/Audible.js
+++ b/server/providers/Audible.js
@@ -41,7 +41,7 @@ class Audible {
   }
 
   cleanResult(item) {
-    const { title, subtitle, asin, authors, narrators, publisherName, summary, releaseDate, image, genres, seriesPrimary, seriesSecondary, language, runtimeLengthMin, formatType } = item
+    const { title, subtitle, asin, authors, narrators, publisherName, summary, releaseDate, image, genres, seriesPrimary, seriesSecondary, language, runtimeLengthMin, formatType, isbn } = item
 
     const series = []
     if (seriesPrimary) {
@@ -70,6 +70,7 @@ class Audible {
       description: summary || null,
       cover: image,
       asin,
+      isbn,
       genres: genresFiltered.length ? genresFiltered : null,
       tags: tagsFiltered.length ? tagsFiltered.join(', ') : null,
       series: series.length ? series : null,
diff --git a/server/providers/FantLab.js b/server/providers/FantLab.js
index dd9f60cc..f33934ca 100644
--- a/server/providers/FantLab.js
+++ b/server/providers/FantLab.js
@@ -52,9 +52,7 @@ class FantLab {
         return []
       })
 
-    return Promise.all(items.map(async (item) => await this.getWork(item, timeout))).then((resArray) => {
-      return resArray.filter((res) => res)
-    })
+    return Promise.all(items.map(async (item) => await this.getWork(item, timeout))).then((resArray) => resArray.filter(Boolean))
   }
 
   /**
@@ -83,6 +81,10 @@ class FantLab {
         return null
       })
 
+    if (!bookData) {
+      return null
+    }
+
     return this.cleanBookData(bookData, timeout)
   }
 
diff --git a/server/routers/ApiRouter.js b/server/routers/ApiRouter.js
index ecb1555f..6446ecc8 100644
--- a/server/routers/ApiRouter.js
+++ b/server/routers/ApiRouter.js
@@ -34,6 +34,7 @@ const CustomMetadataProviderController = require('../controllers/CustomMetadataP
 const MiscController = require('../controllers/MiscController')
 const ShareController = require('../controllers/ShareController')
 const StatsController = require('../controllers/StatsController')
+const ApiKeyController = require('../controllers/ApiKeyController')
 
 class ApiRouter {
   constructor(Server) {
@@ -181,7 +182,7 @@ class ApiRouter {
     this.router.post('/me/item/:id/bookmark', MeController.createBookmark.bind(this))
     this.router.patch('/me/item/:id/bookmark', MeController.updateBookmark.bind(this))
     this.router.delete('/me/item/:id/bookmark/:time', MeController.removeBookmark.bind(this))
-    this.router.patch('/me/password', MeController.updatePassword.bind(this))
+    this.router.patch('/me/password', this.auth.authRateLimiter, MeController.updatePassword.bind(this))
     this.router.get('/me/items-in-progress', MeController.getAllLibraryItemsInProgress.bind(this))
     this.router.get('/me/series/:id/remove-from-continue-listening', MeController.removeSeriesFromContinueListening.bind(this))
     this.router.get('/me/series/:id/readd-to-continue-listening', MeController.readdSeriesFromContinueListening.bind(this))
@@ -325,6 +326,14 @@ class ApiRouter {
     this.router.get('/stats/year/:year', StatsController.middleware.bind(this), StatsController.getAdminStatsForYear.bind(this))
     this.router.get('/stats/server', StatsController.middleware.bind(this), StatsController.getServerStats.bind(this))
 
+    //
+    // API Key Routes
+    //
+    this.router.get('/api-keys', ApiKeyController.middleware.bind(this), ApiKeyController.getAll.bind(this))
+    this.router.post('/api-keys', ApiKeyController.middleware.bind(this), ApiKeyController.create.bind(this))
+    this.router.patch('/api-keys/:id', ApiKeyController.middleware.bind(this), ApiKeyController.update.bind(this))
+    this.router.delete('/api-keys/:id', ApiKeyController.middleware.bind(this), ApiKeyController.delete.bind(this))
+
     //
     // Misc Routes
     //
diff --git a/server/scanner/LibraryItemScanner.js b/server/scanner/LibraryItemScanner.js
index 133a1e30..501df427 100644
--- a/server/scanner/LibraryItemScanner.js
+++ b/server/scanner/LibraryItemScanner.js
@@ -206,6 +206,11 @@ class LibraryItemScanner {
   async scanPotentialNewLibraryItem(libraryItemPath, library, folder, isSingleMediaItem) {
     const libraryItemScanData = await this.getLibraryItemScanData(libraryItemPath, library, folder, isSingleMediaItem)
 
+    if (!libraryItemScanData.libraryFiles.length) {
+      Logger.info(`[LibraryItemScanner] Library item at path "${libraryItemPath}" has no files - ignoring`)
+      return null
+    }
+
     const scanLogger = new ScanLogger()
     scanLogger.verbose = true
     scanLogger.setData('libraryItem', libraryItemScanData.relPath)
diff --git a/server/scanner/LibraryScanner.js b/server/scanner/LibraryScanner.js
index bc174d7a..640c82d7 100644
--- a/server/scanner/LibraryScanner.js
+++ b/server/scanner/LibraryScanner.js
@@ -606,6 +606,11 @@ class LibraryScanner {
       } else if (library.settings.audiobooksOnly && !hasAudioFiles(fileUpdateGroup, itemDir)) {
         Logger.debug(`[LibraryScanner] Folder update for relative path "${itemDir}" has no audio files`)
         continue
+      } else if (!(await fs.pathExists(fullPath))) {
+        Logger.info(`[LibraryScanner] File update group "${itemDir}" does not exist - ignoring`)
+
+        itemGroupingResults[itemDir] = ScanResult.NOTHING
+        continue
       }
 
       // Check if a library item is a subdirectory of this dir
diff --git a/server/scanner/Scanner.js b/server/scanner/Scanner.js
index 1e2751ed..206068cc 100644
--- a/server/scanner/Scanner.js
+++ b/server/scanner/Scanner.js
@@ -370,7 +370,7 @@ class Scanner {
 
     let numEpisodesUpdated = 0
     for (const episode of episodesToQuickMatch) {
-      const episodeMatches = findMatchingEpisodesInFeed(feed, episode.title)
+      const episodeMatches = findMatchingEpisodesInFeed(feed, episode.title, 0.1)
       if (episodeMatches?.length) {
         const wasUpdated = await this.updateEpisodeWithMatch(episode, episodeMatches[0].episode, options)
         if (wasUpdated) numEpisodesUpdated++
diff --git a/server/utils/ffmpegHelpers.js b/server/utils/ffmpegHelpers.js
index 9c88ef71..357a2084 100644
--- a/server/utils/ffmpegHelpers.js
+++ b/server/utils/ffmpegHelpers.js
@@ -103,18 +103,39 @@ module.exports.resizeImage = resizeImage
  */
 module.exports.downloadPodcastEpisode = (podcastEpisodeDownload) => {
   return new Promise(async (resolve) => {
-    const response = await axios({
-      url: podcastEpisodeDownload.url,
-      method: 'GET',
-      responseType: 'stream',
-      headers: {
-        'User-Agent': 'audiobookshelf (+https://audiobookshelf.org)'
-      },
-      timeout: global.PodcastDownloadTimeout
-    }).catch((error) => {
-      Logger.error(`[ffmpegHelpers] Failed to download podcast episode with url "${podcastEpisodeDownload.url}"`, error)
-      return null
-    })
+    // Some podcasts fail due to user agent strings
+    // See: https://github.com/advplyr/audiobookshelf/issues/3246 (requires iTMS user agent)
+    // See: https://github.com/advplyr/audiobookshelf/issues/4401 (requires no iTMS user agent)
+    const userAgents = ['audiobookshelf (+https://audiobookshelf.org; like iTMS)', 'audiobookshelf (+https://audiobookshelf.org)']
+
+    let response = null
+    let lastError = null
+
+    for (const userAgent of userAgents) {
+      try {
+        response = await axios({
+          url: podcastEpisodeDownload.url,
+          method: 'GET',
+          responseType: 'stream',
+          headers: {
+            'User-Agent': userAgent
+          },
+          timeout: global.PodcastDownloadTimeout
+        })
+
+        Logger.debug(`[ffmpegHelpers] Successfully connected with User-Agent: ${userAgent}`)
+        break
+      } catch (error) {
+        lastError = error
+        Logger.warn(`[ffmpegHelpers] Failed to download podcast episode with User-Agent "${userAgent}" for url "${podcastEpisodeDownload.url}"`, error.message)
+
+        // If this is the last attempt, log the full error
+        if (userAgent === userAgents[userAgents.length - 1]) {
+          Logger.error(`[ffmpegHelpers] All User-Agent attempts failed for url "${podcastEpisodeDownload.url}"`, lastError)
+        }
+      }
+    }
+
     if (!response) {
       return resolve({
         success: false
diff --git a/server/utils/fileUtils.js b/server/utils/fileUtils.js
index f80c4acd..2da6b4c9 100644
--- a/server/utils/fileUtils.js
+++ b/server/utils/fileUtils.js
@@ -109,7 +109,7 @@ function getIno(path) {
     .stat(path, { bigint: true })
     .then((data) => String(data.ino))
     .catch((err) => {
-      Logger.error('[Utils] Failed to get ino for path', path, err)
+      Logger.warn(`[Utils] Failed to get ino for path "${path}"`, err)
       return null
     })
 }
diff --git a/server/utils/index.js b/server/utils/index.js
index 9f7d961c..36962027 100644
--- a/server/utils/index.js
+++ b/server/utils/index.js
@@ -34,6 +34,14 @@ const levenshteinDistance = (str1, str2, caseSensitive = false) => {
 }
 module.exports.levenshteinDistance = levenshteinDistance
 
+const levenshteinSimilarity = (str1, str2, caseSensitive = false) => {
+  const distance = levenshteinDistance(str1, str2, caseSensitive)
+  const maxLength = Math.max(str1.length, str2.length)
+  if (maxLength === 0) return 1
+  return 1 - distance / maxLength
+}
+module.exports.levenshteinSimilarity = levenshteinSimilarity
+
 module.exports.isObject = (val) => {
   return val !== null && typeof val === 'object'
 }
diff --git a/server/utils/notifications.js b/server/utils/notifications.js
index 7a3e1198..700d3c38 100644
--- a/server/utils/notifications.js
+++ b/server/utils/notifications.js
@@ -60,6 +60,38 @@ module.exports.notificationData = {
         errorMsg: 'Example error message'
       }
     },
+    {
+      name: 'onRSSFeedFailed',
+      requiresLibrary: true,
+      description: 'Triggered when the RSS feed request fails for an automatic episode download',
+      descriptionKey: 'NotificationOnRSSFeedFailedDescription',
+      variables: ['feedUrl', 'numFailed', 'title'],
+      defaults: {
+        title: 'RSS Feed Request Failed',
+        body: 'Failed to request RSS feed for {{title}}.\nFeed URL: {{feedUrl}}\nNumber of failed attempts: {{numFailed}}'
+      },
+      testData: {
+        title: 'Test RSS Feed',
+        feedUrl: 'https://example.com/rss',
+        numFailed: 3
+      }
+    },
+    {
+      name: 'onRSSFeedDisabled',
+      requiresLibrary: true,
+      description: 'Triggered when automatic episode downloads are disabled due to too many failed attempts',
+      descriptionKey: 'NotificationOnRSSFeedDisabledDescription',
+      variables: ['feedUrl', 'numFailed', 'title'],
+      defaults: {
+        title: 'Podcast Episode Download Schedule Disabled',
+        body: 'Automatic episode downloads for {{title}} have been disabled due to too many failed RSS feed requests.\nFeed URL: {{feedUrl}}\nNumber of failed attempts: {{numFailed}}'
+      },
+      testData: {
+        title: 'Test RSS Feed',
+        feedUrl: 'https://example.com/rss',
+        numFailed: 5
+      }
+    },
     {
       name: 'onTest',
       requiresLibrary: false,
diff --git a/server/utils/podcastUtils.js b/server/utils/podcastUtils.js
index 3a1df198..b62e024f 100644
--- a/server/utils/podcastUtils.js
+++ b/server/utils/podcastUtils.js
@@ -1,8 +1,9 @@
 const axios = require('axios')
 const ssrfFilter = require('ssrf-req-filter')
 const Logger = require('../Logger')
-const { xmlToJSON, levenshteinDistance, timestampToSeconds } = require('./index')
+const { xmlToJSON, timestampToSeconds } = require('./index')
 const htmlSanitizer = require('../utils/htmlSanitizer')
+const Fuse = require('../libs/fusejs')
 
 /**
  * @typedef RssPodcastChapter
@@ -24,6 +25,7 @@ const htmlSanitizer = require('../utils/htmlSanitizer')
  * @property {string} episode
  * @property {string} author
  * @property {string} duration
+ * @property {number|null} durationSeconds - Parsed from duration string if duration is valid
  * @property {string} explicit
  * @property {number} publishedAt - Unix timestamp
  * @property {{ url: string, type?: string, length?: string }} enclosure
@@ -216,8 +218,9 @@ function extractEpisodeData(item) {
   })
 
   // Extract psc:chapters if duration is set
-  let episodeDuration = !isNaN(episode.duration) ? timestampToSeconds(episode.duration) : null
-  if (item['psc:chapters']?.[0]?.['psc:chapter']?.length && episodeDuration) {
+  episode.durationSeconds = episode.duration ? timestampToSeconds(episode.duration) : null
+
+  if (item['psc:chapters']?.[0]?.['psc:chapter']?.length && episode.durationSeconds) {
     // Example chapter:
     // {"id":0,"start":0,"end":43.004286,"title":"chapter 1"}
 
@@ -243,7 +246,7 @@ function extractEpisodeData(item) {
     } else {
       episode.chapters = cleanedChapters.map((chapter, index) => {
         const nextChapter = cleanedChapters[index + 1]
-        const end = nextChapter ? nextChapter.start : episodeDuration
+        const end = nextChapter ? nextChapter.start : episode.durationSeconds
         return {
           id: chapter.id,
           title: chapter.title,
@@ -272,6 +275,7 @@ function cleanEpisodeData(data) {
     episode: data.episode || '',
     author: data.author || '',
     duration: data.duration || '',
+    durationSeconds: data.durationSeconds || null,
     explicit: data.explicit || '',
     publishedAt,
     enclosure: data.enclosure,
@@ -407,7 +411,7 @@ module.exports.getPodcastFeed = (feedUrl, excludeEpisodeMetadata = false) => {
     })
 }
 
-// Return array of episodes ordered by closest match (Levenshtein distance of 6 or less)
+// Return array of episodes ordered by closest match using fuse.js
 module.exports.findMatchingEpisodes = async (feedUrl, searchTitle) => {
   const feed = await this.getPodcastFeed(feedUrl).catch(() => {
     return null
@@ -420,32 +424,29 @@ module.exports.findMatchingEpisodes = async (feedUrl, searchTitle) => {
  *
  * @param {RssPodcast} feed
  * @param {string} searchTitle
- * @returns {Array<{ episode: RssPodcastEpisode, levenshtein: number }>}
+ * @param {number} [threshold=0.4] - 0.0 for perfect match, 1.0 for match anything
+ * @returns {Array<{ episode: RssPodcastEpisode }>}
  */
-module.exports.findMatchingEpisodesInFeed = (feed, searchTitle) => {
-  searchTitle = searchTitle.toLowerCase().trim()
+module.exports.findMatchingEpisodesInFeed = (feed, searchTitle, threshold = 0.4) => {
   if (!feed?.episodes) {
     return null
   }
 
+  const fuseOptions = {
+    ignoreDiacritics: true,
+    threshold,
+    keys: [
+      { name: 'title', weight: 0.7 }, // prefer match in title
+      { name: 'subtitle', weight: 0.3 }
+    ]
+  }
+  const fuse = new Fuse(feed.episodes, fuseOptions)
+
   const matches = []
-  feed.episodes.forEach((ep) => {
-    if (!ep.title) return
-    const epTitle = ep.title.toLowerCase().trim()
-    if (epTitle === searchTitle) {
-      matches.push({
-        episode: ep,
-        levenshtein: 0
-      })
-    } else {
-      const levenshtein = levenshteinDistance(searchTitle, epTitle, true)
-      if (levenshtein <= 6 && epTitle.length > levenshtein) {
-        matches.push({
-          episode: ep,
-          levenshtein
-        })
-      }
-    }
+  fuse.search(searchTitle).forEach((match) => {
+    matches.push({
+      episode: match.item
+    })
   })
-  return matches.sort((a, b) => a.levenshtein - b.levenshtein)
+  return matches
 }
diff --git a/server/utils/queries/libraryItemsBookFilters.js b/server/utils/queries/libraryItemsBookFilters.js
index 42c39120..85d7f387 100644
--- a/server/utils/queries/libraryItemsBookFilters.js
+++ b/server/utils/queries/libraryItemsBookFilters.js
@@ -186,6 +186,8 @@ module.exports = {
       mediaWhere['$series.id$'] = null
     } else if (group === 'abridged') {
       mediaWhere['abridged'] = true
+    } else if (group === 'explicit') {
+      mediaWhere['explicit'] = true
     } else if (['genres', 'tags', 'narrators'].includes(group)) {
       mediaWhere[group] = Sequelize.where(Sequelize.literal(`(SELECT count(*) FROM json_each(${group}) WHERE json_valid(${group}) AND json_each.value = :filterValue)`), {
         [Sequelize.Op.gte]: 1
@@ -251,6 +253,15 @@ module.exports = {
    */
   getOrder(sortBy, sortDesc, collapseseries) {
     const dir = sortDesc ? 'DESC' : 'ASC'
+
+    const getTitleOrder = () => {
+      if (global.ServerSettings.sortingIgnorePrefix) {
+        return [Sequelize.literal('`libraryItem`.`titleIgnorePrefix` COLLATE NOCASE'), dir]
+      } else {
+        return [Sequelize.literal('`libraryItem`.`title` COLLATE NOCASE'), dir]
+      }
+    }
+
     if (sortBy === 'addedAt') {
       return [[Sequelize.literal('libraryItem.createdAt'), dir]]
     } else if (sortBy === 'size') {
@@ -264,19 +275,16 @@ module.exports = {
     } else if (sortBy === 'media.metadata.publishedYear') {
       return [[Sequelize.literal(`CAST(\`book\`.\`publishedYear\` AS INTEGER)`), dir]]
     } else if (sortBy === 'media.metadata.authorNameLF') {
-      return [[Sequelize.literal('`libraryItem`.`authorNamesLastFirst` COLLATE NOCASE'), dir]]
+      // Sort by author name last first, secondary sort by title
+      return [[Sequelize.literal('`libraryItem`.`authorNamesLastFirst` COLLATE NOCASE'), dir], getTitleOrder()]
     } else if (sortBy === 'media.metadata.authorName') {
-      return [[Sequelize.literal('`libraryItem`.`authorNamesFirstLast` COLLATE NOCASE'), dir]]
+      // Sort by author name first last, secondary sort by title
+      return [[Sequelize.literal('`libraryItem`.`authorNamesFirstLast` COLLATE NOCASE'), dir], getTitleOrder()]
     } else if (sortBy === 'media.metadata.title') {
       if (collapseseries) {
         return [[Sequelize.literal('display_title COLLATE NOCASE'), dir]]
       }
-
-      if (global.ServerSettings.sortingIgnorePrefix) {
-        return [[Sequelize.literal('`libraryItem`.`titleIgnorePrefix` COLLATE NOCASE'), dir]]
-      } else {
-        return [[Sequelize.literal('`libraryItem`.`title` COLLATE NOCASE'), dir]]
-      }
+      return [getTitleOrder()]
     } else if (sortBy === 'sequence') {
       const nullDir = sortDesc ? 'DESC NULLS FIRST' : 'ASC NULLS LAST'
       return [[Sequelize.literal(`CAST(\`series.bookSeries.sequence\` AS FLOAT) ${nullDir}`)]]
@@ -391,9 +399,6 @@ module.exports = {
     if (filterGroup !== 'series' && sortBy === 'sequence') {
       sortBy = 'media.metadata.title'
     }
-    if (filterGroup !== 'progress' && sortBy === 'progress') {
-      sortBy = 'media.metadata.title'
-    }
     const includeRSSFeed = include.includes('rssfeed')
     const includeMediaItemShare = !!user?.isAdminOrUp && include.includes('share')
 
@@ -524,6 +529,18 @@ module.exports = {
       }
     }
 
+    // When sorting by progress but not filtering by progress, include media progresses
+    if (filterGroup !== 'progress' && sortBy === 'progress') {
+      bookIncludes.push({
+        model: Database.mediaProgressModel,
+        attributes: ['id', 'isFinished', 'currentTime', 'ebookProgress', 'updatedAt'],
+        where: {
+          userId: user.id
+        },
+        required: false
+      })
+    }
+
     let { mediaWhere, replacements } = this.getMediaGroupQuery(filterGroup, filterValue)
     let bookWhere = Array.isArray(mediaWhere) ? mediaWhere : [mediaWhere]
 
diff --git a/server/utils/queries/libraryItemsPodcastFilters.js b/server/utils/queries/libraryItemsPodcastFilters.js
index 33bac28f..8bb5dc11 100644
--- a/server/utils/queries/libraryItemsPodcastFilters.js
+++ b/server/utils/queries/libraryItemsPodcastFilters.js
@@ -59,6 +59,8 @@ module.exports = {
       replacements.filterValue = value
     } else if (group === 'languages') {
       mediaWhere['language'] = value
+    } else if (group === 'explicit') {
+      mediaWhere['explicit'] = true
     }
 
     return {
diff --git a/server/utils/rateLimiterFactory.js b/server/utils/rateLimiterFactory.js
new file mode 100644
index 00000000..e639c51c
--- /dev/null
+++ b/server/utils/rateLimiterFactory.js
@@ -0,0 +1,82 @@
+const { rateLimit, RateLimitRequestHandler } = require('express-rate-limit')
+const Logger = require('../Logger')
+const requestIp = require('../libs/requestIp')
+
+/**
+ * Factory for creating authentication rate limiters
+ */
+class RateLimiterFactory {
+  static DEFAULT_WINDOW_MS = 10 * 60 * 1000 // 10 minutes
+  static DEFAULT_MAX = 40 // 40 attempts
+
+  constructor() {
+    this.authRateLimiter = null
+  }
+
+  /**
+   * Get the authentication rate limiter
+   * @returns {RateLimitRequestHandler}
+   */
+  getAuthRateLimiter() {
+    if (this.authRateLimiter) {
+      return this.authRateLimiter
+    }
+
+    // Disable by setting max to 0
+    if (process.env.RATE_LIMIT_AUTH_MAX === '0') {
+      this.authRateLimiter = (req, res, next) => next()
+      Logger.info(`[RateLimiterFactory] Authentication rate limiting disabled by ENV variable`)
+      return this.authRateLimiter
+    }
+
+    let windowMs = RateLimiterFactory.DEFAULT_WINDOW_MS
+    if (parseInt(process.env.RATE_LIMIT_AUTH_WINDOW) > 0) {
+      windowMs = parseInt(process.env.RATE_LIMIT_AUTH_WINDOW)
+      if (windowMs !== RateLimiterFactory.DEFAULT_WINDOW_MS) {
+        Logger.info(`[RateLimiterFactory] Authentication rate limiting window set to ${windowMs}ms by ENV variable`)
+      }
+    }
+
+    let max = RateLimiterFactory.DEFAULT_MAX
+    if (parseInt(process.env.RATE_LIMIT_AUTH_MAX) > 0) {
+      max = parseInt(process.env.RATE_LIMIT_AUTH_MAX)
+      if (max !== RateLimiterFactory.DEFAULT_MAX) {
+        Logger.info(`[RateLimiterFactory] Authentication rate limiting max set to ${max} by ENV variable`)
+      }
+    }
+
+    let message = 'Too many authentication requests'
+    if (process.env.RATE_LIMIT_AUTH_MESSAGE) {
+      message = process.env.RATE_LIMIT_AUTH_MESSAGE
+    }
+
+    this.authRateLimiter = rateLimit({
+      windowMs,
+      max,
+      standardHeaders: true,
+      legacyHeaders: false,
+      keyGenerator: (req) => {
+        // Override keyGenerator to handle proxy IPs
+        return requestIp.getClientIp(req) || req.ip
+      },
+      handler: (req, res) => {
+        const userAgent = req.get('User-Agent') || 'Unknown'
+        const endpoint = req.path
+        const method = req.method
+        const ip = requestIp.getClientIp(req) || req.ip
+
+        Logger.warn(`[RateLimiter] Rate limit exceeded - IP: ${ip}, Endpoint: ${method} ${endpoint}, User-Agent: ${userAgent}`)
+
+        res.status(429).json({
+          error: message
+        })
+      }
+    })
+
+    Logger.debug(`[RateLimiterFactory] Created auth rate limiter: ${max} attempts per ${windowMs / 1000 / 60} minutes`)
+
+    return this.authRateLimiter
+  }
+}
+
+module.exports = new RateLimiterFactory()
diff --git a/test/server/controllers/LibraryItemController.test.js b/test/server/controllers/LibraryItemController.test.js
index 9972bd90..5a042239 100644
--- a/test/server/controllers/LibraryItemController.test.js
+++ b/test/server/controllers/LibraryItemController.test.js
@@ -6,6 +6,7 @@ const Database = require('../../../server/Database')
 const ApiRouter = require('../../../server/routers/ApiRouter')
 const LibraryItemController = require('../../../server/controllers/LibraryItemController')
 const ApiCacheManager = require('../../../server/managers/ApiCacheManager')
+const Auth = require('../../../server/Auth')
 const Logger = require('../../../server/Logger')
 
 describe('LibraryItemController', () => {
@@ -19,6 +20,7 @@ describe('LibraryItemController', () => {
     await Database.buildModels()
 
     apiRouter = new ApiRouter({
+      auth: new Auth(),
       apiCacheManager: new ApiCacheManager()
     })
 
diff --git a/test/server/finders/BookFinder.test.js b/test/server/finders/BookFinder.test.js
index c986cc98..6578ca82 100644
--- a/test/server/finders/BookFinder.test.js
+++ b/test/server/finders/BookFinder.test.js
@@ -5,6 +5,12 @@ const bookFinder = require('../../../server/finders/BookFinder')
 const { LogLevel } = require('../../../server/utils/constants')
 const Logger = require('../../../server/Logger')
 Logger.setLogLevel(LogLevel.INFO)
+const { levenshteinDistance } = require('../../../server/utils/index')
+
+// levenshteinDistance is needed for manual calculation of expected scores in tests.
+// Assuming it's accessible for testing purposes or we mock/replicate its basic behavior if needed.
+// For now, we'll assume bookFinder.search uses it internally correctly.
+// const { levenshteinDistance } = require('../../../server/utils/index') // Not used directly in test logic, but for reasoning.
 
 describe('TitleCandidates', () => {
   describe('cleanAuthor non-empty', () => {
@@ -326,31 +332,262 @@ describe('search', () => {
     const sorted = [{ duration: 1000 }, { duration: 500 }, { duration: 2000 }, { duration: 3000 }]
 
     beforeEach(() => {
-      runSearchStub.withArgs(t, a, provider).resolves(unsorted)
+      runSearchStub.withArgs(t, a, provider).resolves(structuredClone(unsorted))
+    })
+
+    afterEach(() => {
+      sinon.restore()
     })
 
     it('returns results sorted by library item duration diff', async () => {
-      expect(await bookFinder.search(libraryItem, provider, t, a)).to.deep.equal(sorted)
+      const result = (await bookFinder.search(libraryItem, provider, t, a)).map((r) => (r.duration ? { duration: r.duration } : {}))
+      expect(result).to.deep.equal(sorted)
     })
 
     it('returns unsorted results if library item is null', async () => {
-      expect(await bookFinder.search(null, provider, t, a)).to.deep.equal(unsorted)
+      const result = (await bookFinder.search(null, provider, t, a)).map((r) => (r.duration ? { duration: r.duration } : {}))
+      expect(result).to.deep.equal(unsorted)
     })
 
     it('returns unsorted results if library item duration is undefined', async () => {
-      expect(await bookFinder.search({ media: {} }, provider, t, a)).to.deep.equal(unsorted)
+      const result = (await bookFinder.search({ media: {} }, provider, t, a)).map((r) => (r.duration ? { duration: r.duration } : {}))
+      expect(result).to.deep.equal(unsorted)
     })
 
     it('returns unsorted results if library item media is undefined', async () => {
-      expect(await bookFinder.search({}, provider, t, a)).to.deep.equal(unsorted)
+      const result = (await bookFinder.search({}, provider, t, a)).map((r) => (r.duration ? { duration: r.duration } : {}))
+      expect(result).to.deep.equal(unsorted)
     })
 
     it('should return a result last if it has no duration', async () => {
       const unsorted = [{}, { duration: 3000 }, { duration: 2000 }, { duration: 1000 }, { duration: 500 }]
       const sorted = [{ duration: 1000 }, { duration: 500 }, { duration: 2000 }, { duration: 3000 }, {}]
-      runSearchStub.withArgs(t, a, provider).resolves(unsorted)
+      runSearchStub.withArgs(t, a, provider).resolves(structuredClone(unsorted))
+      const result = (await bookFinder.search(libraryItem, provider, t, a)).map((r) => (r.duration ? { duration: r.duration } : {}))
+      expect(result).to.deep.equal(sorted)
+    })
+  })
 
-      expect(await bookFinder.search(libraryItem, provider, t, a)).to.deep.equal(sorted)
+  describe('matchConfidence score', () => {
+    const W_DURATION = 0.7
+    const W_TITLE = 0.2
+    const W_AUTHOR = 0.1
+    const DEFAULT_DURATION_SCORE_MISSING_INFO = 0.1
+
+    const libraryItemPerfectDuration = { media: { duration: 600 } } // 10 minutes
+
+    // Helper to calculate expected title/author score based on Levenshtein
+    // Assumes queryPart and bookPart are already "cleaned" for length calculation consistency with BookFinder.js
+    const calculateStringMatchScore = (cleanedQueryPart, cleanedBookPart) => {
+      if (!cleanedQueryPart) return cleanedBookPart ? 0 : 1 // query empty: 1 if book empty, else 0
+      if (!cleanedBookPart) return 0 // query non-empty, book empty: 0
+
+      // Use the imported levenshteinDistance. It defaults to case-insensitive, which is what we want.
+      const distance = levenshteinDistance(cleanedQueryPart, cleanedBookPart)
+      return Math.max(0, 1 - distance / Math.max(cleanedQueryPart.length, cleanedBookPart.length))
+    }
+
+    beforeEach(() => {
+      runSearchStub.resolves([])
+    })
+
+    afterEach(() => {
+      sinon.restore()
+    })
+
+    describe('for audible provider', () => {
+      const provider = 'audible'
+
+      it('should be 1.0 for perfect duration, title, and author match', async () => {
+        const bookResults = [{ duration: 10, title: 'The Great Novel', author: 'John Doe' }]
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe')
+        // durationScore = 1.0 (diff 0 <= 1 min)
+        // titleScore = 1.0 (exact match)
+        // authorScore = 1.0 (exact match)
+        const expectedConfidence = W_DURATION * 1.0 + W_TITLE * 1.0 + W_AUTHOR * 1.0
+        expect(results[0].matchConfidence).to.be.closeTo(expectedConfidence, 0.001)
+      })
+
+      it('should correctly score a large duration mismatch', async () => {
+        const bookResults = [{ duration: 21, title: 'The Great Novel', author: 'John Doe' }] // 21 min, diff = 11 min
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe')
+        // durationScore = 0.0
+        // titleScore = 1.0
+        // authorScore = 1.0
+        const expectedConfidence = W_DURATION * 0.0 + W_TITLE * 1.0 + W_AUTHOR * 1.0
+        expect(results[0].matchConfidence).to.be.closeTo(expectedConfidence, 0.001)
+      })
+
+      it('should correctly score a medium duration mismatch', async () => {
+        const bookResults = [{ duration: 16, title: 'The Great Novel', author: 'John Doe' }] // 16 min, diff = 6 min
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe')
+        // durationScore = 1.2 - 6 * 0.12 = 0.48
+        // titleScore = 1.0
+        // authorScore = 1.0
+        const expectedConfidence = W_DURATION * 0.48 + W_TITLE * 1.0 + W_AUTHOR * 1.0
+        expect(results[0].matchConfidence).to.be.closeTo(expectedConfidence, 0.001)
+      })
+
+      it('should correctly score a minor duration mismatch', async () => {
+        const bookResults = [{ duration: 14, title: 'The Great Novel', author: 'John Doe' }] // 14 min, diff = 4 min
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe')
+        // durationScore = 1.1 - 4 * 0.1 = 0.7
+        // titleScore = 1.0
+        // authorScore = 1.0
+        const expectedConfidence = W_DURATION * 0.7 + W_TITLE * 1.0 + W_AUTHOR * 1.0
+        expect(results[0].matchConfidence).to.be.closeTo(expectedConfidence, 0.001)
+      })
+
+      it('should correctly score a tiny duration mismatch', async () => {
+        const bookResults = [{ duration: 11, title: 'The Great Novel', author: 'John Doe' }] // 11 min, diff = 1 min
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe')
+        // durationScore = 1.0
+        // titleScore = 1.0
+        // authorScore = 1.0
+        const expectedConfidence = W_DURATION * 1.0 + W_TITLE * 1.0 + W_AUTHOR * 1.0
+        expect(results[0].matchConfidence).to.be.closeTo(expectedConfidence, 0.001)
+      })
+
+      it('should use default duration score if libraryItem duration is missing', async () => {
+        const bookResults = [{ duration: 10, title: 'The Great Novel', author: 'John Doe' }]
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search({ media: {} }, provider, 'The Great Novel', 'John Doe')
+        // durationScore = DEFAULT_DURATION_SCORE_MISSING_INFO (0.2)
+        const expectedConfidence = W_DURATION * DEFAULT_DURATION_SCORE_MISSING_INFO + W_TITLE * 1.0 + W_AUTHOR * 1.0
+        expect(results[0].matchConfidence).to.be.closeTo(expectedConfidence, 0.001)
+      })
+
+      it('should use default duration score if book duration is missing', async () => {
+        const bookResults = [{ title: 'The Great Novel', author: 'John Doe' }] // No duration in book
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe')
+        // durationScore = DEFAULT_DURATION_SCORE_MISSING_INFO (0.2)
+        const expectedConfidence = W_DURATION * DEFAULT_DURATION_SCORE_MISSING_INFO + W_TITLE * 1.0 + W_AUTHOR * 1.0
+        expect(results[0].matchConfidence).to.be.closeTo(expectedConfidence, 0.001)
+      })
+
+      it('should correctly score a partial title match', async () => {
+        const bookResults = [{ duration: 10, title: 'Novel', author: 'John Doe' }]
+        runSearchStub.resolves(bookResults)
+        // Query: 'Novel Ex', Book: 'Novel'
+        // cleanTitleForCompares('Novel Ex') -> 'novel ex' (length 8)
+        // cleanTitleForCompares('Novel')    -> 'novel' (length 5)
+        // levenshteinDistance('novel ex', 'novel') = 3
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'Novel Ex', 'John Doe')
+        const expectedTitleScore = calculateStringMatchScore('novel ex', 'novel') // 1 - (3/8) = 0.625
+        const expectedConfidence = W_DURATION * 1.0 + W_TITLE * expectedTitleScore + W_AUTHOR * 1.0
+        expect(results[0].matchConfidence).to.be.closeTo(expectedConfidence, 0.001)
+      })
+
+      it('should correctly score a partial author match (comma-separated)', async () => {
+        const bookResults = [{ duration: 10, title: 'The Great Novel', author: 'Jane Smith, Jon Doee' }]
+        runSearchStub.resolves(bookResults)
+        // Query: 'Jon Doe', Book part: 'Jon Doee'
+        // cleanAuthorForCompares('Jon Doe') -> 'jon doe' (length 7)
+        // book author part (already lowercased) -> 'jon doee' (length 8)
+        // levenshteinDistance('jon doe', 'jon doee') = 1
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'Jon Doe')
+        // For the author part 'jon doee':
+        const expectedAuthorPartScore = calculateStringMatchScore('jon doe', 'jon doee') // 1 - (1/7)
+        // Assuming 'jane smith' gives a lower or 0 score, max score will be from 'jon doee'
+        const expectedConfidence = W_DURATION * 1.0 + W_TITLE * 1.0 + W_AUTHOR * expectedAuthorPartScore
+        expect(results[0].matchConfidence).to.be.closeTo(expectedConfidence, 0.001)
+      })
+
+      it('should give authorScore 0 if query has author but book does not', async () => {
+        const bookResults = [{ duration: 10, title: 'The Great Novel', author: null }]
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe')
+        // authorScore = 0.0
+        const expectedConfidence = W_DURATION * 1.0 + W_TITLE * 1.0 + W_AUTHOR * 0.0
+        expect(results[0].matchConfidence).to.be.closeTo(expectedConfidence, 0.001)
+      })
+
+      it('should give authorScore 1.0 if query has no author', async () => {
+        const bookResults = [{ duration: 10, title: 'The Great Novel', author: 'John Doe' }]
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', '') // Empty author
+        expect(results[0].matchConfidence).to.be.closeTo(1.0, 0.001)
+      })
+
+      it('handles book author string that is only commas correctly (score 0)', async () => {
+        const bookResults = [{ duration: 10, title: 'The Great Novel', author: ',, ,, ,' }]
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe')
+        // cleanedQueryAuthorForScore = "john doe"
+        // book.author leads to validBookAuthorParts being empty.
+        // authorScore = 0.0
+        const expectedConfidence = W_DURATION * 1.0 + W_TITLE * 1.0 + W_AUTHOR * 0.0
+        expect(results[0].matchConfidence).to.be.closeTo(expectedConfidence, 0.001)
+      })
+
+      it('should return 1.0 for ASIN results', async () => {
+        const bookResults = [{ duration: 10, title: 'The Great Novel', author: 'John Doe' }]
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'B000F28ZJ4', null)
+        expect(results[0].matchConfidence).to.be.closeTo(1.0, 0.001)
+      })
+
+      it('should return 1.0 when author matches one of the book authors', async () => {
+        const bookResults = [{ duration: 10, title: 'The Great Novel', author: 'John Doe, Jane Smith' }]
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe')
+        expect(results[0].matchConfidence).to.be.closeTo(1.0, 0.001)
+      })
+
+      it('should return 1.0 when author query and multiple book authors are the same', async () => {
+        const bookResults = [{ duration: 10, title: 'The Great Novel', author: 'John Doe, Jane Smith' }]
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe, Jane Smith')
+        expect(results[0].matchConfidence).to.be.closeTo(1.0, 0.001)
+      })
+
+      it('should correctly score against a book with a subtitle when the query has a subtitle', async () => {
+        const bookResults = [{ duration: 10, title: 'The Great Novel', subtitle: 'A Novel', author: 'John Doe' }]
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel: A Novel', 'John Doe')
+        expect(results[0].matchConfidence).to.be.closeTo(1.0, 0.001)
+      })
+
+      it('should correctly score against a book with a subtitle when the query does not have a subtitle', async () => {
+        const bookResults = [{ duration: 10, title: 'The Great Novel', subtitle: 'A Novel', author: 'John Doe' }]
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe')
+        expect(results[0].matchConfidence).to.be.closeTo(1.0, 0.001)
+      })
+
+      describe('after fuzzy searches', () => {
+        it('should return 1.0 for a title candidate match', async () => {
+          const bookResults = [{ duration: 10, title: 'The Great Novel', author: 'John Doe' }]
+          runSearchStub.resolves([])
+          runSearchStub.withArgs('the great novel', 'john doe').resolves(bookResults)
+          const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel - A Novel', 'John Doe')
+          expect(results[0].matchConfidence).to.be.closeTo(1.0, 0.001)
+        })
+
+        it('should return 1.0 for an author candidate match', async () => {
+          const bookResults = [{ duration: 10, title: 'The Great Novel', author: 'John Doe' }]
+          runSearchStub.resolves([])
+          runSearchStub.withArgs('the great novel', 'john doe').resolves(bookResults)
+          const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe, Jane Smith')
+          expect(results[0].matchConfidence).to.be.closeTo(1.0, 0.001)
+        })
+      })
+    })
+
+    describe('for non-audible provider (e.g., google)', () => {
+      const provider = 'google'
+      it('should have not have matchConfidence', async () => {
+        const bookResults = [{ title: 'The Great Novel', author: 'John Doe' }]
+        runSearchStub.resolves(bookResults)
+        const results = await bookFinder.search(libraryItemPerfectDuration, provider, 'The Great Novel', 'John Doe')
+        expect(results[0]).to.not.have.property('matchConfidence')
+      })
     })
   })
 })