How Sonarr Uses Categories to Track Downloads, and When to Add Authentication
Sonarr keeps track of active downloads in the download apps you have linked to it, but only for items that use the category name you configured, by asking the download app through its API. Servarr Wiki
The category acts as a filter. Sonarr does not track every entry in the download queue. It tracks only the subset that carries that label. Status comes from the API, a standard way for programs to request updates from each other, rather than by inspecting files on disk or parsing logs.
Separately, Sonarr's documentation recommends enabling a login method if the Sonarr web interface is accessible from outside your local network. Servarr FAQ
That recommendation is limited in scope. It applies to remote access. It does not change default behavior on a home network. It describes what operators should do once the interface can be reached beyond the router.
The broader context here is what happens when one download app serves many users. A single client often handles manual downloads plus requests from Sonarr and other automation tools. Without a clear label, it becomes unclear which queue entry belongs to which program, which failure should trigger a retry, and which finished download should be imported where. The category name provides that label, and the API provides the way to ask about status.
In my view, this is a pragmatic setup for systems that run for years. Sonarr stays separate from the inner workings of the download client. The client handles transfers, queuing, and where files land on disk. Sonarr tracks only the work it started, as identified by category. That separation reduces interference when tools share a client, and it makes setup errors easier to find. If nothing shows up in Sonarr, the first thing to check is whether the download has the expected category.
Looking at what this means for exposure, the login guidance follows the same idea of clear boundaries. A management page on a trusted home network carries one level of risk. The same page open to the internet carries another. A login does not solve every security issue, and operators still need to handle network controls, updates, and reverse proxy settings. It does add a basic identity check before anyone can use management functions. For software that can start downloads, move files, and contact other services, that check is useful.
Worth flagging for home operators is how the two behaviors link together. Category-based tracking depends on steady API access to the download client, with the right keys and permissions. Making Sonarr reachable from outside does not change that client connection, but it makes passwords and API keys on both sides more valuable to protect. Keeping remote access narrow and keeping the category spelling consistent in both Sonarr and the download client avoids a quiet failure mode where downloads complete but Sonarr never picks them up.
Stepping back, the pattern is modest, and that helps it last. Small, explicit agreements between programs tend to survive upgrades, client changes, and new network setups better than automatic discovery.
