Skip to content
faros Docs
Open console

Enter a topic to search documentation.

    Authentication

    Authentication, organizations and workspaces, service accounts, platform admins.

    Three pieces make up faros’s security story:

    • Authentication — how a person or machine proves who they are: a static token or OIDC via Dex .
    • Tenancy — where they can act: organizations, workspaces, memberships, and service accounts . Every identity gets a personal organization automatically, so single-user hubs never have to think about this.
    • Platform administration — the hub.adminUsers allowlist unlocks the hub’s admin surface (provider onboarding, root-level views). Nobody is a platform admin by default — not even static-token users.

    Picking an auth method

    MethodUse caseSetup
    Static tokenPersonal home lab, dev, CIGenerate tokens; list them in Helm values; log in with --token
    OIDC (Dex)Teams, audit logging, SSODeploy Dex + an identity backend (GitHub, Google, LDAP)

    Choose the authentication method for your deployment:

    ScenarioRecommendation
    Single user, home labStatic token
    Small teamOIDC with GitHub or Google
    EnterpriseOIDC with LDAP / SAML
    CI / CD automationStatic token, or a workspace service account

    You can switch methods later by re-deploying the Helm chart with different values — hub state is unaffected, and both methods can be enabled at once.