# Authentication

Authentication, organizations and workspaces, service accounts, platform admins.

Source: https://faros.sh/docs/self-hosting/hub/authentication/


Three pieces make up faros's security story:

- **Authentication** — how a person or machine proves who they are: a [static token](https://faros.sh/docs/self-hosting/hub/static-token/) or [OIDC via Dex](https://faros.sh/docs/self-hosting/hub/oidc/).
- **Tenancy** — where they can act: [organizations, workspaces, memberships, and service accounts](https://faros.sh/docs/administration/workspaces/). Every identity gets a personal organization automatically, so single-user hubs never have to think about this.
- **Platform administration** — the `hub.adminUsers` allowlist unlocks the hub's admin surface (provider onboarding, root-level views). Nobody is a platform admin by default — not even static-token users.

## Picking an auth method

| Method | Use case | Setup |
|:-------|:---------|:------|
| **[Static token](https://faros.sh/docs/self-hosting/hub/static-token/)** | Personal home lab, dev, CI | Generate tokens; list them in Helm values; log in with `--token` |
| **[OIDC (Dex)](https://faros.sh/docs/self-hosting/hub/oidc/)** | Teams, audit logging, SSO | Deploy Dex + an identity backend (GitHub, Google, LDAP) |

Choose the authentication method for your deployment:

| Scenario | Recommendation |
|:---------|:---------------|
| Single user, home lab | Static token |
| Small team | OIDC with GitHub or Google |
| Enterprise | OIDC with LDAP / SAML |
| CI / CD automation | Static token, or a workspace [service account](https://faros.sh/docs/administration/workspaces/#service-accounts) |

You can switch methods later by re-deploying the Helm chart with different values — hub state is unaffected, and both methods can be enabled at once.