RBAC & OAuth
Per-Endpoint RBAC & Access Control
Control who can access each endpoint with role-based access control. Configure in the dashboard under Endpoint Settings → Access Control.
Client Management
Each endpoint can have its own set of authenticated clients. Clients support multiple auth methods simultaneously:
- Username & Password — Basic credentials with configurable password
- Static Token — API key or bearer token for programmatic access
- OAuth Subject — Linked to an external provider (Google, GitHub, Azure, Okta, Custom)
All credential changes are recorded in a credential audit trail (creation and updates tracked by type).
Invite Links
Generate invite links to onboard new users to an endpoint:
- Set display name and email for the invitee
- Configure expiration (default 72 hours, max 1 year)
- Invite creates a client record with
invitedstatus - Invitee receives a registration URL:
/register?endpoint=...&invite=...
Registration Policy
Control how new users can register for endpoint access. Three modes:
| Mode | Behavior |
|---|---|
| Open | Anyone can register and get access |
| Invite Only | Only users with a valid invite link can register |
| Requires Approval | Users can register but must be approved by an admin |
Additional policy settings:
- Domain allow/block lists — Restrict registration to specific email domains
- Email verification — Require email confirmation before access
- Password complexity — Enforce minimum length, uppercase, lowercase, numbers, special characters
- Default role — Role automatically assigned to new registrations
Client Sessions & Login History
- View all active sessions per client (with optional expired sessions)
- Revoke individual sessions or revoke all sessions at once
- View login history (last 50 events by default, configurable limit)
Client Metadata Forwarding
Attach custom key-value metadata to clients. Metadata is forwarded downstream as HTTP headers and included in request logs, enabling backend services to identify clients without additional lookups.
Bulk Operations
Select multiple clients via checkboxes and perform bulk delete operations to clean up inactive or unwanted accounts.
OAuth Provider Configuration
Configure per-endpoint OAuth providers for delegated authentication. Set up in the dashboard under Endpoint Settings → OAuth Providers.
Supported Providers
- Google — OAuth 2.0 with Google identity
- GitHub — OAuth 2.0 with GitHub accounts
- Azure AD — Microsoft identity platform
- Okta — Enterprise SSO via Okta
- Auth0 — Auth0 identity platform
- Custom — Any OIDC-compatible provider
Provider Configuration
| Field | Description |
|---|---|
| Client ID | OAuth client ID from the provider |
| Client Secret | Encrypted client secret (stored encrypted at rest) |
| Auth URL | Authorization endpoint URL |
| Token URL | Token exchange endpoint URL |
| User Info URL | User info endpoint for fetching identity |
| Scopes | OAuth scopes (e.g., openid email profile) |
| Identifier Field | JSON field from user info to use as unique identifier (e.g., email, sub) |
| OIDC Issuer | Optional. When set (e.g. https://accounts.google.com), the edge cryptographically verifies the id_token (signature, exp, iss, aud) instead of trusting the user-info endpoint. |
| JWKS URL | Optional. Signing-key endpoint — discovered from the issuer's .well-known/openid-configuration if left blank. |
| Enabled | Toggle provider on/off |
The dashboard displays the Redirect/Callback URL for easy configuration in your OAuth provider's settings. Each provider type shows a guided setup card with provider-specific instructions.
id_token at the edge.