Avrea · Authentication Profile

Avrea Authentication

Authentication

Avrea secures its APIs with apiKey and browser-oauth across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the browser-login flow(s).

CompanyCI/CDContinuous IntegrationGitHub ActionsBuild InfrastructureRunnersCachingObservabilityDevOpsDeveloper Tools
Methods: apiKey, browser-oauth Schemes: 2 OAuth flows: browser-login API key in: header, environment

Security Schemes

AVR_TOKEN apiKey
· in: environment (AVR_TOKEN)
browser-login oauth2-like

Source

Authentication Profile

avrea-authentication.yml Raw ↑ 
generated: '2026-07-18'
method: searched
source: https://docs.avrea.com/cli ; https://avrea.com/trust-security
docs: https://docs.avrea.com/cli
note: >-
  Avrea publishes no public REST API OpenAPI, so this profile is derived from
  the documented CLI and console authentication rather than from securitySchemes.
summary:
  types: [apiKey, browser-oauth]
  api_key_in: [header, environment]
  oauth2_flows: [browser-login]
schemes:
- name: AVR_TOKEN
  type: apiKey
  in: environment
  parameter: AVR_TOKEN
  description: >-
    API key used for non-interactive / CI authentication with the avr CLI.
    Presented via the AVR_TOKEN environment variable; `avr auth logout` revokes
    the active API key.
  sources: [https://docs.avrea.com/cli]
- name: browser-login
  type: oauth2-like
  flow: browser
  description: >-
    Interactive browser-based login (`avr auth login`) that authenticates the
    CLI against the Avrea console session at console.avrea.com.
  sources: [https://docs.avrea.com/cli]
account_security:
- Multi-factor authentication (MFA)
- Single sign-on (SSO)
- Role-based access control for runners, logs, and build data