Backstage Authentication

generated: '2026-09-04'
method: searched
source: openapi/backstage-actions-api-openapi.yml, openapi/backstage-authentication-api-openapi.yml,
  openapi/backstage-authorization-api-openapi.yml, openapi/backstage-catalog-backend-openapi.yaml,
  openapi/backstage-documentation-api-openapi.yml, openapi/backstage-dynamic-features-openapi.yaml,
  openapi/backstage-entities-api-openapi.yml, openapi/backstage-events-backend-openapi.yaml,
  openapi/backstage-locations-api-openapi.yml, openapi/backstage-metadata-api-openapi.yml, openapi/backstage-notifications-backend-openapi.yaml,
  openapi/backstage-scaffolder-backend-openapi.yaml ...
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - cookie
schemes:
- name: cookieAuth
  type: apiKey
  in: cookie
  parameter: backstage-auth
  sources:
  - openapi/backstage-actions-api-openapi.yml
  - openapi/backstage-authentication-api-openapi.yml
  - openapi/backstage-authorization-api-openapi.yml
  - openapi/backstage-documentation-api-openapi.yml
  - openapi/backstage-entities-api-openapi.yml
  - openapi/backstage-locations-api-openapi.yml
  - openapi/backstage-metadata-api-openapi.yml
  - openapi/backstage-search-api-openapi.yml
  - openapi/backstage-sync-api-openapi.yml
  - openapi/backstage-tasks-api-openapi.yml
  - openapi/backstage-templates-api-openapi.yml
  - openapi/backstage-token-verification-api-openapi.yml
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  sources:
  - openapi/backstage-actions-api-openapi.yml
  - openapi/backstage-authentication-api-openapi.yml
  - openapi/backstage-authorization-api-openapi.yml
  - openapi/backstage-catalog-backend-openapi.yaml
  - openapi/backstage-documentation-api-openapi.yml
  - openapi/backstage-dynamic-features-openapi.yaml
  - openapi/backstage-entities-api-openapi.yml
  - openapi/backstage-events-backend-openapi.yaml
  - openapi/backstage-locations-api-openapi.yml
  - openapi/backstage-metadata-api-openapi.yml
  - openapi/backstage-notifications-backend-openapi.yaml
  - openapi/backstage-scaffolder-backend-openapi.yaml
  - openapi/backstage-search-api-openapi.yml
  - openapi/backstage-search-backend-openapi.yaml
  - openapi/backstage-sync-api-openapi.yml
  - openapi/backstage-tasks-api-openapi.yml
  - openapi/backstage-templates-api-openapi.yml
  - openapi/backstage-token-verification-api-openapi.yml

docs:
  - https://backstage.io/docs/auth/
  - https://backstage.io/docs/auth/identity-resolver
  - https://backstage.io/docs/ai/mcp-actions
searched_enrichment:
  note: >-
    Upgraded from derived to searched on 2026-09-04 by reading the Backstage auth documentation and
    the live OAuth discovery documents served by the project's demo deployment. Backstage is
    self-hosted, so the concrete identity provider is the operator's choice; what Backstage itself
    ships is the token model below.
  models:
    - name: Backstage user token (bearer JWT)
      detail: >-
        The frontend obtains a Backstage token from the auth backend and sends it as
        Authorization: Bearer <token> to plugin backends. This is the `JWT` bearer securityScheme
        declared in every first-party plugin OpenAPI.
    - name: Backstage service-to-service token
      detail: >-
        Plugin backends authenticate to each other with issued service tokens; the same bearer
        header carries them.
    - name: Cookie auth
      detail: >-
        A `backstage-auth` cookie is used for static asset / TechDocs style requests.
    - name: External OAuth (MCP clients)
      detail: >-
        The MCP Actions endpoint is an OAuth 2.1-style protected resource. Observed live on
        demo.backstage.io: RFC 9728 protected resource metadata pointing at an RFC 8414
        authorization server with authorization_code + PKCE (S256), dynamic client registration,
        token revocation, and Client ID Metadata Document (CIMD) support.
  identity_providers_supported:
    note: Backstage ships auth provider modules; the operator picks one or more.
    examples: [github, gitlab, google, okta, microsoft, auth0, oidc, atlassian, bitbucket, onelogin, saml/oauth2-proxy]
  discovery_documents:
    - well-known/backstage-demo-oauth-authorization-server.json
    - well-known/backstage-demo-oauth-protected-resource.json