Devtron Authentication

generated: '2026-07-18'
method: searched
source: https://docs.devtron.ai/global-configurations/authorization/api-tokens
note: >-
  The published OpenAPI (openapi/devtron-openapi-original.yml) declares no
  components.securitySchemes, but every operation accepts a "token" header and
  the docs document a first-class API token model. Profile captured from the
  docs auth page and the "token" header parameter present on operations.
summary:
  types: [apiKey]
  api_key_in: [header]
  oauth2_flows: []
schemes:
  - name: DevtronApiToken
    type: apiKey
    in: header
    parameter_name: token
    description: >-
      Static bearer-style API token generated by a super-admin under
      Global Configurations -> Authorization -> API tokens. Sent in the
      "token" HTTP request header on every Devtron orchestrator API call.
    generation: super-admin only; UI-generated with a name, description and
      expiration (7/30/60/90 days, custom date, or no expiration).
    rbac: >-
      Each token is scoped either to Super-admin permission or to Specific
      permissions across Devtron Apps, Helm Apps, Kubernetes Resources and
      Chart Groups. A 401 means the token is missing/invalid; a 403 means the
      token lacks the RBAC permission for the requested action.
    rotation: tokens carry an expiration and can be updated/regenerated in the UI.
    sources: [openapi/devtron-openapi-original.yml]
sso:
  note: >-
    Devtron also supports SSO/OIDC (Dex-based, e.g. Google, GitHub, LDAP, OIDC,
    Microsoft) for interactive UI login, configured via the SSO Configuration
    API tag. This is separate from the token auth used for programmatic API access.
  docs: https://docs.devtron.ai/global-configurations/sso-login