Foxglove Technologies Authentication

generated: '2026-08-16'
method: searched
source: openapi/foxglove-technologies-openapi-original.yml
docs: https://docs.foxglove.dev/api
settings_docs: https://docs.foxglove.dev/docs/settings#api-keys
sso_docs: https://docs.foxglove.dev/docs/security/sso
roles_docs: https://docs.foxglove.dev/docs/security/roles
summary:
  types: [http, apiKey]
  http_schemes: [bearer]
  api_key_in: [cookie]
  oauth2_flows: []
  oauth2: false
  openid_connect: false
  note: >-
    The Foxglove API is API-key authenticated, not OAuth. Keys are bearer tokens
    prefixed `fox_sk_`, issued only by organization admins, and carry a set of
    capabilities; every operation names the capability it requires in its security
    requirement. That capability list is the closest thing Foxglove has to an OAuth
    scope surface, so it is recorded here rather than in scopes/ — there is no
    authorization server, no consent screen, no token endpoint and no scope grant
    flow. Custom OIDC single sign-on exists for logging HUMANS into the Foxglove
    application on the Enterprise tier; it does not issue API credentials.
schemes:
- name: ApiKey
  type: http
  scheme: bearer
  header: Authorization
  format: 'Bearer fox_sk_...'
  key_prefix: fox_sk_
  description: API key authentication using HTTP Bearer auth
  issuance: organization administrators only
  applies_to: all routes except POST /site-bucket-notifications
  sources: [openapi/foxglove-technologies-openapi-original.yml]
- name: Session
  type: apiKey
  in: cookie
  parameter: fox.session
  description: User permissions when signed into the website
  applies_to: browser sessions on the Foxglove web app
  sources: [openapi/foxglove-technologies-openapi-original.yml]
- name: SiteBucketNotificationBearerToken
  type: http
  scheme: bearer
  header: Authorization
  description: Site bucket notification authentication using HTTP Bearer auth
  applies_to: POST /site-bucket-notifications only — the inbound notification route
    used by a self-hosted Primary Site's object storage
  issuance: site inbox notification tokens (POST /site-inbox-notification-tokens)
  sources: [openapi/foxglove-technologies-openapi-original.yml]
adjacent_credentials:
- name: Device token
  purpose: Authenticates a device (robot) to the API
  managed_by: [GET /device-tokens, POST /device-tokens, 'PATCH /device-tokens/{id}', 'DELETE /device-tokens/{id}']
  docs: https://docs.foxglove.dev/docs/fleet/device-tokens
- name: Site token
  purpose: Credential a self-hosted Primary Site or Edge Site uses to talk to the
    Foxglove API
  managed_by: [GET /site-tokens, POST /site-tokens, 'DELETE /site-tokens/{id}']
- name: MCP access token
  purpose: Random bearer token generated by the desktop app for its local MCP server
  docs: https://docs.foxglove.dev/docs/agents/mcp-server
capability_model:
  applies_to: ApiKey
  declared_in: operation security requirements in the OpenAPI
  count: 48
  syntax_note: >-
    Declared using OpenAPI's scope syntax against an http-bearer scheme (e.g.
    a security requirement naming ApiKey with the scope devices.list), which is
    non-standard — OpenAPI only
    defines scopes for oauth2/openIdConnect — but it is how Foxglove publishes the
    per-endpoint permission requirement, and Redoc renders it as
    "Authorizations: ApiKey (devices.list)".
  capabilities:
  - data.coverage.list
  - data.imports.delete
  - data.imports.list
  - data.imports.pending.list
  - data.stream
  - data.topics.list
  - data.upload
  - deviceTokens.create
  - deviceTokens.delete
  - deviceTokens.list
  - deviceTokens.update
  - devices.create
  - devices.delete
  - devices.list
  - devices.update
  - eventTypes.create
  - eventTypes.delete
  - eventTypes.list
  - eventTypes.update
  - events.create
  - events.delete
  - events.list
  - events.update
  - extensions.create
  - extensions.delete
  - extensions.list
  - layouts.create
  - layouts.delete
  - layouts.list
  - layouts.update
  - projects.list
  - properties.create
  - properties.delete
  - properties.list
  - properties.update
  - recordings.delete
  - recordings.list
  - sessions.create
  - sessions.delete
  - sessions.list
  - sessions.update
  - siteTokens.create
  - siteTokens.delete
  - siteTokens.list
  - sites.create
  - sites.delete
  - sites.list
  - sites.update
transport_security:
  https_required: true
  tls: TLS 1.2 minimum in transit; TLS 1.3 observed on api.foxglove.dev
  source: https://foxglove.dev/security
gaps:
- No token rotation, expiry or refresh contract is published for API keys.
- No OAuth 2.0 / OIDC authorization server for API access, so third-party
  applications cannot obtain delegated, user-consented access — only an admin-issued
  organization key.