Openfaas Authentication

generated: '2026-10-14'
method: searched
generator: extract-docs-artifacts.py (local)
source: https://docs.openfaas.com/reference/authentication/
sources:
- https://docs.openfaas.com/reference/authentication/
- https://docs.openfaas.com/reference/function-oauth/
description: Authentication methods documented for OpenFaaS functions
schemes:
- type: http-bearer
  name: Bearer token
  evidence: You can also create and manage your own Bearer tokens or API keys. These are simply shared secrets, where the client (the user or
    machine invoking the function) and the server (the function) share a copy of the token.
  location: header
  header: Authorization
  how_to_obtain: Create a token as a secret and assign it to the function; the client then sends it in the Authorization header.
- type: http-basic
  name: Basic authentication
  evidence: 'You can enable basic-authentication for a web-portal or an API by setting the appropriate header such as WWW-Authenticate: Basic
    realm="User Visible Realm" . This is the approach that the OpenFaaS gateway takes, and the OpenFaaS Pro edition comes with an OIDC integration.'
  location: header
  header: Authorization
  how_to_obtain: Configure the gateway with a username and password; clients provide credentials using the HTTP Basic scheme.
- type: hmac
  name: Webhook HMAC
  evidence: When functions receive webhooks, most publishers of events will not support any form of authentication. Messages are verified using
    symmetric keys, where the client (your function) and the server (GitHub, Stripe, YouTube, etc) share the same secret.
  location: header
  header: X-Hub-Signature-256
  how_to_obtain: Create a shared secret between the webhook sender and the function; the sender includes a hash of the payload in the designated
    header.
- type: oauth2
  name: OAuth/OIDC login for functions
  evidence: The of-watchdog can protect a function with browser login through an OAuth 2.0 or OpenID Connect (OIDC) provider. It handles sign-in
    and checks the browser's session before forwarding requests to the function.
  location: cookie
  how_to_obtain: Register the function as an OIDC client, configure oauth_enabled=true and provide client ID, issuer URL, and signing key; the
    watchdog performs the OAuth flow and sets a session cookie.
docs: https://docs.openfaas.com/reference/authentication/