Oxide Computer Authentication

generated: '2026-08-26'
method: searched
source: https://docs.oxide.computer/api/guides/authentication
docs: https://docs.oxide.computer/api/guides/authentication
spec: openapi/oxide-computer-region-api-openapi.json
note: >-
  The Oxide Region API OpenAPI document declares NO components.securitySchemes — it is
  generated by dropshot, which does not emit them. The auth model below is therefore taken
  from Oxide's own authentication guide and from the auth operations that are present in the
  spec, not derived from securitySchemes. This is a documentation gap in the contract, not an
  absence of authentication.
schemes:
- id: device_token
  type: http
  scheme: bearer
  in: header
  header: Authorization
  format: 'Authorization: Bearer <device token>'
  description: >-
    Primary programmatic credential. Issued by an OAuth 2.0 Device Authorization Grant
    (RFC 8628) and presented as a bearer token. The CLI stores it at
    $HOME/.config/oxide/credentials.toml; it can also be supplied through the OXIDE_TOKEN
    environment variable (with OXIDE_HOST naming the control plane). A user may hold
    multiple device tokens, one per device. Environment variables take precedence over the
    credentials file.
  operations:
  - device_auth_request
  - device_auth_confirm
  - device_access_token
  - current_user_access_token_list
  - current_user_access_token_delete
- id: session_cookie
  type: apiKey
  in: cookie
  description: >-
    Browser session used by the Oxide web console. Login endpoints return credentials in a
    Set-Cookie header; subsequent requests present them in Cookie. Sessions are terminated by
    POST /v1/logout. Oxide states "The session timeout is currently set to eight hours, but
    the policy may change in the future releases"; the v9 release notes record 8 hours idle
    and 24 hours absolute.
  operations:
  - login_local
  - login_saml
  - logout
  - user_logout
- id: saml_sso
  type: openIdConnect
  protocol: SAML 2.0
  description: >-
    Per-silo federated identity. An operator registers a SAML identity provider on a silo
    (saml_identity_provider_create) and users authenticate at
    POST /login/{silo_name}/saml/{provider_name}. Oxide documents integrations with Keycloak,
    Microsoft Entra ID and Duo.
  operations:
  - saml_identity_provider_create
  - saml_identity_provider_view
  - login_saml
  docs: https://docs.oxide.computer/guides/operator/keycloak
- id: scim_bearer_token
  type: http
  scheme: bearer
  description: >-
    Separate bearer token class issued per silo for SCIM 2.0 provisioning clients, managed
    through scim_token_create / scim_token_list / scim_token_view / scim_token_delete. Added
    in system release v17.
  operations:
  - scim_token_create
  - scim_token_list
  - scim_token_view
  - scim_token_delete
flows:
  device_authorization_grant:
    standard: RFC 8628 (OAuth 2.0 Device Authorization Grant)
    steps:
    - operationId: device_auth_request
      path: POST /device/auth
      summary: Start an OAuth 2.0 Device Authorization Grant
    - operationId: device_auth_confirm
      path: POST /device/confirm
      summary: Confirm an OAuth 2.0 Device Authorization Grant
    - operationId: device_access_token
      path: POST /device/token
      summary: Request a device access token
    cli: 'oxide auth login --host https://engineering.cloud.example.com'
    headless: '--no-browser prints the verification URL for another machine'
    docs: https://docs.oxide.computer/guides/quickstart-cli
scopes:
  documented: false
  note: >-
    Oxide documents no OAuth scope vocabulary. Authorization is not scope-based; it is
    role-based (RBAC) over silos, projects and the fleet — see the roles referenced by
    policy_view / policy_update and the fleet.admin role required to manage alert receivers.
  docs: https://docs.oxide.computer/guides/configuring-access
credential_storage:
  file: $HOME/.config/oxide/credentials.toml
  env:
  - OXIDE_HOST
  - OXIDE_TOKEN
  precedence: environment variables override the credentials file
mtls: false