Positron Authentication

generated: '2026-08-02'
method: searched
source: openapi/positron-inference-openapi.yml, openapi/positron-admin-openapi.yml
docs: https://support.positron.ai/api-documentation
summary:
  types:
  - apiKey
  - http-bearer
  api_key_in:
  - header
  oauth2_flows: []
  model: >-
    Static API keys only. Inference calls carry the key in the `authorization` header; the admin
    control plane declares a bearer requirement. Keys are minted and revoked through the admin
    API (createAccessToken / deleteAccessToken). No OAuth 2.0, no OIDC, no scopes, no mTLS.
schemes:
- name: apiKey
  type: apiKey
  in: header
  parameter: authorization
  api: Positron Olivaw OpenAI-Compatible Inference API
  applied: >-
    root-level `security: [{apiKey: []}]` — applies to all four operations (listModels, getModel,
    createChatCompletion, createCompletion)
  sources:
  - openapi/positron-inference-openapi.yml
- name: bearer
  type: http
  scheme: bearer
  bearerFormat: API key
  api: Positron Olivaw Admin API
  applied: >-
    root-level `security: [{bearer: [API key]}]` — applies to all 19 admin operations
  sources:
  - openapi/positron-admin-openapi.yml
  spec_gap: >-
    The published admin document references the `bearer` scheme in its root `security` block but
    declares no `components.securitySchemes`, so the scheme object itself is undefined in the
    specification. Type/scheme recorded here from the requirement's shape and the "API key"
    label it carries.
credential_lifecycle:
  issued_by: openapi/positron-admin-openapi.yml#createAccessToken
  revoked_by: openapi/positron-admin-openapi.yml#deleteAccessToken
  audited_by:
  - openapi/positron-admin-openapi.yml#listAccessTokens
  - openapi/positron-admin-openapi.yml#getAccessToken
  rotation: >-
    Create-then-delete. There is no update operation on AccessToken, so rotation means minting a
    replacement and revoking the old credential.
operator_authentication:
  surface: Olivaw GUI (hosted deployments)
  method: Google account via Auth0
  source: https://support.positron.ai/user-guide
  note: >-
    Human operator sign-in to the Olivaw web console, distinct from API credentials. No OIDC
    discovery document is published for the API itself.
discovery:
  openid_configuration: absent (404 on every Positron host)
  oauth_authorization_server: absent (404 on every Positron host)
  oauth_protected_resource: absent (404 on every Positron host)
  probed: '2026-08-02'
gaps:
- No 401/403 responses are documented on either API despite both declaring root-level security.
- No scope model — see conformance/positron-conformance.yml (oauth2 = false); no scopes/ artifact
  is emitted for this provider.
- No documented key prefix, key format, expiry or IP allowlist.