Prometheus Authentication

generated: '2026-06-20'
method: searched
source: https://prometheus.io/docs/guides/basic-auth/, https://prometheus.io/docs/prometheus/latest/querying/api/
docs: https://prometheus.io/docs/guides/basic-auth/
summary:
  types: []
  api_key_in: []
  oauth2_flows: []
  built_in_auth: false
model: >-
  Prometheus, Pushgateway, and Alertmanager ship with NO built-in application-level
  authentication or authorization on their HTTP APIs. None of the OpenAPI specs declare a
  securityScheme. Access control is expected to be provided externally.
mechanisms:
  - name: web-config-basic-auth
    description: >-
      Since 2.24.0 the server supports TLS and HTTP Basic Auth via a --web.config.file
      (web-config.yml) with bcrypt-hashed basic_auth_users. This secures the server's own
      endpoints without a proxy.
    docs: https://prometheus.io/docs/guides/basic-auth/
    optional: true
  - name: web-config-tls
    description: TLS server certificates and optional mTLS client auth configured via --web.config.file.
    docs: https://prometheus.io/docs/prometheus/latest/configuration/https/
    optional: true
  - name: reverse-proxy
    description: >-
      The canonical pattern for authenticated/authorized/multi-tenant access is to front
      Prometheus with a reverse proxy (nginx, OAuth2 Proxy, service mesh) that enforces
      OAuth/OIDC/SSO and network policy.
    docs: https://prometheus.io/docs/operating/security/
    optional: true
  - name: admin-flags
    description: >-
      Destructive/administrative endpoints are gated by server flags rather than tokens —
      --web.enable-lifecycle (config reload, quit) and --web.enable-admin-api (TSDB
      snapshot, delete series, clean tombstones). Disabled by default.
    docs: https://prometheus.io/docs/prometheus/latest/management_api/
    optional: false
schemes: []