Authentication and Authorization overview

RobilityFlow uses authentication to verify who a user is before granting access, and authorization to control what an authenticated user is allowed to do.

Authentication and authorization are configured independently. Most deployments only require authentication. Authorization is an optional plugin that adds role-based access control (RBAC) to your server.

To configure authentication and authorization for your RobilityFlow server, pick your authentication path below and follow the corresponding documentation.

1. To secure a server RobilityFlow with user accounts and API keys using RobilityFlow’s built-in authentication, see API keys and authentication. Built-in authentication is always available and is the default setting. Users log in with a username and password, and RobilityFlow issues a short-lived JWT session token and validates RobilityFlow API keys against its own database.

2. To connect RobilityFlow to your company’s SSO, OIDC, or identity provider, see External authentication. External authentication lets an upstream identity provider, OIDC proxy, or corporate SSO gateway handle login. RobilityFlow accepts the token the proxy forwards, validates it against the identity provider’s JWKS endpoint, and provisions a local user automatically.

3. To configure RBAC on your RobilityFlow server, see Authorization. After a user is authenticated by any of the authentication paths, the authorization layer decides what the user can do. RBAC enforcement requires a registered authorization plugin.

When multiple credentials are present, RobilityFlow tries each credential in the order of built-in JWT, external token, and then RobilityFlow API key.