04 · Authentication & Access Control
Sign-in, API keys, roles, SSO, and linking cloud accounts.
How people and machines prove who they are, and what they're allowed to do once they're in.
In this section
- How sign-in works - magic-link and device-code; no passwords.
- API keys - headless, scoped tokens for scripts and CI.
- Roles & scopes - viewer · editor · builder · admin, and how key scopes narrow them.
- SSO with OIDC - Okta, Entra ID, Auth0, Keycloak, and other OIDC providers.
- Provider OAuth apps - register a per-org Azure/Google app so users can link their cloud accounts.
- Per-org provider linking & storage discovery - link an account to enumerate storage and discover tables.
Two different "OAuth" things
Don't confuse them:
- SSO sign-in (OIDC) - how a human logs in to Eddytor via your IdP.
- Provider OAuth apps / linking - how a user grants Eddytor delegated access to their cloud storage (Azure/Google) for discovery.
They're configured separately and covered in separate articles above.