Auth & Identity

Device-code login for the guardrail install, API keys for the SDK, and OAuth with bearer JWTs for the Console.

  • Guardrail install: device-code login. The installer opens a browser, the developer signs in, and the device identity is persisted so the guardrail can authenticate on its own afterwards. A completed login redirects to tools.armoriq.ai.
  • SDK to backend: API keys and device-scoped keys on the enforce and telemetry calls (x-api-key).
  • Console to backend: OAuth (Google or GitHub) sign-in; the Console then attaches a JWT as Authorization: Bearer on REST calls.
  • Workspace: auto-provisioned at install; the same workspace the Console signs into. Team membership is admin-controlled.