Overview
Flipt supports the ability to secure its core API routes.
Flipt authentication is disabled (not required) by default.
Head to the Configuration: Authentication section to enable it.
Once enabled, all routes beneath the following API prefixes will require a client token in order to authenticate requests:
/api/v1//auth/v1//meta//evaluation/v1/
The following URLs aren’t protected by authentication:
/debug/metrics/health
They’re currently unprotected to support backwards compatibility. We’re exploring ways to support protecting these endpoints going forward. For now, we recommend excluding these API prefixes from your load-balancer.
Apart from /auth/v1/ itself, the rest of the top-level API prefixes can be optionally excluded from authentication.
Allowing for sections, such as the evaluations API, to be publicly accessible while still protecting the management and metadata APIs.
Checkout the Configuration: Authentication Exclusions documentation for details.
Client Tokens
Client tokens are the core credential required to authenticate a request. Tokens themselves are acquired via authentication methods.
Flipt supports multiple authentication methods for acquiring credentials:
Once a client token has been acquired, it can be supplied via request metadata dependent on the protocol. Both HTTP and gRPC examples can be found on the Using Client Tokens page.
Authorization
Currently, Flipt only supports authentication without any extended authorization capabilities. Authorization is something we’re actively exploring and we will update this section as we settle on a design.
We would appreciate your input into designing authorization. Head over to our discord and let us know what you need from Flipt.