For AI agents: the documentation index is at /docs/mdmbox/llms.txt. A Markdown version of this page is available at /docs/mdmbox/authentication.md or by requesting it with the Accept: text/markdown header.
MDMbox Docs

Authentication

Authentication is enabled by default and is controlled by MDMBOX_AUTH_ENABLED. MDMbox supports separate authentication flows for API requests and the Admin UI.

InterfaceAuthentication
APIBasic credentials for an Aidbox Client, an Aidbox access token, or an external JWT validated by TokenIntrospector
Admin UIAidbox browser session backed by an Aidbox User

Every authenticated credential has full access to protected MDMbox endpoints.

Basic API authentication

Set both variables to create credentials for API access:

MDMBOX_API_CLIENT_ID=mdmbox-api
MDMBOX_API_CLIENT_SECRET=<secret>

Send the client credentials through HTTP Basic authentication:

curl --user "mdmbox-api:$MDMBOX_API_CLIENT_SECRET" \
  http://localhost:3000/api/models

Admin UI authentication

Set both variables to create an admin for browser login:

MDMBOX_ADMIN_ID=admin
MDMBOX_ADMIN_PASSWORD=<password>

Use these credentials to sign in at /login.

Login and logout are audited.

External JWT authentication

Configure token validation using the Aidbox Token Introspector documentation, then send the token to MDMbox:

curl http://localhost:3000/api/models \
  --header "Authorization: Bearer $ACCESS_TOKEN"

For a runnable setup, see the Keycloak authentication example. For existing users, clients, and sessions, see Aidbox authentication.

Public endpoints

The health checks, Swagger UI, and OpenAPI specification remain public when authentication is enabled:

  • /healthz
  • /readyz
  • /api/docs
  • /api/openapi.json

Last updated: