---
title: "User sign-in and identity"
version: "v0.27.0"
canonical: "https://docs.obot.ai/v0.27.0/security/authentication"
unreleased: false
---

# User sign-in and identity

Enable authentication before onboarding users or deploying servers for shared use.

1. Enable authentication using the [bootstrap setup procedure](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md#obot-doc-enabling-authentication-step-1-set-environment-variables), or use the [preconfigured Local owner](https://docs.obot.ai/v0.27.0/installation/docker-deployment.md#obot-doc-preconfigure-a-local-owner) Docker setup.
2. Configure one [authentication provider](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md), including allowed email domains and provider-specific group lookup requirements.
3. Assign [roles](https://docs.obot.ai/v0.27.0/security/policy-coverage.md) and resource policies for the users who sign in.
4. Use [agent authorization scopes](https://docs.obot.ai/v0.27.0/functionality/agent-auth-scopes.md) for programmatic clients that need API keys.

Local authentication stores passwords as salted hashes and supports administrator-created accounts and required password changes. External providers authenticate through their configured OAuth/OIDC integration. Provider availability depends on [edition](https://docs.obot.ai/v0.27.0/enterprise/overview.md).

Obot login and upstream MCP OAuth are separate authorizations. The [authentication flow](https://docs.obot.ai/v0.27.0/concepts/architecture.md#obot-doc-authentication-flow) explains what the client receives and what Obot retains.

Before switching providers, read the [provider-switch procedure](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md#obot-doc-switching-between-auth-providers). Identities are provider-scoped; a new provider login is not an automatic transfer of the user's existing resources.

After enabling authentication, open **Identity & Access** to manage users, roles, agent identities, and providers.

<a id="obot-doc-user-management-users"></a>

## Users

Open **Identity & Access > Users**. From this page you can:

- See all registered users and their current roles
- Update individual user roles
- Monitor user activity

For details on updating roles, see [User Roles](https://docs.obot.ai/v0.27.0/security/policy-coverage.md#obot-doc-user-roles-managing-user-roles).

<a id="obot-doc-user-management-user-roles"></a>

## User Roles

Open **Identity & Access > Roles** to configure the default role assigned to new users. Choose from:

- **Standard User**: Connect to approved MCP servers
- **Power User**: Standard User features plus publish personal MCP servers
- **Power User Plus**: Power User features plus share MCP servers through registries
- **Admin**: Full platform management

For detailed role descriptions and permissions, see [User Roles](https://docs.obot.ai/v0.27.0/security/policy-coverage.md).

<a id="obot-doc-user-management-agent-authorization-scopes"></a>

## Agent Authorization Scopes

Open **Identity & Access > Agents** to view and manage agent identities and their authorization scopes. Administrators can see which users have created agent authorization scopes and delete any if necessary. For details, see [Agent Authorization Scopes](https://docs.obot.ai/v0.27.0/functionality/agent-auth-scopes.md).

<a id="obot-doc-user-management-auth-providers"></a>

## Auth Providers

Configure identity providers for user authentication. See [Auth Providers](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md) for setup details.

<a id="obot-doc-authentication-setup"></a>

## Authentication setup

Installation and provider configuration are covered in [Configure authentication providers](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md). The links below preserve existing setup bookmarks.

<a id="obot-doc-enabling-authentication-step-1-set-environment-variables"></a>

## Step 1: Set Environment Variables

Continue to [Step 1: Set Environment Variables](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md#obot-doc-enabling-authentication-step-1-set-environment-variables).

<a id="obot-doc-enabling-authentication-step-2-start-obot-and-login"></a>

## Step 2: Start Obot and Login

Continue to [Step 2: Start Obot and Login](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md#obot-doc-enabling-authentication-step-2-start-obot-and-login).

<a id="obot-doc-enabling-authentication-step-3-configure-authentication-provider"></a>

## Step 3: Configure Authentication Provider

Continue to [Step 3: Configure Authentication Provider](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md#obot-doc-enabling-authentication-step-3-configure-authentication-provider).

<a id="obot-doc-enabling-authentication-post-setup"></a>

## Post-Setup

Continue to [Post-Setup](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md#obot-doc-enabling-authentication-post-setup).

<a id="obot-doc-enabling-authentication-troubleshooting"></a>

## Troubleshooting

Continue to [Troubleshooting](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md#obot-doc-enabling-authentication-troubleshooting).

<a id="obot-doc-enabling-authentication-bootstrap-token-not-working"></a>

### Bootstrap Token Not Working

Continue to [Bootstrap Token Not Working](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md#obot-doc-enabling-authentication-bootstrap-token-not-working).

<a id="obot-doc-enabling-authentication-authentication-provider-issues"></a>

### Authentication Provider Issues

Continue to [Authentication Provider Issues](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md#obot-doc-enabling-authentication-authentication-provider-issues).

<a id="obot-doc-enabling-authentication-next-steps"></a>

## Next Steps

Continue to [Next Steps](https://docs.obot.ai/v0.27.0/configuration/auth-providers.md#obot-doc-enabling-authentication-next-steps).