Configure Basic Auth and OIDC Login in Kestra
For the complete documentation index, see llms.txt. For a full content snapshot, see llms-full.txt. Append .md to any kestra.io/docs/* URL for plain Markdown.

Kestra supports two authentication methods: Basic Auth (enabled by default) and OpenID Connect (OIDC).

Kestra uses the default encryption key for JWT sessions. Generate a secret of at least 256 bits and add it to your Kestra Security and Secrets configuration:

kestra:
  encryption:
    secret-key: your-256-bits-secret

This secret must be the same across all your webserver instances and will be used to sign the JWT cookie and encode the refresh token.

To use separate keys for the signature and refresh token:

micronaut:
  security:
    token:
      jwt:
        generator:
          refresh-token:
            secret: refresh-token-256-bits-secret
        signatures:
          secret:
            generator:
              secret: signature-256-bits-secret

Basic authentication

The default installation comes with no users defined. To create an administrator account, use the following CLI command:

./kestra auths users create --admin --username=<admin-username> --password=<admin-password> --tenant=<tenant-id>

Without multi-tenancy, omit the --tenant parameter.

Single sign-on (SSO)

Single Sign-On (SSO) is an authentication process that allows users to access multiple applications with one set of login credentials (e.g., Sign in with Google). Kestra supports SSO using the OpenID Connect (OIDC) protocol, which is a simple identity layer built on top of the OAuth 2.0 protocol.

Enable OIDC in your Micronaut configuration:

micronaut:
  security:
    oauth2:
      enabled: true
      clients:
        google:
          client-id: "{{ clientId }}"
          client-secret: "{{ clientSecret }}"
          openid:
            issuer: "{{ issuerUrl }}"

See the Micronaut OIDC configuration guide for full details. See Single Sign-On to configure SSO with Google, Microsoft, and other providers.

Was this page helpful?