Authentication
Sessions, API tokens and agent keys.
ErrorDX accepts three credential types:
| Credential | Use | Header / transport |
|---|---|---|
| Better Auth session | Browser dashboard | session cookie on /api/auth/* |
API token (edx_…) | Scripts, sentry-cli | Authorization: Bearer edx_… |
Agent key (ak_…) | MCP clients, errordx CLI | Authorization: Bearer ak_… |
Auth endpoints
Better Auth runs under:
/api/auth/*This includes sign-in, sign-out and session checks. The web app uses the
better-auth/react client against the same origin.
Sign-in providers
Providers are configured on the auth service, and the login page offers whatever is
configured — GET /api/auth/providers reports the list:
- Google —
GOOGLE_CLIENT_IDandGOOGLE_CLIENT_SECRET. - Any OpenID Connect provider (Keycloak, Okta, Entra ID, Auth0, …) —
OIDC_ISSUER,OIDC_CLIENT_IDandOIDC_CLIENT_SECRET. Endpoints come from the issuer's discovery document.OIDC_PROVIDER_ID(defaultoidc) is the id in the callback URL,OIDC_DISPLAY_NAMEis the button's label, andOIDC_SCOPESdefaults toopenid profile email.
Register the callback URL with the provider:
{BETTER_AUTH_URL}/api/auth/callback/google or
{BETTER_AUTH_URL}/api/auth/callback/{OIDC_PROVIDER_ID}.
API tokens
Create tokens per organization in Settings → Profile → API tokens. The
plaintext token is shown once; only its SHA-256 hash is stored. Tokens are scoped
to their organization with a member or admin role.
Agent keys
Agent keys are machine credentials with read / write / deploy permissions
(see Agents & CLI). They authenticate /api/v1 and /mcp, are
scoped to one organization and are recorded in the agent audit trail.
Sessions in production
Sessions are stored in the shared SQLite database and validated by the Rust
server on every request, so the auth sidecar can restart without logging users
out. Both the plain (better-auth.session_token) and secure
(__Secure-better-auth.session_token) cookie names are accepted.