SkyfloDocs
DeploymentAuthentication & Teams

Authentication & Teams

Skyflo uses JWT-based authentication with refresh token rotation. The first registered user becomes the admin.

First Login

After installation, open the Command Center and register the first account. This account automatically becomes the admin with full permissions.

Authentication Flow

  1. Login via POST /auth/jwt/login stores auth_token and refresh_token as HttpOnly cookies.
  2. Access tokens expire after 15 minutes (configurable via jwtAccessTokenExpireMinutes).
  3. Refresh tokens are rotated automatically every 14 minutes. Valid for 7 days by default.
  4. Logout revokes the refresh token and clears cookies.

Token Configuration

Set these in the Helm values under engine.config:

SettingDefaultDescription
jwtAlgorithmHS256JWT signing algorithm
jwtAccessTokenExpireMinutes15Access token lifetime
jwtRefreshTokenExpireDays7Refresh token lifetime

The jwtSecret under engine.secrets is auto-generated on first install and preserved across upgrades.

Team Management

Admins can manage team members from the Command Center settings:

  • Add members with email and role assignment
  • Update roles for existing members
  • Remove members from the team

Roles

RolePermissions
AdminFull access. Manage team, integrations, approve operations.
MemberUse the agent, approve operations, view conversations.

SSO (Team Plan)

SAML 2.0 and OIDC support for enterprise identity providers is available in the Team plan. Book a demo to learn more.