Authentication & Teams

Skyflo uses JWT-based authentication with refresh token rotation. The first registered user becomes the admin.

First Login#

After installation, open the Command Center and register the first account. This account automatically becomes the admin with full permissions.

Authentication Flow#

1. Login via POST /auth/jwt/login stores auth_token and refresh_token as HttpOnly cookies.
2. Access tokens expire after 15 minutes (configurable via jwtAccessTokenExpireMinutes).
3. Refresh tokens are rotated automatically every 14 minutes. Valid for 7 days by default.
4. Logout revokes the refresh token and clears cookies.

Token Configuration#

Set these in the Helm values under engine.config:

The jwtSecret under engine.secrets is auto-generated on first install and preserved across upgrades.

Team Management#

Admins can manage team members from the Command Center settings:

• Add members with email and role assignment
• Update roles for existing members
• Remove members from the team

Roles#

SSO#

The open-source project does not include SAML 2.0 or OIDC single sign-on. A paid Team plan for this agent is not offered.