Skip to main content

Authentication

Authenticate users and manage access tokens. The Backstage API uses JWT tokens for authentication-you'll get an access token when you log in, and use it for all subsequent requests.

Authentication Flow​

1. Login with email/password → Get access + refresh tokens
2. Use access token in Authorization header for API calls
3. When access token expires, use refresh token to get new tokens
4. For SSO, use the federate endpoint with your identity provider

Token Types​

  • Access Token - Short-lived (15 min), used for API requests
  • Refresh Token - Long-lived (7 days), used to get new access tokens

Common Scenarios​

  • Direct login: Use /auth/login with email and password
  • SSO/OAuth: Use /auth/federate with your identity provider's token
  • New user setup: Use /auth/redeem to activate an invitation

Operations​