generated: '2026-07-18'
method: searched
source: https://docs.diagrid.io/concepts/security
docs: https://docs.diagrid.io/concepts/identities
notes: >-
  Derived from Diagrid Catalyst security/identity docs (no public OpenAPI is
  published; the platform exposes the Dapr HTTP/gRPC APIs behind a regional
  gateway). Application calls present a scoped app API token over TLS; human and
  automation access is role-based; internal workloads use SPIFFE X.509 SVID mTLS.
summary:
  types: [apiKey, http, oauth2, mutualTLS]
  api_key_in: [header]
  oauth2_flows: [browser-login]
  workload_identity: SPIFFE-X.509-SVID
schemes:
  - name: AppApiToken
    type: apiKey
    in: header
    description: >-
      Scoped application API token presented on every Dapr API call to the
      regional Catalyst gateway; transport is TLS. Created/managed via
      `diagrid apikey` and service-account API keys.
    docs: https://docs.diagrid.io/references/catalyst/cli-reference/apikey/
  - name: ServiceAccountToken
    type: apiKey
    in: header
    description: >-
      Named machine tokens tied to a role assignment, with configurable expiry
      and optional project scope, for automation and CI.
    docs: https://docs.diagrid.io/references/catalyst/cli-reference/serviceaccount/
  - name: CliLogin
    type: oauth2
    flow: browser-login
    description: >-
      Interactive browser-based login used by the diagrid CLI; access and
      identity tokens can be printed via `diagrid auth print-access-token` /
      `print-identity-token`.
    docs: https://docs.diagrid.io/references/catalyst/cli-reference/auth/
  - name: SamlSso
    type: openIdConnect
    description: SAML 2.0 SSO via enterprise identity providers (Catalyst Enterprise).
    plans: [enterprise]
  - name: WorkloadMtls
    type: mutualTLS
    description: >-
      SPIFFE-based mutual TLS between in-platform workloads; each data-plane
      component receives a short-lived X.509 SVID signed by Dapr Sentry, rotated
      automatically.
    docs: https://docs.diagrid.io/concepts/security
roles:
  - Admin
  - Operator
  - Consumer
  - Viewer
access_policies:
  description: >-
    Runtime behavior is governed declaratively by access policies controlling
    which applications can be invoked and which components they can access.
  docs: https://docs.diagrid.io/concepts/policies