Authentication

Two auth methods: session cookies for the dashboard and API keys for programmatic access.

Authentication

Igris supports two authentication methods depending on the context.

Session Cookies (Dashboard)

When you log in through the dashboard, Better Auth sets an igris.session_token cookie. This cookie is automatically sent with all dashboard requests.

For API calls from a browser context, include credentials:

fetch("https://your-igris.fly.dev/api/v1/policies", {
  credentials: "include" // sends session cookie
});

Or pass the cookie explicitly:

curl https://your-igris.fly.dev/api/v1/policies \
  -H "Cookie: igris.session_token=eyJhbGciOi..."

API Keys (Programmatic Access)

For MCP proxy connections, log ingestion, and CI/CD integrations, use API keys.

Creating an API Key

1. Go to Settings → API Keys in the dashboard
2. Click Create Key
3. Give it a label (e.g., “Proxy - Production”, “Portkey Ingestion”)
4. Copy the key — it’s only shown once

API keys follow the format ig_ followed by a random string:

ig_k1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6

Using an API Key

Pass the key in the Authorization header:

curl https://your-igris.fly.dev/api/v1/policies \
  -H "Authorization: Bearer ig_k1a2b3c4d5e6f7..."

Key Scoping

API keys inherit the permissions of the user who created them and are scoped to their active organization. A key created by an admin has admin-level access to that organization’s resources.

Revoking Keys

Revoke a key in Settings → API Keys by clicking Revoke. Revoked keys immediately stop working — any proxy connections or ingestion webhooks using that key will receive 401 Unauthorized.

Organization Context

All API requests are scoped to an organization. The organization is determined by:

1. Session cookies — the user’s active organization in their session
2. API keys — the organization the key was created in

Error Responses

Status	Meaning
401 Unauthorized	Missing, invalid, or revoked credentials
403 Forbidden	Valid credentials but insufficient role permissions
403 Plan Required	Feature requires a higher plan tier

{
  "error": "Unauthorized",
  "message": "Invalid or expired API key"
}

RBAC Roles

Permissions are enforced based on the user’s role in the organization:

Role	Governance	Compliance	Billing	Members
Owner	Full	Full	Full	Full
Admin	Full	Full	View	Manage
Developer	Own servers	View	—	—
CISO	View	Full	View	—
Auditor	Read-only	Read-only	—	—