> ## Documentation Index
> Fetch the complete documentation index at: https://docs.keephq.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> [!TIP]
>
> For every authentication-related question or issue, please join our [Slack](https://slack.keephq.dev).

Keep supports various authentication providers and architectures to accommodate different deployment strategies and security needs, from development environments to production setups.

### Authentication Providers

* [**No Authentication**](https://docs.keephq.dev/deployment/authentication/no-auth.md) - Quick setup for testing or internal use cases.
* [**DB**](https://docs.keephq.dev/deployment/authentication/db-auth.md) - Simple username/password authentication. Works well for small teams or for dev/stage environments. Users and hashed password are stored on DB.
* [**Auth0**](https://docs.keephq.dev/deployment/authentication/auth0-auth.md) - Utilize Auth0 for scalable, auth0-based authentication.
* [**Keycloak**](https://docs.keephq.dev/deployment/authentication/keycloak-auth.md) - Utilize Keycloak for enterprise authentication methods such as SSO/SAML/OIDC, advanced RBAC with custom roles, resource-level permissions, and integration with user directories (LDAP).
* [**AzureAD**](https://docs.keephq.dev/deployment/authentication/azuread-auth.md) - Utilize Azure AD for SSO/SAML/OIDC nterprise authentication.
* [**Okta**](https://docs.keephq.dev/deployment/authentication/okta-auth.md) - Utilize Okta for SSO/OIDC authentication.
* [**OneLogin**](https://docs.keephq.dev/deployment/authentication/onelogin-auth.md) - Utilize OneLogin for SSO/OIDC authentication.
* [**Generic OIDC**](https://docs.keephq.dev/deployment/authentication/oidc-auth.md) - Bring your own OIDC provider: Dex, Authentik, Zitadel, Authelia, Kanidm, Keycloak and similar.

Choosing the right authentication strategy depends on your specific use case, security requirements, and deployment environment. You can read more about each authentication provider.

### Authentication Features Comparison

| Identity Provider | RBAC | SAML/OIDC/SSO | LDAP | Resource-based permission | User Management | Group Management | On Prem | License |
| :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: |
| **No Auth** | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | **OSS** |
| **DB** | ✅ (Predefiend roles) | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ | **OSS** |
| **Auth0** | ✅ (Predefiend roles) | ✅ | 🚧 | 🚧 | ✅ | 🚧 | ❌ | **EE** |
| **Keycloak** | ✅ (Custom roles) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | **EE** |
| **Oauth2Proxy** | ✅ (Predefiend roles) | ✅ | ❌ | ❌ | N/A | N/A | ✅ | **OSS** |
| **Azure AD** | ✅ (Predefiend roles) | ✅ | ❌ | ❌ | By Azure AD | By Azure AD | ✅ | **EE** |
| **Okta** | ✅ (Predefiend roles) | ✅ | ❌ | ✅ | ❌ | ❌ | ✅ | **OSS** |
| **OneLogin** | ✅ (Predefiend roles) | ✅ | ❌ | ✅ | ❌ | ❌ | ✅ | **OSS** |
| **Generic OIDC** | ✅ (Predefiend roles) | ✅ | ❌ | ❌ | ❌ | ❌ | ✅ | **OSS** |

### How To Configure

> [!TIP]
>
> Some authentication providers require additional environment variables. These will be covered in detail on the specific authentication provider pages.

The authentication scheme on Keep is controlled with environment variables both on the backend (Keep API) and the frontend (Keep UI).

| Identity Provider | Environment Variable | Additional Variables Required |
| - | - | - |
| **No Auth** | `AUTH_TYPE=NOAUTH` | None |
| **DB** | `AUTH_TYPE=DB` | `KEEP_JWT_SECRET` |
| **Auth0** | `AUTH_TYPE=AUTH0` | `AUTH0_DOMAIN`, `AUTH0_CLIENT_ID`, `AUTH0_CLIENT_SECRET` |
| **Keycloak** | `AUTH_TYPE=KEYCLOAK` | `KEYCLOAK_URL`, `KEYCLOAK_REALM`, `KEYCLOAK_CLIENT_ID`, `KEYCLOAK_CLIENT_SECRET` |
| **Oauth2Proxy** | `AUTH_TYPE=OAUTH2PROXY` | `OAUTH2_PROXY_USER_HEADER`, `OAUTH2_PROXY_ROLE_HEADER`, `OAUTH2_PROXY_AUTO_CREATE_USER` |
| **AzureAD** | `AUTH_TYPE=AZUREAD` | See [AzureAD Configuration](https://docs.keephq.dev/deployment/authentication/azuread-auth.md) |
| **Okta** | `AUTH_TYPE=OKTA` | `OKTA_DOMAIN`, `OKTA_CLIENT_ID`, `OKTA_CLIENT_SECRET` |
| **OneLogin** | `AUTH_TYPE=ONELOGIN` | See [OneLogin Configuration](https://docs.keephq.dev/deployment/authentication/onelogin-auth.md) |
| **Generic OIDC** | `AUTH_TYPE=OIDC` | See [Generic OIDC Configuration](https://docs.keephq.dev/deployment/authentication/oidc-auth.md) |

For more details on each authentication strategy, including setup instructions and implications, refer to the respective sections.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.