# Authentication and authorization

:::callout{intent="info" title="Authentication and authorization"}
Authentication and authorization are closely related concepts, and sometimes abbreviated as `AuthN` and `AuthZ`. Authentication (`AuthN`) is the process of verifying the identity of a user, while authorization (`AuthZ`) is the process of determining what permissions the user has.
:::

## Authentication

Weaviate controls access through user authentication via API keys or OpenID Connect (OIDC), with an option for anonymous access. Users can then be assigned different [authorization](../authorization-and-authentication/deploy-configuration-authorization.md) levels, as shown in the diagram below.

```mermaid
flowchart LR
    %% Define main nodes
    Request["Client<br> Request"]
    AuthCheck{"AuthN<br> Enabled?"}
    AccessCheck{"Check<br> AuthZ"}
    Access["✅ Access<br> Granted"]
    Denied["❌ Access<br> Denied"]

    %% Define authentication method nodes
    subgraph auth ["AuthN"]
        direction LR
        API["API Key"]
        OIDC["OIDC"]
        AuthResult{"Success?"}
    end

    %% Define connections
    Request --> AuthCheck
    AuthCheck -->|"No"| AccessCheck
    AuthCheck -->|"Yes"| auth
    API --> AuthResult
    OIDC --> AuthResult
    AuthResult -->|"Yes"| AccessCheck
    AuthResult -->|"No"| Denied

    AccessCheck -->|"Pass"| Access
    AccessCheck -->|"Fail"| Denied

    %% Style nodes
    style Request fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style AuthCheck fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style AccessCheck fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style Access fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style Denied fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style API fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style OIDC fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style AuthResult fill:#ffffff,stroke:#B9C8DF,color:#130C49

    %% Style subgraph
    style auth fill:#ffffff,stroke:#130C49,stroke-width:2px,color:#130C49
```

For example, a user logging in with the API key `jane-secret` may be granted administrator permissions, while another user logging in with the API key `ian-secret` may be granted read-only permissions.

API key and OIDC authentication can be both enabled at the same time. We recommend using a client library to authenticate against Weaviate. See [How-to: Connect](../connect-to-weaviate/index.md) pages for more information.

:::callout{intent="info" title="What about Weaviate Cloud (WCD)?"}
For Weaviate Cloud (WCD) instances, authentication is pre-configured with API key access. You can [authenticate against Weaviate](../connect-to-weaviate/connect-cloud.md) by [creating new API keys](../manage-clusters/connect.md).
:::

### API key

API key authentication is the simplest method to authenticate against Weaviate. Each user is assigned a unique API key, which is passed in the request header. For details on configuring API key authentication, see the [authentication guide](../authorization-and-authentication/deploy-configuration-authentication.md#api-key-authentication).

### OpenID Connect (OIDC)

[OpenID Connect (OIDC)](../authorization-and-authentication/deploy-configuration-authentication.md#oidc-authentication) enables authentication through an external identity provider (e.g., Okta, Azure AD, Google). OIDC supports multiple flows such as client credentials, resource owner password, and hybrid flow. For details on configuring OIDC and working with tokens, see the [OIDC configuration guide](../authorization-and-authentication/deploy-configuration-oidc.md).

### Anonymous access

[Anonymous access](../authorization-and-authentication/deploy-configuration-authentication.md#anonymous-access) allows unauthenticated requests. This is **strongly discouraged** except for local development or evaluation purposes, as it bypasses all identity verification.

## Authorization

Weaviate provides differentiated access through authorization levels, based on the user's [authentication](#authentication) status.

The following authorization schemes are available:

### RBAC (recommended)

[Role-Based Access Control (RBAC)](../authorization-and-authentication/weaviate-configuration-rbac.md) provides fine-grained control over user permissions. With RBAC, you define roles with specific permissions and assign them to users. This is the **recommended authorization scheme** for production deployments.

RBAC supports:

- **Predefined roles**: `root` (full access) and `viewer` (read-only access)
- **Custom roles**: Create roles with specific permissions for collections, objects, tenants, backups, and more
- **Granular permissions**: Control access at the collection, tenant, and operation level using name filters and regex patterns

See [RBAC Overview](../authorization-and-authentication/weaviate-configuration-rbac.md) for the full permissions model, and [Configuring RBAC](../authorization-and-authentication/deploy-configuration-configuring-rbac.md) for setup instructions.

### Admin list (legacy)

:::callout{intent="warning" title="Prefer RBAC over Admin list"}
The Admin list authorization scheme only provides coarse-grained access control (admin or read-only). Use [RBAC](#rbac-recommended) instead for production deployments, as it provides much more flexible and secure permission management.
:::

The [Admin list](../authorization-and-authentication/deploy-configuration-authorization.md#admin-list) scheme assigns users as either admin (full access) or read-only. [Anonymous users](../authorization-and-authentication/deploy-configuration-authorization.md#anonymous-users) can optionally be granted permissions.

### Undifferentiated access

With [undifferentiated access](../authorization-and-authentication/deploy-configuration-authorization.md#undifferentiated-access), all authenticated users have full access. This is only suitable for development or trusted single-user environments.

## Further resources

- [Configuration: Authentication](../authorization-and-authentication/deploy-configuration-authentication.md)
- [Configuration: Authorization](../authorization-and-authentication/deploy-configuration-authorization.md)
- [Configuration: OIDC](../authorization-and-authentication/deploy-configuration-oidc.md)
- [Configuration: RBAC](../authorization-and-authentication/weaviate-configuration-rbac.md)
- [Configuration: Environment variables - Authentication and Authorization](../database-configuration/overview.md#authentication-and-authorization)
- [Weaviate MCP server](../ai-assisted-vibe-coding/configuration-mcp-server.md) (authenticates via API key and respects RBAC permissions)

## Questions and feedback

Have a question or feedback? Here's how to reach us.

::::card-grid
:::card{title="Community Forum" href="https://forum.weaviate.io/c/support" icon="messages-square"}
Ask questions and connect with other developers on our **Community forum**.
:::

:::card{title="Support" href="/guides/support-overview" icon="life-buoy"}
Weaviate Cloud user or customer? Find the right channel on the **Support page**.
:::
::::

## Related pages

- [Agents](./agents-index.md)
- [AI-assisted Weaviate code generation](./ai-assisted-vibe-coding-index.md)
- [APIs](./apis-index.md)
- [Authorization and authentication](./authorization-and-authentication-index.md)
- [Benchmarks](./benchmarks-index.md)
- [Best practices](./best-practices-index.md)
- [Client libraries](./clients-index.md)
- [Client Libraries / SDKs](./client-libraries-index.md)
- [Cloud](./cloud-index.md)
- [Cloud account management](./cloud-account-management-index.md)

# Agent Instructions

This portal answers questions programmatically. To receive a synthesized,
source-cited answer instead of crawling page by page, append the `?ask=`
query parameter to any page URL on this site:

    /guides/quickstart?ask=how+do+I+authenticate

Optional parameters:

- `&goal=<what-you-are-trying-to-do>` steers the answer toward your
  objective (e.g. `&goal=write+a+python+client`).
- `&version=<label>` scopes the answer to a mounted version when the
  portal publishes more than one.

The response is `text/markdown`: the answer followed by a `# Sources` list
of the portal pages it was grounded in. Status codes are the contract:

- `200` — the answer; `402` — the portal owner’s plan or answer credits are
  exhausted (surface this to your operator; do NOT retry); `429` — you are
  rate-limited; back off for the `Retry-After` seconds; `503` — the answer
  lane is temporarily unavailable; fall back to crawling the `.md` pages.

For the full corpus map read `llms.txt` at the site root; for the tool
surface (search + page fetch as MCP tools) see `/mcp`.