Authentication and authorization

Weaviate controls access through user authentication via API keys or OpenID Connect (OIDC), with an option for anonymous access. Users can then be assigned different authorization levels, as shown in the diagram below.

flowchart LR
    %% Define main nodes
    Request["Client<br> Request"]
    AuthCheck{"AuthN<br> Enabled?"}
    AccessCheck{"Check<br> AuthZ"}
    Access["✅ Access<br> Granted"]
    Denied["❌ Access<br> Denied"]

    %% Define authentication method nodes
    subgraph auth ["AuthN"]
        direction LR
        API["API Key"]
        OIDC["OIDC"]
        AuthResult{"Success?"}
    end

    %% Define connections
    Request --> AuthCheck
    AuthCheck -->|"No"| AccessCheck
    AuthCheck -->|"Yes"| auth
    API --> AuthResult
    OIDC --> AuthResult
    AuthResult -->|"Yes"| AccessCheck
    AuthResult -->|"No"| Denied

    AccessCheck -->|"Pass"| Access
    AccessCheck -->|"Fail"| Denied

    %% Style nodes
    style Request fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style AuthCheck fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style AccessCheck fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style Access fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style Denied fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style API fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style OIDC fill:#ffffff,stroke:#B9C8DF,color:#130C49
    style AuthResult fill:#ffffff,stroke:#B9C8DF,color:#130C49

    %% Style subgraph
    style auth fill:#ffffff,stroke:#130C49,stroke-width:2px,color:#130C49

For example, a user logging in with the API key jane-secret may be granted administrator permissions, while another user logging in with the API key ian-secret may be granted read-only permissions.

API key and OIDC authentication can be both enabled at the same time. We recommend using a client library to authenticate against Weaviate. See How-to: Connect pages for more information.

API key authentication is the simplest method to authenticate against Weaviate. Each user is assigned a unique API key, which is passed in the request header. For details on configuring API key authentication, see the authentication guide.

OpenID Connect (OIDC) enables authentication through an external identity provider (e.g., Okta, Azure AD, Google). OIDC supports multiple flows such as client credentials, resource owner password, and hybrid flow. For details on configuring OIDC and working with tokens, see the OIDC configuration guide.

Anonymous access allows unauthenticated requests. This is strongly discouraged except for local development or evaluation purposes, as it bypasses all identity verification.

Weaviate provides differentiated access through authorization levels, based on the user's authentication status.

The following authorization schemes are available:

Role-Based Access Control (RBAC) provides fine-grained control over user permissions. With RBAC, you define roles with specific permissions and assign them to users. This is the recommended authorization scheme for production deployments.

RBAC supports:

• Predefined roles: root (full access) and viewer (read-only access)
• Custom roles: Create roles with specific permissions for collections, objects, tenants, backups, and more
• Granular permissions: Control access at the collection, tenant, and operation level using name filters and regex patterns

See RBAC Overview for the full permissions model, and Configuring RBAC for setup instructions.

The Admin list scheme assigns users as either admin (full access) or read-only. Anonymous users can optionally be granted permissions.

With undifferentiated access, all authenticated users have full access. This is only suitable for development or trusted single-user environments.

• Configuration: Authentication
• Configuration: Authorization
• Configuration: OIDC
• Configuration: RBAC
• Configuration: Environment variables - Authentication and Authorization
• Weaviate MCP server (authenticates via API key and respects RBAC permissions)

Have a question or feedback? Here's how to reach us.