Authentication
Choose an authentication method for your Dagu instance.
Choose an authentication method
| Method | Use it when |
|---|---|
| Builtin | You need multiple users, roles, API keys, OIDC, or proxy authentication. This is the recommended self-hosted mode. |
| Builtin + OIDC | Users should sign in through an OpenID Connect provider. Self-hosted SSO requires an active license. |
| Builtin + proxy authentication | A reverse proxy authenticates users and is the only network path to Dagu. Self-hosted SSO requires an active license. |
| Basic | A single shared account is enough and you do not need user management. |
none | Authentication is handled outside Dagu or the instance is isolated. |
Builtin authentication is the default. On a new installation, create the first builtin administrator through /setup or auth.builtin.initial_admin. Dagu requires this administrator before it allows OIDC sign-in.
Related access controls
- User management covers roles, workspace access, and password operations.
- Proxy authentication covers header-based identity, network isolation, and proxy-managed access.
- API keys provide role-based access for automation.
- Webhooks use DAG-specific tokens for external triggers.
- TLS/HTTPS secures browser and API connections.
- Remote nodes covers authentication between Dagu instances.