DocsFeaturesAuthentication

Authentication

Sign in to Lifecycle, link GitHub, sign out, and verify access controls.

Lifecycle uses OpenID Connect (OIDC) for interactive sign-in. It uses API keys for programmatic access.

🚫

The stock installation is not a complete authentication-on profile for shared-network exposure. Before exposure, use a complete authentication-on profile and procedure for the installed release. If the release does not supply this procedure, keep the deployment isolated. Do not disable authentication to bypass a failed test.

Sign in

  1. Open your organization’s Lifecycle URL.
  2. Complete the identity-provider sign-in.
  3. If your organization requires multifactor authentication, complete it.
  4. Make sure that Lifecycle shows the expected account.

If sign-in fails, select Try again. If the failure continues, send the displayed message to your administrator.

Link your GitHub identity

GitHub account linking is different from signing in to Lifecycle. After sign-in, Lifecycle can show a GitHub connection prompt. The connection identifies your GitHub user for repository actions and Agent workflows.

You can select Skip this step and connect later. Select Link GitHub from the account menu when you are ready.

If Lifecycle cannot use the saved authorization, select Reconnect GitHub. Do not create a second Lifecycle account.

Connecting GitHub does not replace company SSO. It adds a repository identity to your existing Lifecycle account.

Sign out

  1. Open the account menu.
  2. Select Log out.
  3. Open a protected Lifecycle page.
  4. Make sure that Lifecycle requires sign-in.

Check the security boundary

Before you make a deployment available on an untrusted network, make sure that:

  1. An unauthenticated UI request redirects to sign-in.
  2. An unauthenticated v2 API request returns 401.
  3. A signed-in user receives only the expected Lifecycle role.
  4. A forbidden administrator action returns 403.
  5. GitHub linking changes only GitHub-dependent features.
  6. Signing out invalidates the browser session.

Also test the token issuer, audience, redirect URIs, trusted proxy headers, and TLS. Test secret rotation before you rely on the deployment.

For programmatic access, continue with API authentication and API keys.

Create a default static EnvironmentAuto-deploy and labels