Environment Auth

Environment Variable Auth

auth:
  environmentEnabled: true
  dbEnabled: false

When environmentEnabled is set to true, Conduit loads authorization tokens from the following environment variables:

• AUTH_TOKEN_ADMIN
• AUTH_TOKEN_READ_WRITE
• AUTH_TOKEN_READ_ONLY

Each variable defines a token for a specific role. Clients authenticate by including the token in the Authorization header:

Authorization: Bearer <token>

Roles and Permissions

Environment-based auth supports three roles:

• Admin — full access to all actions
• ReadWrite — can read and write, but cannot mutate schema
• ReadOnly — can only perform read operations

Conduit evaluates the requested action and determines whether the role is permitted to perform it.

ActionReadTable      → allowed for all roles
ActionWriteTable     → allowed for Admin and ReadWrite
ActionMutateSchema   → allowed only for Admin

Noop Mode

If all three environment variables are unset, the environment authenticator enters noop mode. In this mode, it performs no authorization checks and always reports that it is inactive.

AUTH_TOKEN_ADMIN=""
AUTH_TOKEN_READ_WRITE=""
AUTH_TOKEN_READ_ONLY=""

This allows Conduit to fall back to other authorization mechanisms or operate without authorization entirely.

Example

export AUTH_TOKEN_ADMIN="admin-secret"
export AUTH_TOKEN_READ_WRITE="rw-secret"
export AUTH_TOKEN_READ_ONLY="ro-secret"

A client using the ReadWrite token would authenticate with:

Authorization: Bearer rw-secret

This client can read and write data, but cannot perform schema mutations.