Unified auth
Sign in to Observe
Use the local admin path for development. The same auth proxy boundary fronts the product shell, APIs, and Grafana upstreams.
Production identity
OIDC/SAML handoff point
Session
Signed, HTTP-only cookie issued by auth proxy.
Workspace
Trusted identity header maps each request to a tenant.
Upstreams
Control-plane, Grafana, and APIs receive stripped/reissued headers.