Sign in to Observe

Use the local admin path for development. The same auth proxy boundary fronts the product shell, APIs, and Grafana upstreams.

Production identity

OIDC/SAML handoff point

Session

Signed, HTTP-only cookie issued by auth proxy.

Workspace

Trusted identity header maps each request to a tenant.

Upstreams

Control-plane, Grafana, and APIs receive stripped/reissued headers.