> For the complete documentation index, see [llms.txt](https://docs.durohub.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.durohub.com/account-management/how-authentication-works.md).

# How Authentication Works

Duro has two ways to prove who you are. Picking the wrong one costs you a day, so start here.

| You are…                                                                  | Use                                                                                                 |
| ------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| A script, integration, or backend service acting **as your organization** | An **API key** in the `x-api-key` header — see [Authentication](/getting-started/authentication.md) |
| An identity provider signing your people in                               | **SAML SSO** and **SCIM**, covered in this section                                                  |
| An application signing in **as an individual person**                     | The account APIs below                                                                              |

{% hint style="success" %}
**Most integrations want an API key.** If yours authenticates with `x-api-key`, nothing in this section changes anything for you.
{% endhint %}

## What lives where

Duro runs its own authentication — there is no third-party identity provider in the path. Account creation, verification, sign-in, password reset, Google, and SAML all run on Duro's own domain.

Anything that creates or destroys a credential is **REST**, under `/auth/*` on the API host. Anything that configures identity is **GraphQL**, alongside the rest of the API.

```
https://api.durohub.com/auth/…      authentication
https://api.durohub.com/graphql     everything else
```

Because authentication is REST, none of it appears in the GraphQL schema or Apollo Explorer.

## Signing in is not the same as having access

Worth knowing whichever credential you use, because it is the surprise that catches people:

> **A successful sign-in does not mean the caller can use Duro.**

Duro admits someone when any of these is true:

1. They already belong to an organization
2. A live invitation exists for their **verified** email address
3. An organization's allowlist covers their address or domain
4. They hold a pending organization-creation grant

An account with none of those can read its own profile and little else; organization-scoped queries are refused. `user { me { hasOrganizations } }` is the cheapest way to check — see [Current User](/getting-started/current-user.md).

Note **verified** in point 2. An address must be verified before an invitation, allowlist entry, or domain match will apply to it.

## Where to go next

|                                                                   |                                                |
| ----------------------------------------------------------------- | ---------------------------------------------- |
| [Creating an Account](/account-management/creating-an-account.md) | Sign up and verify an account through the API  |
| [Enterprise SSO (SAML)](/account-management/enterprise-sso.md)    | Let your identity provider sign your people in |
| [SCIM Provisioning](/account-management/scim-provisioning.md)     | Provision users and teams automatically        |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.durohub.com/account-management/how-authentication-works.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.