> For the complete documentation index, see [llms.txt](https://docs.durohub.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.durohub.com/account-management/how-authentication-works.md).

# How Authentication Works

Duro has two ways to prove who you are. Picking the wrong one costs you a day, so start here.

| You are…                                                                  | Use                                                                                                 |
| ------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| A script, integration, or backend service acting **as your organization** | An **API key** in the `x-api-key` header — see [Authentication](/getting-started/authentication.md) |
| An identity provider signing your people in                               | **SAML SSO** and **SCIM**, covered in this section                                                  |
| An application signing in **as an individual person**                     | The account APIs below                                                                              |

{% hint style="success" %}
**Most integrations want an API key.** If yours authenticates with `x-api-key`, nothing in this section changes anything for you.
{% endhint %}

## What lives where

Duro runs its own authentication — there is no third-party identity provider in the path. Account creation, verification, sign-in, password reset, Google, and SAML all run on Duro's own domain.

Anything that creates or destroys a credential is **REST**, under `/auth/*` on the API host. Anything that configures identity is **GraphQL**, alongside the rest of the API.

```
https://api.durohub.com/auth/…      authentication
https://api.durohub.com/graphql     everything else
```

Because authentication is REST, none of it appears in the GraphQL schema or Apollo Explorer.

## Signing in is not the same as having access

Worth knowing whichever credential you use, because it is the surprise that catches people:

> **A successful sign-in does not mean the caller can use Duro.**

Duro admits someone when any of these is true:

1. They already belong to an organization
2. A live invitation exists for their **verified** email address
3. An organization's allowlist covers their address or domain
4. They hold a pending organization-creation grant

An account with none of those can read its own profile and little else; organization-scoped queries are refused. `user { me { hasOrganizations } }` is the cheapest way to check — see [Current User](/getting-started/current-user.md).

Note **verified** in point 2. An address must be verified before an invitation, allowlist entry, or domain match will apply to it.

## Where to go next

|                                                                   |                                                |
| ----------------------------------------------------------------- | ---------------------------------------------- |
| [Creating an Account](/account-management/creating-an-account.md) | Sign up and verify an account through the API  |
| [Enterprise SSO (SAML)](/account-management/enterprise-sso.md)    | Let your identity provider sign your people in |
| [SCIM Provisioning](/account-management/scim-provisioning.md)     | Provision users and teams automatically        |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.durohub.com/account-management/how-authentication-works.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.