Nokku authenticates users before it evaluates workspace access. Authentication and authorization are separate: signing in does not grant access to a target until the identity is assigned to a principal.
Human users
The core implements password login, OAuth/OIDC flows, SAML flows, passkeys, email verification, password recovery, and backup codes. The methods available to a user depend on the core and workspace configuration.
The nk login command uses a browser-based login flow. It waits for the browser authentication to complete and then registers the machine’s signing identity with the core. CLI requests are authenticated with signed challenges from that device-bound key; no token or password is stored on the machine.
The signing identity is TPM-backed on Linux and Windows machines with a TPM, with a software fallback key otherwise. See Install & Login for enabling TPM access on Linux.
OIDC and SAML
Workspace administrators can configure an OIDC provider or a SAML provider for a workspace. Verify the workspace domain and configure the provider’s redirect, claims, and signing settings according to the provider’s requirements.
Do not describe a provider as active until a complete login has been tested with a non-administrator account.
Passkeys and backup codes
Users can register passkeys and generate backup codes from their account settings. Treat backup codes as recovery credentials and store them separately from the primary login device.
Service accounts
Service accounts are non-human workspace identities. They authenticate with a token and are assigned to principals just like users and teams. Use Service Accounts for CI and automation.
Authentication failures
Start by confirming the core is reachable:
nk status
nk doctorIf the core cannot be reached, verify its /healthz endpoint and the configured NK_API_URL before investigating identity-provider configuration.