Skip to content


Single Sign-On (SSO) for the OpenFaaS CLI and dashboard is a feature of Identity and Access Management (IAM) for OpenFaaS.

Any OpenID Connect (OIDC) compatible identity provider can be configured and registered with OpenFaaS to provide authentication.

Create an OIDC App for OpenFaaS

OpenFaaS IAM has been tested with Auth0, Google, Okta, Keycloak and Azure Active Directory but any other provider that supports OIDC should work.

To configure your identity provider:

  1. Create a new client (application) for OpenFaaS.
  2. Enable the required authentication flows.

    Enable at least one authentication flow for the OpenFaaS CLI and if deployed, the OpenFaaS dashboard.

    Authentication flows supported by the OpenFaaS CLI:

    • Authorization Code flow with Proof Key of Code Exchange (PKCE) - (recommended)
    • Implicit flow
    • Client Credentials flow

    Authentication flows supported by the OpenFaaS dashboard:

    • Authorization Code Flow
    • Authorization Code Flow with Proof Key of Code Exchange (PKCE)

    For the CLI we recommend the Authorization Code flow with PKCE. One of the other flows can be used if your provider does not support PKCE.

  3. Configure allowed callback URLs.

    The dashboard uses the callback path: /auth/callback. If you are deploying the dashboard allow callbacks on your dashboards public URL, e.g.

    For the CLI the default callback URL is,

  4. Register your provider with OpenFaaS

    Trusted identity providers need to be registered by creating a JwtIssuer object in the OpenFaaS namespace.

    Example JwtIssuer object:

    kind: JwtIssuer
      namespace: openfaas
      tokenExpiry: 12h

    The iss field needs to be set to the url of your provider, eg. for google or for Auth0.

    The aud field needs to contain a set of accepted audiences. The set is used to validate the audience field in an OIDC access token and verify OpenFaaS is the intended audience. The audience is usually the gateway’s public URL although for some providers it can also be the client id.

    The tokenExpiry field can be used to set the expiry time of the OpenFaaS access token.

For more details on how to configure Single Sign-On for OpenFaaS, follow one of our guides or see the documentation for your provider:

  • Keycloak - Configure Keycloak for OpenFaaS IAM.
  • Google - Configure Google for OpenFaaS IAM.
  • Okta - Configure Okta for OpenFaaS IAM.

Some providers may need an additional patch or configuration. Feel free to reach out to us.