> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemo-helix/v0.7.0/documentation/access-control/authentication/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemo-helix/_mcp/server.

# Authentication

NeMo Helix authenticates requests using **OpenID Connect (OIDC)**. You register an OAuth application in your identity provider, configure NeMo Helix with the issuer and client ID, and users sign in via the CLI, SDK, or browser. NeMo Helix validates the JWT on every request and extracts the user's identity for authorization.

For the quickstart (no IdP), see the [email-based shortcut](/documentation/access-control). For the authorization model, see [Authorization Concepts](/documentation/access-control/concepts).

## Connect Your Identity Provider

Start here — register an OAuth application in your IdP and configure NeMo Helix:

* [OIDC Setup](/documentation/access-control/authentication/oidc-setup) — Step-by-step: register an app, configure NeMo Helix, verify login.
* [Azure AD (Entra ID)](/documentation/access-control/authentication/providers/azure-ad-entra-id) — Azure-specific OIDC claim and configuration notes.
* [Generic OIDC Provider](/documentation/access-control/authentication/providers/generic-oidc) — Checklist for any OIDC-compliant IdP.
* IdP Integration References - provider manifests and runnable reference bundles under `contrib/auth/*`.

## Log In and Make API Calls

Once your IdP is connected, see [Using Authentication](/documentation/access-control/authentication/using-authentication) for the full walkthrough: device flow login, SDK and curl examples, token management, and config file reference.

| Method                    | Command / Action                                      | Best For                                                 |
| ------------------------- | ----------------------------------------------------- | -------------------------------------------------------- |
| **Device flow** (browser) | `nemo auth login`                                     | Interactive use — opens browser to sign in with your IdP |
| **Password grant**        | `nemo auth login --username <user> --password <pass>` | CI/CD pipelines — non-interactive                        |
| **Direct from IdP**       | Use your IdP's token endpoint or workload identity    | Custom integrations, service accounts                    |

The CLI stores the token and auto-refreshes it before expiry. The SDK reads the stored token from the CLI config automatically — after `nemo auth login`, `NeMoHelix()` works with no arguments.

## Discovery Endpoint

NeMo Helix exposes an unauthenticated endpoint that clients and the SDK use to discover OIDC settings:

```text
GET {BASE_URL}/apis/auth/discovery
```

Response:

```json
{
  "auth_enabled": true,
  "oidc": {
    "issuer": "https://login.microsoftonline.com/{tenant}/v2.0",
    "token_endpoint": "https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token",
    "device_authorization_endpoint": "https://login.microsoftonline.com/{tenant}/oauth2/v2.0/devicecode",
    "client_id": "...",
    "default_scopes": "platform:read platform:write openid profile email offline_access",
    "scope_prefix": "api://<client-id>/"
  }
}
```

The CLI and SDK call this endpoint automatically during `nemo auth login` or when initializing the client. `default_scopes` are the short scopes users see and pass to the CLI. When discovery includes `scope_prefix`, the CLI automatically expands NeMo Helix API scopes such as `platform:read` into the resource-qualified OAuth scope required by the configured IdP application.

## Related

* [Using Authentication](/documentation/access-control/authentication/using-authentication) — Log in, make API calls, and manage tokens.
* [Security Model](/documentation/access-control/security-model) — Trust boundaries and the principal model.

## Docs

- [OIDC Setup](https://docs.nvidia.com/nemo-helix/v0.7.0/documentation/access-control/authentication/oidc-setup.md): 
- [Using Authentication](https://docs.nvidia.com/nemo-helix/v0.7.0/documentation/access-control/authentication/using-authentication.md): Log in, call APIs, manage tokens, and create Scoped Access Keys.
- [Provider Guides](https://docs.nvidia.com/nemo-helix/v0.7.0/documentation/access-control/authentication/providers.md): 
- [Azure AD (Entra ID) Setup](https://docs.nvidia.com/nemo-helix/v0.7.0/documentation/access-control/authentication/providers/azure-ad-entra-id.md): 
- [Generic OIDC Provider](https://docs.nvidia.com/nemo-helix/v0.7.0/documentation/access-control/authentication/providers/generic-oidc.md):