Auth and access control
This section shows DevOps and platform engineers how to authenticate callers and control what they can reach in DIAL. It assumes you operate a running DIAL Core instance and can edit its configuration files. For the conceptual model behind these tasks, see Access Control in DIAL.
Two questions DIAL answers on every request
- Authentication — who is calling? DIAL Core accepts two credential types: API keys for server-to-server calls, and JWT access tokens for end users who log in through an identity provider (IdP).
- Authorization — what may they reach? Both credential types resolve to one or more roles. Roles grant access to deployments (models, applications, toolsets, routes) and carry usage limits.
Where the configuration lives
Most of this configuration sits in two DIAL Core files:
settings.json— static settings, loaded once at startup. The path is named by theAIDIAL_SETTINGSenvironment variable; the Docker Compose setups mount it at/opt/settings/settings.json. See settings.json — File location.config.json— dynamic settings, reloaded roughly every 60 seconds. The path comes from theconfig.filesstatic setting; the Docker Compose setups mount it at/opt/config/config.json. See config.json — File location.
DIAL Chat reads its login-provider settings from environment variables. The table below maps each concern to its file and the reference page that documents every option.
| Concern | File | Reload | Reference |
|---|---|---|---|
| API keys | config.json (keys section) | Dynamic, ~60 s | Keys reference |
| Roles, limits, sharing | config.json (roles section) | Dynamic, ~60 s | Roles reference |
Resource access (userRoles) | config.json (models, applications, etc.) | Dynamic, ~60 s | config.json overview |
| IdP / JWT validation | settings.json (identityProviders section) | At startup | Identity providers reference |
| Admin privileges | settings.json (access.admin.rules) | At startup | Access control reference |
| DIAL Chat login providers | environment variables | At startup | DIAL Chat configuration |
How-to guides
- Configure API key authentication — issue and scope keys for external applications.
- Configure end-user authentication with JWT — grant logged-in users access to resources through JWT claims.
- Configure roles and rate limits — set request, token, cost, and sharing limits per role.
- SSO / IdP setup — connect DIAL to AWS Cognito, Auth0, Google Identity, Microsoft Entra ID, Okta, Keycloak, or Azure AD B2C.