Access control and tokens

Authentication

Method	Notes
Email and password	Hashed with argon2id
MFA	TOTP and WebAuthn (security keys, passkeys). Enforceable per org
OIDC single sign-on	Google, GitHub, Microsoft, Okta and any generic OIDC provider. On every plan
SAML 2.0	Business and above
SCIM 2.0 provisioning	Business and above

Org settings let you enforce SSO, restrict sign-up to allowed email domains and set an IP allowlist.

RBAC

Permissions are strings such as pipelines.read, runs.trigger, deployments.approve and environments.deploy:<env>. Roles are sets of permissions; a role binding grants a role to a subject at a scope.


Subjects	user, team, service account
Scopes	org, project, environment
Built-in roles	`owner`, `admin`, `developer`, `deployer`, `viewer`, `billing`
Custom roles	Team and above

Examples:

Give team payments-devs the developer role on project payments.
Give team sre the deployer role on environment production of project payments, so they can deploy there and nowhere else.
Give service account ci-promoter a custom role with only the permissions it needs to create deployments and promote releases.

Policies are evaluated by a CEL engine. A denied call returns permission_denied naming the missing permission. Check what you have with slipway whoami -v.

API tokens

Type	Use
Personal access token	Acts as you, with the permissions you choose to delegate, for scripts and the CLI
Service-account token	Acts as a non-human principal owned by the org, for automation
Job token	Short-lived OIDC JWT issued to a running job. See OIDC

Tokens look like sk_live_..., are shown once, are hashed at rest and are compared in constant time. They carry scoped permissions and an expiry; org token policies can cap lifetime. Create and revoke them under Profile, Tokens or with IdentityService.CreateApiToken and RevokeApiToken.

echo "$SLIPWAY_TOKEN" | slipway login --server https://slipway.example.com --with-token

Sessions

Browser sessions are server-side (cookie slipway_session, stored in Valkey) with CSRF protection on mutating calls. Users can sign out everywhere from their profile.

Audit

Every mutating action and every deployment decision is recorded in an append-only audit log with actor, action, target, metadata, IP and time. See Security and compliance.