Skip to main content

​
Overview

Nebuly uses two distinct authentication mechanisms depending on the type of access. End-user authentication is handled through your enterprise identity provider (Google, Microsoft, Okta) or built-in basic authentication. Users log into the Nebuly UI via SSO or basic authentication. Ingestion authentication uses API keys. Any service sending data (interactions, traces) to Nebuly must include a project API key in every request:
API keys are scoped to a project and can be created under Settings → Project → API keys. Once users can sign in, you control what they can see and do through roles and project access. See Permissions and user management for roles, inviting members, and assigning project access.

​
Default admin user on first startup

On first startup, you should create an initial admin user through the Helm values under auth.
Use a strong password that follows your organization’s security standards (minimum length, mixed character types, and no reused credentials). The initial admin user is intended for bootstrap access: use it to create additional users and assign roles (see Permissions and user management), then disable it if your security policy requires removing the default admin account after setup.

​
Configuring SSO for self-hosted deployments

SSO is configured at the infrastructure level via the Nebuly Terraform module. Pass your identity provider credentials as a module input and Terraform will automatically inject them into the generated Helm values. Supported providers: google, microsoft, okta.
After terraform apply, re-run terraform output helm_values to pick up the updated values before upgrading the Helm chart. Terraform module references: AWS · Azure · GCP
If you do not use SSO, you can add members manually from the invite flow in Settings → Members. See Adding members manually.

​
Configuring SSO for Nebuly Cloud (SaaS)

Nebuly Cloud supports Single Sign-On (SSO) through Google, Microsoft Entra ID, and Okta.
SSO setup for Nebuly Cloud currently requires configuration by the Nebuly team. A dedicated authentication environment must be provisioned before SSO can be enabled.

​
Setup process

  1. Request SSO enablement Contact the Nebuly team to enable SSO for your organization. During setup, Nebuly creates a dedicated authentication environment (or configures your custom domain, if applicable) and provides the redirect URI required by your Identity Provider.
  2. Configure your Identity Provider Using the redirect URI provided by Nebuly, create an OAuth/OpenID Connect application in your Identity Provider (Google, Microsoft Entra ID, or Okta). This generates a Client ID and Client Secret.
  3. Share your credentials Send the generated Client ID and Client Secret to the Nebuly team.
  4. Complete the setup Nebuly configures your authentication environment using the provided credentials. Once complete, users can sign in using your organization’s Identity Provider.