> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://docs.prividium.com/api/mcp` to find what you need. > > **Have feedback?** Use `submit_feedback` on the same MCP server. Authentication controls how users and administrators log in to Prividium™ and access the permissioned network. Prividium™ supports two authentication methods: * **Okta (OIDC)** for enterprise single sign-on * **Crypto-native Sign-in With Ethereum (SIWE)** for wallet-based access You can enable either method or both at the same time. *** ### 1. Configure Okta Authentication Use Okta if your organization manages users through an identity provider. #### Step 1: Create an application in Okta 1. Sign in to your Okta Admin Console. 2. Go to **Applications → Create App Integration**. 3. Choose **OIDC – OpenID Connect** and **Single-Page Application (SPA)**. 4. Set the following: * **Sign-in redirect URI** → `http://localhost:3001/callback` (or your production URL) * **Sign-out redirect URI** → `http://localhost:3001` * **Allowed grant types** → Authorization Code 5. After creation, note: * **Client ID** * **Okta domain** (for example, `https://yourokta.okta.com`) #### Step 2: Update your environment variables Edit your `.env` file or Docker Compose configuration for the **User Dashboard**: ```bash VITE_OKTA_ISSUER=https://yourokta.okta.com/oauth2/default VITE_OKTA_CLIENT_ID= VITE_OKTA_REDIRECT_URI=http://localhost:3001/callback VITE_AUTH_METHODS=oidc ``` Restart the **User Dashboard** container to apply changes. #### Step 3: Test the login 1. Open `http://localhost:3001`. 2. Click **Sign in with Okta**. 3. Complete the Okta login flow. After login, the user token is validated by the **Permissions API**, which determines the user's roles and access rights. #### OIDC only Set `AUTH_METHODS=oidc` on the **Permissions API** and `VITE_AUTH_METHODS=oidc` on the **User Dashboard**. The API then refuses wallet login for users, tenants and services. Users can still link wallets, so the `SIWE_*` variables stay required. To keep wallet login for automation, list its wallets in `CRYPTO_NATIVE_LOGIN_ALLOWLIST`; each must already belong to a non-admin user. Such a login gets a 20-minute session that works on RPC only. Before switching, make sure an OIDC user holds the admin role, for example through `OIDC_ADMIN_SUBS`. Wallet-only accounts keep their open sessions until they expire and their personal RPC tokens until revoked, so delete the accounts you want to cut off. #### Watchdog `WATCHDOG_WALLETS` lists the wallets of the Matter Labs watchdog, which monitors the chain. At startup the API gives a `Watchdog` user exactly these wallets, creating it the first time; a listed wallet that already belongs to another user stops the API from starting. It logs in by wallet whatever `AUTH_METHODS` allows and gets a 20-minute session that works on RPC only. What it may do is a fixed list, shown on its user page: roles, permission rules and policy don't apply to it, and it withdraws and sends value only to its own addresses. Admins cannot rename it, change its wallets or roles, move it into an organization or delete it; suspending it stops monitoring until it is resumed. *** ### 2. Configure Crypto-Native (SIWE) Authentication SIWE allows users to authenticate using their Ethereum wallet without a third-party identity provider. #### Step 1: Enable SIWE in configuration In your `.env` file for the **User Dashboard**, set: ```bash VITE_AUTH_METHODS=crypto_native ``` To enable both Okta and SIWE together, use: ```bash VITE_AUTH_METHODS=okta,crypto_native ``` In your **Permissions API** environment, set these additional variables: ```bash SIWE_CHAIN_ID=324 # Chain ID for your network SIWE_VALID_DOMAINS=user-panel.your-domain.com SIWE_HMAC_SECRET=<64-char hex string> # Generate with: openssl rand -hex 32 ``` `SIWE_HMAC_SECRET` signs the nonce tokens issued during the SIWE challenge flow. The Permissions API refuses to start if this value is absent, or if `NODE_ENV=production` and it uses the `.env.example` placeholder. #### Step 2: Test wallet login 1. Open `http://localhost:3001`. 2. Select **Sign in with Ethereum**. 3. Approve the signature request in your wallet. The dashboard issues an access token that grants access through the **Prividium API**. The wallet address is recorded and can later be linked to specific roles in the **Admin Dashboard**. #### Per-organization SIWE settings Each organization can independently enable or disable wallet login and configure extra allowed domains through the Admin Panel. This controls whether the wallet login button appears for users in that organization. See [Manage Organizations](/configuring/chain/organizations#8-configure-wallet-login-siwe). *** ### 3. Mixed Mode (Okta and SIWE) You can enable both Okta and wallet login on the same **User Dashboard**. Each user can have: * An **Okta identity**, used for organizational authentication * One or more **wallet addresses**, used for on-chain interactions Admins can manage both under **Users → Edit → Roles** in the **Admin Dashboard**. ### 4. Initial admin user The first admin is created during setup through environment variables or the `admin-create` script. After you sign in as the initial admin, you can: * Add more admin users * Assign the **Admin** role to existing users * Limit sensitive actions to administrators only *** ### 5. Common Issues | Symptom | Likely Cause | Resolution | | ------------------------------------------- | ----------------------------------------------- | ---------------------------------------------- | | **401 Unauthorized** after login | Missing or incorrect Okta or SIWE configuration | Verify environment variables and redirect URIs | | User can log in but cannot access contracts | The user has no assigned role | Add a role under **Users → Edit → Roles** | | Wallet signature rejected | Expired SIWE nonce or clock drift | Refresh the page and retry signing | ***