Configure Auth

Authentication controls how users and administrators log in to Prividium™ and access the permissioned network. Prividium™ supports two authentication methods:

• Okta (OIDC) for enterprise single sign-on
• Crypto-native Sign-in With Ethereum (SIWE) for wallet-based access

You can enable either method or both at the same time.

1. Configure Okta Authentication

Use Okta if your organization manages users through an identity provider.

Step 1: Create an application in Okta

1. Sign in to your Okta Admin Console.
2. Go to Applications → Create App Integration.
3. Choose OIDC – OpenID Connect and Single-Page Application (SPA).
4. Set the following:
   • Sign-in redirect URI → http://localhost:3001/callback (or your production URL)
   • Sign-out redirect URI → http://localhost:3001
   • Allowed grant types → Authorization Code
5. After creation, note:
   • Client ID
   • Okta domain (for example, https://yourokta.okta.com)

Step 2: Update your environment variables

Edit your .env file or Docker Compose configuration for the User Dashboard:

VITE_OKTA_ISSUER=https://yourokta.okta.com/oauth2/default
VITE_OKTA_CLIENT_ID=<your_client_id>
VITE_OKTA_REDIRECT_URI=http://localhost:3001/callback
VITE_AUTH_METHODS=oidc

Restart the User Dashboard container to apply changes.

Step 3: Test the login

1. Open http://localhost:3001.
2. Click Sign in with Okta.
3. Complete the Okta login flow.

After login, the user token is validated by the Permissions API, which determines the user's roles and access rights.

2. Configure Crypto-Native (SIWE) Authentication

SIWE allows users to authenticate using their Ethereum wallet without a third-party identity provider.

Step 1: Enable SIWE in configuration

In your .env file for the User Dashboard, set:

VITE_AUTH_METHODS=crypto_native

To enable both Okta and SIWE together, use:

VITE_AUTH_METHODS=okta,crypto_native

In your Permissions API environment, set these additional variables:

SIWE_CHAIN_ID=324                        # Chain ID for your network
SIWE_VALID_DOMAINS=user-panel.your-domain.com
SIWE_HMAC_SECRET=<64-char hex string>    # Generate with: openssl rand -hex 32

SIWE_HMAC_SECRET signs the nonce tokens issued during the SIWE challenge flow. The Permissions API refuses to start in production if this value is absent or uses a known development default.

Step 2: Test wallet login

1. Open http://localhost:3001.
2. Select Sign in with Ethereum.
3. Approve the signature request in your wallet.

The dashboard issues an access token that grants access through the Prividium API. The wallet address is recorded and can later be linked to specific roles in the Admin Dashboard.

Per-organization SIWE settings

Each organization can independently enable or disable wallet login and configure extra allowed domains through the Admin Panel. This controls whether the wallet login button appears for users in that organization. See Manage Organizations.

3. Mixed Mode (Okta and SIWE)

You can enable both Okta and wallet login on the same User Dashboard. Each user can have:

• An Okta identity, used for organizational authentication
• One or more wallet addresses, used for on-chain interactions

Admins can manage both under Users → Edit → Roles in the Admin Dashboard.

4. Initial admin user

The first admin is created during setup through environment variables or the admin-create script. After you sign in as the initial admin, you can:

• Add more admin users
• Assign the Admin role to existing users
• Limit sensitive actions to administrators only

5. Common Issues