v0.14.6

dash now accepts API tokens (#36): personal access tokens for scripts, agents and apps, static tokens for GitOps installs, and Settings → Tokens to manage them. It is a patch. Nothing changes for browsers, and tokens stay off until dash has a writable data dir.

New

• Personal access tokens. Create one in Settings → Tokens. You choose:

  • an audience: the API, or MCP for agents once the MCP server arrives;
  • scopes: read and logs, and for admins actions:<plugin>, optionally limited to namespaces;
  • an expiry from 1 to 365 days (default 30).

  The token is shown once, and dash stores only its hash. A revocation takes effect on the next request and ends open streams within one heartbeat. Each user can hold at most 50 tokens.

• Bearer requests. Authorization: Bearer <token> works on /api/v1.

  • A token can do what its owner's role allows, narrowed by its scopes. That is worked out again on every request, so a group change at your identity provider reaches the user's tokens at their next sign-in, or at their next request behind a proxy.
  • Bearer requests skip the CSRF check. A request that carries both a token and a dash session cookie is refused.

• Static tokens for GitOps installs. dash token generate prints a dash_st_ token and its hash, and the hash goes in auth.tokens. Edits to the config file apply without a restart.

• CORS for browser-based clients: list their origins in server.corsOrigins. Nothing is sent by default, and Allow-Credentials never is.

• Limits: 300 requests a minute per API token (bursts up to 300), and 10 token creations a minute per user.

• Audit: every token request's audit record names the token.

• Docs: docs/auth.md documents tokens, scopes, audiences and limits.

Behind an identity proxy

oauth2-proxy and similar proxies redirect requests that lack their own session, so bearer clients need a route that skips the proxy. The chart's routes.direct for this comes with the OAuth release. docs/auth.md lists what a route you set up yourself needs.

Upgrade notes

• No change is needed. Tokens need a writable data dir in local, oidc and proxy mode. Without one, Settings → Tokens says they are unavailable.

• Every 401 now carries a WWW-Authenticate: Bearer challenge.

• Rolling back to v0.14.5 after creating tokens:

  • with dash stopped, remove credentials.yaml, which ends every session and revokes every token;
  • remove auth.tokens and server.corsOrigins from the config.

  See docs/upgrading.md.