Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.igrisecurity.com/llms.txt

Use this file to discover all available pages before exploring further.

​
Authentication

Igris supports two authentication methods depending on the context.

​
Session Cookies (Dashboard)

When you log in through the dashboard, Better Auth sets an igris.session_token cookie. This cookie is automatically sent with all dashboard requests. For API calls from a browser context, include credentials: 
fetch("https://your-igris.fly.dev/api/v1/policies", {
  credentials: "include" // sends session cookie
});
Or pass the cookie explicitly: 
curl https://your-igris.fly.dev/api/v1/policies \
  -H "Cookie: igris.session_token=eyJhbGciOi..."

​
API Keys (Programmatic Access)

For MCP proxy connections and CI/CD integrations, use API keys.

​
Creating an API Key

  1. Go to Settings → API Keys in the dashboard
  2. Click Create Key
  3. Give it a label (e.g., “Proxy - Production”, “CI Pipeline”)
  4. Copy the key — it’s only shown once
API keys follow the format ig_ followed by a random string: 
ig_k1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6

​
Using an API Key

Pass the key in the Authorization header: 
curl https://your-igris.fly.dev/api/v1/policies \
  -H "Authorization: Bearer ig_k1a2b3c4d5e6f7..."

​
Key Scoping

API keys inherit the permissions of the user who created them and are scoped to their active organization. A key created by an admin has admin-level access to that organization’s resources.

​
Revoking Keys

Revoke a key in Settings → API Keys by clicking Revoke. Revoked keys immediately stop working — any proxy connections using that key will receive 401 Unauthorized.

​
Organization Context

All API requests are scoped to an organization. The organization is determined by:
  1. Session cookies — the user’s active organization in their session
  2. API keys — the organization the key was created in

​
Error Responses

StatusMeaning
401 UnauthorizedMissing, invalid, or revoked credentials
403 ForbiddenValid credentials but insufficient role permissions
403 Plan RequiredFeature requires a higher plan tier
{
  "error": "Unauthorized",
  "message": "Invalid or expired API key"
}

​
RBAC Roles

Permissions are enforced based on the user’s role in the organization:
RoleGovernanceBillingMembers
OwnerFullFullFull
AdminFullViewManage
DeveloperOwn servers——
CISOViewView—
AuditorRead-only——