Cloud Auth and Access

ByteOr Cloud uses distinct credentials for different actors. Enrollment tokens, agent runtime keys, user access, and approval credentials should not be treated as interchangeable.

Central editorial page

This page is a public summary of the Cloud auth model. Exact credential handling should defer to the synced Cloud docs and Enterprise approval contracts.

Actor Classes

Cloud uses separate credential families because the actors are different.

Actor	Credential	Scope	Notes
Human operator	Browser session or API bearer token	Organization and project membership	Backed by the configured login flow and normal RBAC checks
Automation at the control-plane edge	Organization API key	Organization	Used for automation that should not impersonate an enrolled agent
Agent bootstrap	Enrollment token	Environment	Single-purpose credential used to register one agent into one environment
Enrolled agent	Runtime API key	Agent	Used for heartbeats, deployment fetch, artifact upload, and signing-key refresh
Governed action	Approval credential	Environment + spec hash + capability scope	Required when deployment or replay posture demands explicit approval

The important rule is separation, not convenience. Enrollment tokens are not long-lived agent secrets. Organization API keys are not substitutes for human RBAC. Approval credentials are not general API credentials.

Enrollment And Runtime Split

Agent enrollment is intentionally two-step:

An environment enrollment token authorizes a one-time registration.
The control plane returns a per-agent runtime API key.
The agent uses that runtime key for steady-state operations.

That split lets operators revoke bootstrap access without rotating every long-lived agent secret and keeps artifact upload authorization bound to an actual enrolled node.

Approval-Aware Access

Approval-sensitive operations add another layer on top of normal RBAC. A user may be allowed to request a deployment or replay and still be blocked until the request carries a credential that matches the target environment, the relevant spec hash, and the required capability scope.