--- title: "Authentication in Unqork" slug: "authentication-in-unqork" updated: 2026-09-18T14:38:17Z published: 2026-09-18T14:38:17Z canonical: "docs.unqork.io/authentication-in-unqork" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.unqork.io/llms.txt > Use this file to discover all available pages before exploring further. # Authentication in Unqork Unqork supports authentication in three distinct contexts. Each context has a different direction and a different set of tools. Understanding which context applies makes it easier to find the right configuration in the platform. ## Authentication Contexts Authentication in Unqork flows in one of three directions: outbound to an external system, inbound from an external system, or from an end-user. Each direction has its own administration area and its own supported methods. Choosing the wrong context is the most common source of confusion when setting up authentication for the first time. Learn more about the three authentication contexts below: ### Context 1: Unqork Calling External Systems When a module calls an external API or service, Unqork authenticates through a service configured in **Services Administration**, found under ![icon](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20260918_143131_d0c28db534304181b38e7611218d4896.svg?sv=2026-02-06&spr=https&st=2026-11-08T10%3A18%3A14Z&se=2026-11-08T11%3A18%3A14Z&sr=c&sp=r&sig=eo5gIxSR31XEcO%2Fg1bZB8SzjFJympaOWKPJJTgmYMfo%3D) **Administration** > ![icon](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20260918_143131_2307862fbe7749c19f388b88e4861dff.svg?sv=2026-02-06&spr=https&st=2026-11-08T10%3A18%3A14Z&se=2026-11-08T11%3A18%3A14Z&sr=c&sp=r&sig=eo5gIxSR31XEcO%2Fg1bZB8SzjFJympaOWKPJJTgmYMfo%3D) **Integration** > **Services Administration**. ![Diagram](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20260918_143131_110a34256bdd4215bbdb19e295f04538.svg?sv=2026-02-06&spr=https&st=2026-11-08T10%3A18%3A14Z&se=2026-11-08T11%3A18%3A14Z&sr=c&sp=r&sig=eo5gIxSR31XEcO%2Fg1bZB8SzjFJympaOWKPJJTgmYMfo%3D) Each service has an authentication method. Creators choose between the following: - **Standard** authentication uses one of Unqork's built-in protocols, like Basic Authentication, Bearer Token, or OAuth 2.0. The full list of supported types and their configuration fields is in [Service Types](/unqorkai/docs/service-types). For more information, see [Services Administration](/unqorkai/docs/services-administration). ### Context 2: External Systems Calling Unqork When an external system calls the Unqork API, it authenticates through credentials configured in **API Access Management**, found under ![icon](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20260918_143131_d0c28db534304181b38e7611218d4896.svg?sv=2026-02-06&spr=https&st=2026-11-08T10%3A18%3A14Z&se=2026-11-08T11%3A18%3A14Z&sr=c&sp=r&sig=eo5gIxSR31XEcO%2Fg1bZB8SzjFJympaOWKPJJTgmYMfo%3D) **Administration** > ![icon](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20260918_143131_2307862fbe7749c19f388b88e4861dff.svg?sv=2026-02-06&spr=https&st=2026-11-08T10%3A18%3A14Z&se=2026-11-08T11%3A18%3A14Z&sr=c&sp=r&sig=eo5gIxSR31XEcO%2Fg1bZB8SzjFJympaOWKPJJTgmYMfo%3D) **Integration** > **API Access Management**. ![Diagram](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20260918_143131_43ea01d3c0864a3e8de87811a37a393a.svg?sv=2026-02-06&spr=https&st=2026-11-08T10%3A18%3A14Z&se=2026-11-08T11%3A18%3A14Z&sr=c&sp=r&sig=eo5gIxSR31XEcO%2Fg1bZB8SzjFJympaOWKPJJTgmYMfo%3D) API Access Management uses the OAuth 2.0 client credentials flow. An administrator creates a credential that contains a client ID and a client . The external system uses these values to request an access token before making API calls. Unqork supports the following credential types: - Express **credentials**: Grant access as an Express user, with one or more Express roles assigned. - Creator **credentials**: Grant access as a Creator, with a single Creator role assigned. **When to use Express vs. Creator credentials**: Use Express credentials when the integration acts as an end-user, accessing application data or triggering workflows governed by Express roles. Use Creator credentials when the integration requires platform-level access, like managing modules or querying the environment through Creator APIs. For more information, see [API Access Management](/unqorkai/docs/api-access-management). ### Context 3: End-Users Accessing an Application When end-users log in to a Unqork application, several authentication options are available. The right choice depends on whether the environment uses an external identity provider and whether end-users need persistent accounts. ![Diagram](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20260918_143131_5d91b4b29fbe4a6886d1d6fa713a6134.svg?sv=2026-02-06&spr=https&st=2026-11-08T10%3A18%3A14Z&se=2026-11-08T11%3A18%3A14Z&sr=c&sp=r&sig=eo5gIxSR31XEcO%2Fg1bZB8SzjFJympaOWKPJJTgmYMfo%3D) ### Single Sign-On SSO (Single Sign-On) lets end-users authenticate through an external identity provider (IdP) like Okta or Microsoft Entra ID. Unqork supports SAML 2.0 and OIDC (OpenID Connect). Unqork has the following SSO domains: - **Designer SSO** controls how Creators log in to the platform. - **Express SSO** controls how end-users log in to applications. The two domains are configured independently and can use different identity providers. **When to use SSO**: Use SSO when end-users already have accounts in an organizational identity provider. SSO is the right choice for enterprise or internal deployments where the organization controls the IdP. It avoids creating and managing separate Unqork accounts for each end-user. For more information, see [Setting Up Single Sign-On (SSO) in Unqork](/unqorkai/docs/sso-setup-overview) and [SSO Concepts](/unqorkai/docs/single-sign-on-sso-concepts). ### Express Users Express Users are end-user accounts created and managed directly in Unqork, without an external identity provider. Each account is assigned one or more Express roles that control what end-users can access. Manage Express User accounts in ![icon](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20260918_143131_d0c28db534304181b38e7611218d4896.svg?sv=2026-02-06&spr=https&st=2026-11-08T10%3A18%3A14Z&se=2026-11-08T11%3A18%3A14Z&sr=c&sp=r&sig=eo5gIxSR31XEcO%2Fg1bZB8SzjFJympaOWKPJJTgmYMfo%3D) **Administration** > ![icon](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/api_upload_20260918_143132_ec9905e1bbc14a5c954c171dff582ccc.svg?sv=2026-02-06&spr=https&st=2026-11-08T10%3A18%3A14Z&se=2026-11-08T11%3A18%3A14Z&sr=c&sp=r&sig=eo5gIxSR31XEcO%2Fg1bZB8SzjFJympaOWKPJJTgmYMfo%3D) **Express Permissions** > **Express User Administration**. **When to use Express Users**: Express Users work well for external-facing applications, customer portals, or deployments where the organization does not have an IdP or does not want to integrate one. For more information, see [Express User Administration](/unqorkai/docs/express-user-administration). ### Refer Strings A refer string is a URL-based authentication method for temporary access. An encrypted token is appended to a URL, which grants access to a specific application or module without requiring an end-user account. Refer strings are commonly used for registration links or one-time access flows. **When to use Refer Strings**: Use Refer Strings for one-time or temporary access scenarios: registration flows, external invite links, or approval requests sent by email. Refer strings are not a substitute for persistent end-user accounts. Sessions expire and cannot be individually revoked after they are issued. For more information, see [Understanding and Configuring Refer Strings](/unqorkai/docs/auth-refer-strings). ## Which Context Applies? Use the following table to identify the right context for a given situation. | Situation | Auth Direction | Where to Configure | | --- | --- | --- | | A module calls an external API or service | Unqork to external system | [Services Administration](/unqorkai/docs/services-administration) | | An external system calls the Unqork API | External system to Unqork | [API Access Management](/unqorkai/docs/api-access-management) | | End-users log in to an application | User to application | [Single Sign-On](/unqorkai/docs/sso-setup-overview), [Express Users](/unqorkai/docs/express-user-administration), or [Refer Strings](/unqorkai/docs/auth-refer-strings) | For end-users accessing an application, use the table below to choose the right method. | Situation | Recommended method | | --- | --- | | End-users already have accounts in an org identity provider (For example, Okta, Entra ID, Google Workspace) | Single Sign-On | | End-user accounts are managed directly in Unqork | Express Users | | Temporary access links are needed (for example, registration, approval, or invites) | Refer Strings | --- **Changelog** | Date | Change | | --- | --- | | 2026-09-18 | Removed Custom Authentication references — removed Custom bullet and Standard vs. Custom guidance (EN-8131). | | 2026-09-04 | Added when-to-use guidance for Standard vs. Custom auth, Express vs. Creator credentials, SSO vs. Express Users vs. Refer Strings, and a Context 3 sub-decision table. Fixed Express Users heading level. | | 2026-09-04 | Initial publication. | End-users, also known as Express Users, are the individuals accessing an application through Express View. In most cases, end-users are the customers using the product. A definition APIs (application programming interfaces) are a set of protocols and definitions developers use to build and integrate application software. APIs act as the connective tissue between products and services. Also known as Unqork Users, or Designer Users; is anyone who is inside the Unqork platform. A bearer token is an HTTP authentication scheme that allows clients to generate a cryptic string used to authorize access to server resources. OAuth, or Open Authorization, is an authorization protocol that lets users grant third-party access to their information without sharing their passwords. OAuth is an industry standard that's used by many companies, including Google, Amazon, and Microsoft. The Unqork front-end application framework that delivers Creator-built applications to end-users. Express is the layer end-users interact with—the published forms, screens, and navigation built in the Module Builder. Express is distinct from Express View, which is a Creator-facing preview tool in the IDE. Also known as Unqork Users, or Designer Users; is anyone who is inside the Unqork platform. APIs (application programming interfaces) are a set of protocols and definitions developers use to build and integrate application software. APIs act as the connective tissue between products and services. End-users, also known as Express Users, are the individuals accessing an application through Express View. In most cases, end-users are the customers using the product. Identity provider (IdP) provide a service that creates, manages, and verifies users' digital identities, allowing them to securely authenticate and access different applications or services. Single Sign-On is an authentication scheme that enables users to use one set of login credentials across multiple services. Identity provider (IdP) provide a service that creates, manages, and verifies users' digital identities, allowing them to securely authenticate and access different applications or services. Okta is a cloud-based identity and access management (IAM) platform that helps organizations manage user identities, access rights, and credentials across multiple applications, websites, and databases. Security Assertion Markup Language (SAML) is a protocol that allows an identity provider (IdP) to send a user's credentials to a service provider (SP) to verify their identity and grant them access to a service. OIDC (OpenID Connect) is an identity authentication protocol that lets two applications share user information without exposing user credentials. A string is an object that represents a sequence of characters. Strings typically hold data represented in text form. A URL (uniform resource locator) is a unique identifier used to locate a resource on the internet. Also known as a web address. A string is an object that represents a sequence of characters. Strings typically hold data represented in text form.