Authentication Overview

📋 Planned

Documentation Under Construction

This page will explain Vanna's authentication model: you bring your own auth, and Vanna enforces permissions based on the user context you provide.

Planned Content

  • ✓ Key concept: Vanna doesn't do authentication, you do
  • ✓ How UserResolver pattern works
  • ✓ User model: id, username, email, group_memberships, metadata
  • ✓ RequestContext: cookies, headers, remote_addr
  • ✓ Group-based access control overview
  • ✓ When to implement authentication (production deployments)
  • ✓ Links to concrete auth pattern examples

Want to contribute or suggest improvements? Open an issue on GitHub

Core Principle

Vanna doesn’t replace your authentication system—it integrates with it.

You implement a UserResolver that:

  1. Extracts user identity from requests (cookies, JWTs, session tokens)
  2. Returns a User object with id, groups, and metadata
  3. Vanna uses this to enforce tool permissions and row-level security

Coming Soon

This page will show:

  • The UserResolver interface
  • A minimal example
  • Links to 4 concrete patterns: Cookie-based, JWT, NextAuth.js, OAuth/SSO