> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thoras.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Default (htpasswd) dashboard auth

> Log into the Thoras dashboard with the generated username and password, or provide your own.

## Overview

`htpasswd` is the default authentication mode. On first install, the Thoras
config-controller generates a password and session cookie secret and stores them
in the `thoras-config-controller` Secret. The username is `thoras`. You can set
your own values, pin them for GitOps, or point the chart at a Secret you manage
yourself.

When you're ready to integrate with an identity provider, see the
[dashboard authentication overview](/guides/dashboard-auth) for OIDC options.

## Logging in

The default username is `thoras` (`thorasDashboard.auth.htpasswd.username`).
Fetch the generated password with:

```bash theme={null}
kubectl get secret thoras-config-controller -n thoras \
  -o jsonpath='{.data.dashboard-auth-password}' | base64 -d
```

<Note>
  The Secret appears once config-controller has finished its first reconcile,
  usually within a minute of install. Until then the dashboard pod reports
  `CreateContainerConfigError`. This clears on its own.
</Note>

## Setting the password explicitly

Set the values in `values.yaml` to pin them. The chart stores pinned values in
the `thoras-helm-values` Secret. That Secret is rendered without random
generation or Helm `lookup`, so it is safe for GitOps tools such as Argo CD and
Flux.

```yaml theme={null}
thorasDashboard:
  auth:
    htpasswd:
      username: thoras
      password: <your-password>
      cookieSecret: <16, 24, or 32 byte secret> # e.g. openssl rand -base64 32
```

## Using an existing Secret

Point the dashboard at a Secret you manage yourself, for example one provisioned
by Sealed Secrets, External Secrets, or SOPS.

```yaml theme={null}
thorasDashboard:
  auth:
    htpasswd:
      existingSecret:
        secretName: my-dashboard-auth
        passwordKey: dashboard-auth-password
        cookieSecretKey: dashboard-auth-cookie-secret
```

`existingSecret` takes precedence over `password` and `cookieSecret`.

## Rotating credentials

The generated credentials are not intended to be rotated in place. If you need
control over rotation, take ownership of the values by pinning them in
`values.yaml` or by pointing the chart at an `existingSecret` you manage. The
config-controller watches both and restarts the dashboard automatically when the
value changes, so there is no manual `kubectl rollout restart` step:

* **Pinned in values:** change the value in `values.yaml` and `helm upgrade`.
* **Existing Secret:** update your Secret. The change is picked up within about
  a minute.

Rotating the cookie secret logs out every active dashboard session.

## Switching to OIDC

To hand authentication off to your identity provider, see the
[dashboard authentication overview](/guides/dashboard-auth) and pick the guide
for your IdP.