Security
Security covers how Zilla Console itself authenticates the people and services that connect to it, separate from the auth a deployed API Product enforces on its own consumers.
Authentication and SSO
Zilla Console can authenticate users directly, or delegate to a single sign-on provider so users sign in with credentials they already have. From Authentication, configure:
- Email + password: direct account credentials.
- SAML 2.0 SSO and OIDC: delegate sign-in to an identity provider.
- SCIM provisioning: sync users and teams from your identity provider automatically.
- Domain auto-assign: automatically add new users from a trusted email domain.
- Enforce MFA: require multi-factor authentication org-wide.
Enabling SSO replaces direct account credentials with your identity provider's own login flow for every user in the organization.
Organization API Keys
An organization-level API key authenticates automation, such as a CI pipeline or an external tool, against the Zilla Console API itself. It's distinct from a user's personal keys (managed under their Profile) and from the per-application subscription credentials managed under Applications. Select Generate new key to create one.
Certificate Authorities
Certificate authorities are managed per environment, not here. Open Platform Settings → Environments → [environment] → Security to register a CA trusted when that environment validates a certificate presented by a Gateway or another component using mutual TLS. See mTLS for the equivalent concept on the gateway's own inbound connections.
Next Steps
- Environments covers the per-environment certificate authorities and Security tab.
- Access covers the users and teams this authentication applies to.
- Audit Log covers reviewing changes to security configuration.