@kontextmind/kxm/docs/architecture/authentication.md

KXM local-first multi-agent orchestration and operator dashboard

# Authentication

Read from `plugins/kxm/src/harness.ts`, `plugins/kxm/src/cli.ts`, and
`python/kxm-control/src/kxm_control/auth.py`.
`kxm harness list` runs `probeHarnesses` (`cmdHarnessList` in
`plugins/kxm/src/cli/project.ts`). For each detected harness that has
`authArgs`, `probeEntry` runs that command and `interpretAuth` reads the
output. KXM does not store provider credentials. The probe only classifies
the harness command's own stdout.

| Harness | Probe command | Logged-in signal in this file |
| --- | --- | --- |
| Pi | no `authArgs` on the catalog entry | `authenticated` stays null with `auth_context_required`. A separate assignment probe can run `pi auth check`. |
| Claude | `auth status` | JSON `loggedIn: true`, method `claude.ai` or `api-key` |
| Codex | `login status` | `Logged in using ChatGPT` or `Logged in using an API key` |
| Grok | `models` | exact line `You are logged in with grok.com.` |
| Kimi | `provider list` | a line containing `managed:kimi`, `type=kimi`, or `Default model:` |
| agy | `models` | a model row matched by `AGY_MODEL_ROW`, method `antigravity-oauth` |
| omp | `models --json` | success, and a non-empty `models` array when JSON parses |
| deepseek | no `authArgs` | `authenticated` stays null with `auth_unknown` |

`kxm auth` in `plugins/kxm/src/cli.ts` is `kxm auth token`. It inspects,
issues, or clears the local session token file. That token is a KXM session
token, not a provider key. Provider logins stay in each harness.

The MG1 Python control API uses a separate Authentik boundary. It accepts only
RS256 tokens whose issuer and audience match its configured values, whose
`exp` is present and unexpired, and whose `kxm_actor` is `user` or `runner`.
A token without `exp` is rejected.
The signed subject and actor kind must match
an explicit tenant membership; a user membership never authorizes a runner
token with the same subject. Only a user can create a tenant. The API does not
store the bearer token.

## Related

- [Access](access.md)
- [Harness routing](../reference/harness-routing.md)