Authentication
Different Overlord surfaces use different credentials, but the goal is always the same: keep access scoped and auditable.
Desktop and CLI login
Desktop and CLI login is handled by ovld auth login or via Overlord Desktop. A USER_TOKEN (prefixed out_) is generated server-side and stored locally. The raw token is shown once at creation time; the server retains only a SHA-256 hash.
USER_TOKENs are created in Settings → Tokens and scoped to specific permission sets. They expire after 90 days by default.
Authentication library — better_auth
OpenOverlord uses the open-source better_auth library for session and token management. Authentication runs on the same server as the rest of the backend — no credentials are forwarded to a third-party identity provider.
Agent access
Agents authenticate using a USER_TOKEN passed as the OVERLORD_USER_TOKEN environment variable (or via the ovld user-token helper). The token's scope gates which protocol operations the agent may perform.
Local protocol routes
On local and desktop deployments, the runner and CLI may also communicate over the loopback interface. Loopback requests are granted operator authority without a token; this mode is disabled on hosted deployments.