DocumentationAPI Reference
Getting started

Authentication

Secure user authentication, OAuth 2.0 integration, session management, and role-based access control in OutRiskAI.

OutRiskAI employs NextAuth.js v5 to manage secure session-based authentication for the web dashboard and token-based authentication for the Public REST API.

Web application sessions use encrypted, HTTP-only cookies. Public API integrations authenticate using Bearer secret tokens (ork_live_...).

Supported Authentication Methods

  1. OAuth 2.0 Single Sign-On: Google OAuth & LinkedIn Sign-In.
  2. Credentials Authentication: Email and bcrypt-hashed passwords.
  3. API Secret Keys: Scoped Bearer tokens generated from user profiles (/profile).

NextAuth.js Environment Setup

Ensure the following authentication variables are defined in your .env file:

# NextAuth Core Settings
NEXTAUTH_URL="http://localhost:3000"
NEXTAUTH_SECRET="your-32-byte-base64-secret"

# Google OAuth Provider
GOOGLE_CLIENT_ID="123456789-example.apps.googleusercontent.com"
GOOGLE_CLIENT_SECRET="GOCSPX-example_secret"

Configuring Google OAuth

  1. Navigate to the Google Cloud Console Credentials page.
  2. Create a new OAuth 2.0 Client ID with application type Web application.
  3. Add Authorized JavaScript Origins:
    • http://localhost:3000 (Development)
    • https://your-domain.com (Production)
  4. Add Authorized Redirect URIs:
    • http://localhost:3000/api/auth/callback/google
    • https://your-domain.com/api/auth/callback/google
  5. Copy the generated Client ID and Client Secret into .env.

Role-Based Access Control (RBAC)

OutRiskAI enforces three primary user roles:

RolePermissions
USERUpload contracts, trigger AI analysis, chat with contracts, manage owned API keys.
LAWYERReview assigned user contracts, offer professional legal consultations, publish recommendations.
ADMINFull system access, manage user roles, audit platform metrics, configure system defaults.

Session Storage & Security Standards

  • Cookie Security: Cookies are flagged SameSite=Lax, HttpOnly, and Secure (in production HTTPS).
  • Password Hashing: Passwords are hashed using bcrypt with a salt round factor of 12.
  • API Key Hashing: Secret API keys are shown once at creation. Only a SHA-256 hash of the token is stored in PostgreSQL.

Next Steps

Configuration Guide

Configure object storage, SMTP email services, and model options.

Public REST API

Learn how to authenticate programmatic API requests with Bearer tokens.

Risk Analysis

Comprehensive guide to OutRiskAI's automated risk detection, severity scoring, risk categories, and assessment methodology.

Configuration

Detailed reference for environment variables, object storage, email gateways, and AI model parameters.

On this page

Supported Authentication MethodsNextAuth.js Environment SetupConfiguring Google OAuthRole-Based Access Control (RBAC)Session Storage & Security StandardsNext Steps