Authentication

Overview

Guardian authentication is part of the release-governance pipeline. GitHub device authorization unlocks monitoring, and provider credentials determine how Guardian evaluates AI-generated changes before release.

Supported Providers

Guardian supports multiple AI providers for governance-oriented code analysis:

GitHub Sign-In

1. Click Sign In with GitHub when prompted.
2. Follow the device authorization flow in your browser.
3. Return to Guardian and click Check Now if needed.

Provider Setup

Follow the steps below to configure your AI provider.

Step 1: Obtain API Keys

1. OpenAI: Visit platform.openai.com
2. Anthropic: Visit console.anthropic.com
3. Google: Visit aistudio.google.com
4. GitHub Models: Generate a fine-grained GitHub token with models:read permission (see the in-app Settings note).
5. Ollama: No API key required for local installation

Step 2: Configure in Guardian

Open Settings (gear icon) and configure your provider:

1. Select your preferred Provider from the dropdown
2. Enter your API Key (if required)
3. Choose a Model from the available options
4. Click Save to apply

Step 3: Validate Connection

The app will automatically validate your credentials when you start monitoring or use Guru.

Credential Storage

Guardian uses platform-native secure storage:

Security Note: API keys are never stored in plain text files or exposed in logs.

Ollama Configuration

For local AI models using Ollama:

Local Setup

1. Install Ollama from ollama.com
2. Pull a model: ollama pull llama3.2
3. In Guardian, select Ollama provider
4. Set Base URL to http://localhost:11434 (Local) or your cloud endpoint

Cloud/Remote Setup

If you have a hosted Ollama instance:

1. Select Ollama provider
2. Choose "Cloud" from the Base URL dropdown or enter your custom endpoint

Rate Limit Management

Guardian automatically handles rate limits with exponential backoff. If you encounter rate limiting:

• Wait a few moments and try again
• Consider using a different provider temporarily

API Key Rotation

Regularly rotate your API keys for security:

1. Generate new key from provider dashboard
2. Update in Guardian Settings
3. Test by using Guru or starting monitoring
4. Revoke old key from provider dashboard

Troubleshooting

Common Issues

Reset Credentials

To clear stored credentials:

1. Open Settings
2. Click "Clear" next to the API Key field
3. Re-enter new credentials

Best Practices

1. Use Separate Keys: One key per environment (dev, staging, prod)
2. Monitor Usage: Check provider dashboards for usage
3. Rotate Quarterly: Change keys every 3 months
4. Limit Scope: Use provider's API key restrictions if available
5. Never Commit: Keep keys out of version control