---
title: Admin
description: The admin section — protecting the admin dashboard with an auth provider and an IP allowlist.
---

# Admin

The `admin` section controls access to the built-in admin dashboard. The block is optional; by
default the dashboard has no auth provider and an empty IP allowlist (all IPs permitted).

```yaml
admin:
  auth_provider: client-certs
  allowed_ips:
    - 10.0.0.0/8
    - 192.168.1.10
```

## `admin`

| Key | Type | Default | Description |
| --- | --- | --- | --- |
| `auth_provider` | string | none | Name of an [auth provider](/docs/octopus/configuration/auth) used to protect the dashboard. When unset, the dashboard requires no authentication. |
| `allowed_ips` | array of string | `[]` | IP allowlist for admin access. Empty means all IPs are allowed. |

<Callout type="warn">
  With no `auth_provider` **and** an empty `allowed_ips`, the admin dashboard is reachable without
  authentication. Both are enforced: `allowed_ips` matches the client address against each IP / CIDR
  / range pattern and returns `403` on a miss, and `auth_provider` requires authentication (static
  assets bypass the auth check). Set at least one in any non-local deployment. See
  [Admin API](/docs/octopus/observability/admin-api).
</Callout>

The dashboard is served under the gateway's internal route prefix (see
`gateway.internal_route_prefix` in [Gateway](/docs/octopus/configuration/gateway)).