User

Scope: namespaced · Licensed (identity-management feature + users cap)

A User is a person on the platform — a licensed seat. It is the natural identity that ties together that person's accounts across every backend. The license users cap counts User seats, regardless of how many backend Identity accounts each person has.

Spec

Field	Type	Description
email	string (required)	The person's email — the natural key linking all of their Identity accounts. Must be a well-formed address; a malformed one is refused at admission (as is Identity.spec.email and every team or organization member's email)
displayName	string	Human-readable name

A User carries no type — it is backend-agnostic. The per-backend accounts (LiteLLM key, Langfuse membership, LibreChat login) are separate Identity objects, each pointing back at the User via userRef.

One person, many accounts

User (person / seat)            email: alice@example.com
  ▲   ▲   ▲
  │   │   └── Identity (type: librechat)      userRef: { name: alice }
  │   └────── Identity (type: observability)  userRef: { name: alice }
  └────────── Identity (type: litellm)        userRef: { name: alice }

• Each Identity must reference its owning User through a required userRef ({ name }, same namespace).
• An Identity whose spec.email is omitted defaults to the owning User's email, so the person keeps one identity across backends.
• Identity accounts are uncapped; only User seats count against the license.

Example

apiVersion: core.navique.com/v1alpha1
kind: User
metadata:
  name: alice
  namespace: forge-identity
spec:
  email: alice@example.com
  displayName: Alice Example
---
apiVersion: core.navique.com/v1alpha1
kind: Identity
metadata:
  name: alice-litellm
  namespace: forge-identity
spec:
  type: litellm
  userRef: { name: alice }     # same namespace
  gatewayRef: { name: gateway }  # required, and same namespace — no `namespace:`
  # email omitted → inherits alice@example.com

Prefer type: gateway for new resources

type: litellm still works, but it is now validated against the referenced Gateway and is refused if the two disagree. type: gateway follows the Gateway's own spec.type instead, so the Identity never has to name the gateway product. gatewayRef is required for every gateway-backed type and must be in the same namespace — see Choosing the backend and Admission rules.

Licensing

The users instance cap in the License counts User seats — one person is one seat no matter how many backend Identity accounts they have. Identity management overall requires the identity-management feature. In the Community edition, manage identities inline on a single Gateway instead.

See Identity, Organization & Team and Editions & Licensing.