# Security groups

Named sets of API client credentials - many partners on one channel, each with its own revocable definition.

[Video: New security group](https://zatosource-production.b-cdn.net/docs/gfx/security/group-create.webm?v=1792089524)

Dashboard menu: Security > Groups

## Overview {#overview}

A security group is a named set of security definitions. A channel with one directly assigned definition has one credential - a channel with groups has as many as the groups hold members. Each partner or application keeps its own credentials, and revoking one client's access is removing its definition from the group, without touching the channel or the other clients.

Three definition types can be group members:

- [Basic Auth](https://zato.io/docs/security/basic-auth.html) - a username and password in the `Authorization` header
- [API keys](https://zato.io/docs/security/api-keys.html) - a key in the header the channel's API key definitions name
- [Bearer tokens](https://zato.io/docs/security/bearer-tokens/index.html) - static tokens and JWTs in the `Authorization` header

Groups are managed in the dashboard under **Security** > **Groups**. Changes take effect immediately, without server restarts.

## Definition fields {#definition-fields}

| Field | Notes |
| --- | --- |
| Name | A unique name for the group |
| Quota tier | Optional - a [quota tier](https://zato.io/docs/security/quota-tiers.html) that applies to every member of the group |
| Members | The security definitions that belong to the group, picked from the available Basic Auth, API key and Bearer token definitions |

Groups are exported and imported with [enmasse](https://zato.io/docs/admin/enmasse.html) under the top-level `groups` key - the fields are in the [enmasse reference](https://zato.io/docs/admin/enmasse-reference.html). On import, the `members` list of a group in the file replaces the group's current members, and a security definition removed from the list remains in the environment.

## Channels {#channels}

Assign one or more groups in a [REST channel's](https://zato.io/docs/dev/rest/channels.html) create or edit form and a request is allowed through when its credential matches any member of any of the channel's groups. In service code, `self.channel.security.username` names the member whose credential authenticated the request, so you can tell which client made each call.

A channel secured through groups answers failed authentication with 403, both for a wrong credential and for a missing one - only a directly assigned definition answers 401 with a `WWW-Authenticate` challenge. The constraints that keep a channel's groups unambiguous, and the header rules for API key members, are described under [security groups for REST channels](https://zato.io/docs/dev/rest/security-groups.html).

## MCP gateways {#mcp-gateways}

Each [MCP gateway](https://zato.io/docs/ai/mcp/index.html) automatically creates its own group named `mcp.<gateway-name>` - the gateway's security picker manages that group's members, and the group is visible under **Security** > **Groups** like any other. Which credential types agents present and what rejections log is described under [MCP gateway security](https://zato.io/docs/ai/mcp/security.html).

## Quota tiers {#quota-tiers}

A [quota tier](https://zato.io/docs/security/quota-tiers.html) set on a group applies to every member, with per-member counting. A member's own rules or its own tier take precedence over the group's tier.

## Live changes {#live-changes}

Group membership changes are reflected in enforcement immediately - adding a member grants access on the next request and removing one revokes it, without restarts and without redeployments.

## Learn more {#learn-more}

- [Securing channels](https://zato.io/docs/admin/security/channel.html) - Which security types a channel accepts, and how to assign them
- [Securing outgoing connections](https://zato.io/docs/admin/security/outgoing.html) - Credentials Zato presents to the systems it calls
- [API keys](https://zato.io/docs/security/api-keys.html) - Per-client keys in a configurable HTTP header
- [Basic Auth](https://zato.io/docs/security/basic-auth.html) - Usernames and passwords for channels and outgoing connections
- [Bearer tokens](https://zato.io/docs/security/bearer-tokens/) - Static tokens and JWTs verified against a JWKS endpoint
- [Kerberos (SPNEGO)](https://zato.io/docs/security/kerberos/) - Negotiate authentication from a keytab, with no ticket management
- [mTLS](https://zato.io/docs/security/mtls/) - Client certificates in both directions, matched by fingerprint or DN
- [NTLM](https://zato.io/docs/security/ntlm.html) - Windows domain credentials for outgoing connections
- [WS-Security](https://zato.io/docs/security/ws-security.html) - UsernameToken, X.509 and SAML for SOAP traffic
- [Quota tiers](https://zato.io/docs/security/quota-tiers.html) - Named rate-limit plans assigned to any number of API clients
- [TLS certificates](https://zato.io/docs/admin/security/ssl/) - Your own certificates, the self-signed ones and how to rotate them