0 Session & token inspector live view of the current access token
1 Register email + password Ā· Argon2id
Creates a global user. With no tenant slug the user gets a fresh tenant they own; with an existing slug they join as a member.
ā
2 Login lockout after 5 fails
Password login. After loginMaxAttempts (5) failures the account locks for 15 min. Optional tenantId picks the active tenant.
ā
3 Federated login OAuth2 + PKCE
Authorization-code + PKCE with account linking. Buttons open /auth/oauth/{provider}/start. A provider only works if its client id is configured server-side.
Firebase social + phone-OTP login is also supported (POST /auth/firebase) on JVM builds when enabled ā needs a Firebase ID token, so it isn't wired into this console.
4 Stateless verification JWKS & OIDC discovery
Downstream services verify access tokens offline using the published public keys.
ā
5 Platform catalog X-Admin-Token Ā· cross-tenant
Set X-Admin-Token up top. Define products & features, and introspect tenants/users/products.
ā
6 Grant entitlement bearer Ā· tenant owner/admin
Grants a product plan + features to a user, scoped to a tenant. Uses your current access token; you must be owner/admin of the tenant. Re-login afterwards to see the entitlements claim update.
ā