Getting started
Sign in and sessions
The dashboard uses a signed session; automated or server-side calls can use your tenant's API key instead, which is treated as full ADMIN access.
How it works
- Login issues a signed JWT that the browser only ever holds as an httpOnly cookie, expiring in 8 hours by default
- The tenant API key authenticates as full ADMIN wherever the authenticated API accepts it — treat it like a password
- A temporary password logs you into a forced-reset state — no session until you choose a real password
Good to know
- Because an API key acts as ADMIN, treat it like any other production secret
- Passwords are stored with salted scrypt, not a reversible encoding