Getting started
Sign in and sessions
The dashboard uses a signed session; automated or server-side calls can use your tenant's API key instead, which is treated as full ADMIN access.
How it works
- Dashboard sessions are backed by a hand-rolled HS256 JWT signed with your workspace secret
- Server-to-server requests send the tenant API key via the x-api-key header
- Disabled accounts are blocked, and an admin-issued temporary password forces a reset on next sign-in
Good to know
- Because an API key acts as ADMIN, treat it like any other production secret
- Passwords are stored with salted scrypt, not a reversible encoding