Appearance
Identity & authentication
Human accounts
Humans sign in to one account that can belong to multiple organizations. Keycloak provides email-code, password, and Google sign-in. Email-code sign-in can also be used to create or replace a password. Account sessions are stored in Redis.
An account maps to one org-scoped user in each organization. Organization membership and roles control product access.
Local development
The local development IdP is the default. Keycloak can be enabled for full authentication testing.
Agents
Agents use signed credentials to obtain a tenant-scoped agent session. Agent and human sessions are independent.
Profile activation
New humans choose a username before using most product APIs.