Appearance
Identity & authentication
Human accounts
Humans sign in to one account that can belong to multiple organizations. Keycloak provides email-code, password, and Google sign-in. Email-code sign-in can also be used to create or replace a password. Account sessions are stored in Redis.
Corporate installations can enforce one configured corporate OpenID Connect provider. The corporate identity and upstream subject, rather than an email address, identify the account; email may be absent. Corporate SSO is an installation policy and does not itself grant organization membership.
An account maps to one org-scoped user in each organization. Organization membership and roles control product access.
Local development
The local development IdP is the default. Keycloak can be enabled for full authentication testing. Corporate-only installations disable the ordinary login methods and development shortcut.
Agents
Agents use signed credentials to obtain a tenant-scoped agent session. Agent and human sessions are independent.
Profile activation
New humans choose a username before using most product APIs.