Account dashboard

There is no self sign-up. An administrator creates your account and gives you a username and a one-time secret code (see Admin access). On the first sign-in, enter the username, then the "Secret code" and a new password. Add a passkey afterwards.

Use "Add passkey" in the dashboard header (it opens /add-passkey) and click "Create passkey". If the authenticator supports it, the passkey can also unlock your end-to-end encryption keys: you are asked to use it once more ("Enable encryption keys"), or you can choose "Skip, use it for sign-in only". The Sign-in methods page then tells you what happened, for example "Passkey added. Sign in with it and confirm once with another method to let it unlock encryption keys", or "This authenticator can't unlock encryption keys".

pykrete requires user verification for every passkey: a fingerprint, face, device unlock or, on a hardware security key, a PIN. A key that only checks "user present" (a touch) is rejected with "authenticator did not verify the user, security keys need a PIN set".

This is deliberate. A passkey replaces your password and can unlock your encryption keys through the WebAuthn PRF extension. Authenticators compute a different PRF secret with and without user verification, so allowing both would break the encrypted key envelopes, and touch-only would make unlocking your keys possession-only.

Shows your user ID (with a copy button; apps and admins use it to refer to you), name, when the profile was last updated, member-since date, every username you had (current first) and your email addresses.

You can upload or remove your picture (at most 2 MiB). Name and username can't be changed from the dashboard yet.

Lists your addresses with a "verified" or "unverified" badge and, for unverified ones, whether a verification link is pending.

The server emails the link when email is configured (see Email). Without it, no email is sent and the link only appears in the server log.

Verified addresses matter for organization invitations sent by email: only an account with that verified address can accept them.

Lists your credentials: "Password", "Passkey" (with a short id), "Password setup code" (an unused registration code), "Authenticator app", "YubiKey OTP" and "YubiKey OTP (YubiCloud)" (both with the key's public ID). A badge marks credentials that can unlock your encryption keys, and a summary line shows the encryption key fingerprint and how many credentials wrap it.

Add passkeys with "Add passkey" in the header. Second factors can be removed with "Remove"; passwords and passkeys can't be removed from the dashboard yet.

One entry per browser where you are signed in to pykrete, with the time it started and the sign-in methods passed in it (for example "Passkey"). Ending a single session from here is not available yet; "Sign out" ends the session of the current browser (see [sign-out]).

At the top, requests from machines waiting for your approval (backchannel requests, see CIBA), marked "waiting for you". Each shows the app, its message (for example "nas1: unlock 2 disks"), the address the request came from, when it was made and expires, and the requested scopes.

Approve only requests you expect. A request you didn't start can mean someone has a copy of the machine's credentials.

Below them, sign-ins that are not finished yet: authorization codes issued to an app that the app has not exchanged, and device sign-ins you approved that the device has not picked up. Read-only. Each entry shows when it was created and when it expires; expired entries are marked "expired".

Everything inside an organization is described in Self-service.

Every app you granted access to, grouped by what it can see: "Your identity" (built-in permissions such as profile and email) and one group per API (audience) with the scopes you approved.

Revoking a grant from here is not available yet.

Which of your organizations an app may see is chosen on the sign-in screen, when the app uses organizations: "Visible to this app" toggles them, "Continue as" picks the active one, and "Not enabled for this app" lets you request access for organizations that haven't enabled the app. There is no dashboard page for these decisions yet; see Organizations for when the screen appears again.

All access tokens issued to you, newest first; expired ones are folded away. Each entry shows the app, a short id, the grant type, issue and expiry time, scopes, audiences, the refresh token state and, under "Claims", the access and ID token claims. "this page" marks the token the dashboard itself is using. Tokens can't be revoked from here.

Passwords for apps that sign you in over LDAP, with the app and creation date. Administrators issue and revoke them; creating your own is not available yet. See LDAP.

API keys that apps created for you through the Backend API: name, prefix, app, who created it, last use, expiry, scopes and state. "Revoke" disables a key immediately; revoked and expired keys stay listed under a fold. New keys are only created by the apps that use them, see Backend API.

App encryption keys: one per key name, created the first time an app is issued an app_key:... scope for you. Shows name, description and creation date. Read-only. See App encryption keys.

Global roles an administrator granted you, with their id and description. Roles you hold inside an organization are shown on that organization's Members page.