Console
The signed-in surface: what each page is for, who may change what, and what a deployment with no hosted console says instead of linking to a route that would 404.
What each console page is for
| Page | Path | Purpose |
|---|---|---|
| Dashboard | /app | Balance, spend today, call totals, recent traces and the organization’s default residency. |
| Models | /app/models | Candidate endpoints split into callable, blocked by the policy in force, and catalogue only; a blocked row carries the router’s own reason. |
| API keys | /app/keys | Create a key with its scopes, copy the secret once, and revoke keys. |
| Playground | /app/playground | Send a prompt through the real router; the console calls the API server-side, so the key never reaches the browser. |
| Traces | /app/traces | Per-call metadata: model, region, route reason, latency and cost, with the retention in force shown beside the list. |
| Usage | /app/usage | Calls, tokens and spend by day and by model. |
| Policies | /app/policies | Residency, provider and model allow/deny lists, price caps, and the retention value a policy stores. |
| Settings | /app/settings | Organization name, default residency, default retention and the console language. |
| Residency | /app/settings/residency | Which endpoints the policy at hand admits and which the router excluded, with the router’s reasoning. |
| Exports | /app/exports | Download traces.json, usage.json, policies.json, the DPA template and the NDJSON audit bundle. |
| Profile | /app/profile | Your own account: name, language, email, password, verification, sessions and account deletion. |
| Billing | /app/billing | Balance, spend this month and plan. Adding credit is a form that appears only when the deployment enables it. |
| Team | /app/team | Members and roles, and invites; the invite link is shown so it can be copied by hand. |
Who may change what
The console enforces two role sets. owner and admin govern; developer may write; viewer is read-only.
- Govern (owner, admin): policies, team, settings, credit, key revocation, and minting a key with the platform_write scope.
- Write (developer): create inference keys and spend organization credit through the playground, but not govern.
- Read-only (viewer): pages and traces can be read; the playground is refused.
- Bulk organization downloads (traces.json, usage.json, policies.json, audit.ndjson) need a writing role; me.json is the caller’s own account export and is open to every member.
Your own account
These actions write only rows keyed by the session’s user id, so no form field can point them at another person.
- Display name and console language.
- Email address: changing it requires the current password, and the new address starts unverified, because the old proof belonged to the old address.
- Password: at least 12 characters, the floor in packages/shared/src/limits.mjs; changing it signs out every other session and invalidates outstanding reset links.
- Email verification: a request needs a configured mail transport; without one the page says this deployment cannot process it.
- The list of signed-in sessions, each revocable, plus one control that signs out every other browser and keeps this one; the current session cannot be revoked from the list.
- Account deletion: refused while you are the sole owner of an organization that still has other members or a non-zero credit balance, and the refusal names the organization.
The console is a deployment
The console is a deployment fact, not a public page. Its base URL comes from PUBLIC_CONSOLE_URL, and the renderer never guesses it.
consoleHref(’/signup’) is the link shape: it returns the console origin plus the route, or null when no console is configured.
Card payments need the deployment’s stripe_enabled flag. The security page records that the credit handler accepts a submitted amount without verifying a payment, and that the flag must stay off until that is fixed and tested.