Console login & user management
Audience: Operators and tenant admins
Portal: /login · Console Identity
Addon: Works alongside API keys, OIDC, SAML, and SCIM.
What was added
| Capability | How |
|---|---|
| Custom email/password login | /login + POST /api/identity/local/login |
| First admin bootstrap | /login → First admin (only when project has zero local users) |
| User management | Console → Account → Identity → Users |
| Toggle | Identity config → Enable custom email/password login |
Existing automation stays on API keys. Enterprise SSO (OIDC/SAML) and SCIM stay available.
First-time setup
- Open https://webx.agentslab.host/login (or your deployment
/login). - Project:
default(or your tenant id). - Open First admin, enter email + password (10+ characters).
- You are redirected to
/adminwith a browser session cookie. - Create more users under Identity → Users.
After the first local user exists, bootstrap is disabled for that project.
API (summary)
| Method | Path | Auth | Purpose |
|---|---|---|---|
| GET | /api/identity/local/status?project_id= | public | bootstrap available? |
| POST | /api/identity/local/login | public | sign in |
| POST | /api/identity/local/bootstrap | public if no local users | first admin |
| GET | /api/identity/projects/:id/users | admin+ | list users |
| POST | /api/identity/projects/:id/users | admin+ | create local user |
| PATCH | /api/identity/projects/:id/users/:user_id | admin+ | role / active / password |
| POST | /api/identity/logout | session + CSRF | sign out |
Passwords are Argon2 hashes in identity_local_credentials — never returned in directory JSON.
Still supported
- Paste API key in the console sidebar
- OIDC / SAML start URLs when configured
- SCIM provisioning to
/scim/v2/:project/...