# Console login & user management

**Audience:** Operators and tenant admins  
**Portal:** [/login](/login) · Console [Identity](/admin)  
**Addon:** Works **alongside** API keys, OIDC, SAML, and SCIM.

---

## What was added

| Capability | How |
|---|---|
| Custom email/password login | `/login` + `POST /api/identity/local/login` |
| First admin bootstrap | `/login` → **First admin** (only when project has zero local users) |
| User management | Console → **Account → Identity → Users** |
| Toggle | Identity config → **Enable custom email/password login** |

Existing automation stays on **API keys**. Enterprise SSO (OIDC/SAML) and SCIM stay available.

---

## First-time setup

1. Open https://webx.agentslab.host/login (or your deployment `/login`).
2. Project: `default` (or your tenant id).
3. Open **First admin**, enter email + password (10+ characters).
4. You are redirected to `/admin` with a browser session cookie.
5. Create more users under **Identity → Users**.

After the first local user exists, bootstrap is disabled for that project.

---

## API (summary)

| Method | Path | Auth | Purpose |
|---|---|---|---|
| GET | `/api/identity/local/status?project_id=` | public | bootstrap available? |
| POST | `/api/identity/local/login` | public | sign in |
| POST | `/api/identity/local/bootstrap` | public if no local users | first admin |
| GET | `/api/identity/projects/:id/users` | admin+ | list users |
| POST | `/api/identity/projects/:id/users` | admin+ | create local user |
| PATCH | `/api/identity/projects/:id/users/:user_id` | admin+ | role / active / password |
| POST | `/api/identity/logout` | session + CSRF | sign out |

Passwords are Argon2 hashes in `identity_local_credentials` — never returned in directory JSON.

---

## Still supported

- Paste **API key** in the console sidebar  
- OIDC / SAML start URLs when configured  
- SCIM provisioning to `/scim/v2/:project/...`