Ipseity Identity Console

Name	Type	Disabled	MFA	Groups	Roles	Direct Permissions	Actions

Name Type Display Name Given Name Family Name Email Email Verified Password

i

MFA Enabled MFA Secret (base32)

i

Disabled

Groups

i

Roles

i

Direct Permissions

i

Name	Description	Roles	Actions

Name Description Roles

i

Name	Permissions	Actions

Name Permissions

i

Custom Permission

Client ID	Display Name	Public	Redirect URIs	Scopes	Consent	Logout	Actions

Client ID Client Display Name (shown on the login screen; defaults to the Client ID) Client Secret Public Client (PKCE, no secret) Redirect URIs (one per line, supports suffix wildcard `.*`) Allowed Origins for CORS (one per line, e.g. https://app.example.com) Require consent screen (OAuth per-client scope consent) Front-channel logout URI (OIDC single logout) Back-channel logout URI (OIDC single logout) Allowed scopes

i

Name	Source	Client	Enabled	Auto-Provision	Actions

External providers let accounts sign in via OAuth2/OIDC. The account is keyed by email: any provider reporting the same email signs into the same local account, and a first-time email auto-provisions a principal.

Name OAuth Client ID Source Type Client Type Client Secret (private clients)

OIDC Discovery URL

Issuer (verifies the id_token; for oauth2, blank jwks_uri is auto-resolved from this issuer's discovery) JWKS URI (RS256 id_token verification; auto-resolved from the issuer when blank)

Authorization Endpoint Token Endpoint Userinfo Endpoint

Scope Email claim Auto-provision on first login Enabled

A realm is a Kubernetes namespace scoping this console's data (principals, groups, roles, clients, and its OIDC signing key). Creating one labels a new namespace and tolerates an existing one (any workloads already present are kept). Deleting a realm "releases" it by default — it removes every Ipseity-managed object and the realm label, keeping the namespace and any non-Ipseity workloads. Use the purge action to delete the namespace and everything in it.

ON = delete the namespace and everything inside it.

Realm	Ipseity	Bootstrap	Counts	Active Key	Actions

Profile

Loading...

Change Password

Current Password New Password

MFA (Authenticator App)

Loading...

Current Password (required)

Scan this URI with an authenticator app, then confirm with the generated 6-digit code.

Linked External auth providers

Loading...

Active Sessions

Client	Scope	Issued	Expires	Actions

Core protocol endpoints:

GET    /oauth/authorize
POST   /oauth/authorize
POST   /oauth/authorize/consent
POST   /oauth/token
POST   /oauth/introspect
POST   /oauth/revoke
GET    /oidc/.well-known/openid-configuration
GET    /oidc/jwks
GET    /oidc/userinfo
GET    /oidc/logout

Open discovery document Open JWKS Open health check

Administrator

Optional Bootstrap Entities

Ipseity Identity Console

Principals

Create Principal

Groups

Create Group

Roles

Create Role

Clients

Create Client

External Auth Providers

Create Provider

Realms

My Account

Profile

Change Password

MFA (Authenticator App)

Linked External auth providers

Active Sessions

OAuth2/OIDC

Initial Setup

Administrator

Optional Bootstrap Entities

Access Denied

Sign In

Principals

Create Principal

Groups

Create Group

Roles

Create Role

Clients

Create Client

External Auth Providers

Create Provider

Realms

My Account

Profile

Change Password

MFA (Authenticator App)

Linked External auth providers

Active Sessions

OAuth2/OIDC