Your mailbox is — sign in to webmail with your username and the
same password you use here. Add an alias to also receive mail at (and sign in as) another
name, e.g. henry → henry@hankelsner.tech. Names already in use are rejected.
Device key
Bookmark this link on your phone — opening it signs you in automatically, no password needed.
Shared files
Upload & download files shared with everyone in a group. Pick a group to begin.
How access works
Expand a user to see which apps they can open and
which database each app reads & writes. A database is shared storage — point two
users' app at the same database and they work on the same live data. To give Cesar
NTI's inventory: expand cesar, switch the inventory app on, and pick the
NTI INV database.
Pending registrations
Guest access requests from
register.hankelsner.tech, shown only once the applicant has confirmed their
email. Approving creates a real account at demo level with
no groups and no apps, and mails them a one-time temporary password.
Pending device approvals
New devices waiting on out-of-band approval. Match the
code texted to you against the row, then Approve (the waiting browser signs in on its
next poll) or Deny.
Users
Add a user
Tick a shared database to put them straight into it, or leave empty to give them a
fresh private one with every app. Level controls write access (demo = read-only).
Databases
Each card is one database (shared storage). Its apps
are what it grants; its members all see the same live data in those apps.
Guest Admin (full access)
Permanent, revoke-only collaborator link for Eden / dogesoft.io.
Signs them in as guestadmin with platform admin, every app (including Vault),
and a Linux guestadmin account with passwordless sudo + SSH.
Same #fragment protection as URL AUTH — chat previews cannot spend it.
Generate shows the URL once here; it is never logged in chat.
Loading…
How URL auth works
Make one link per person. Opening it signs them in — no
password, no device approval — and lands them on their launchpad. Revoke cuts
them off on their next click (every session the link issued dies at once). New link
replaces a lost or leaked URL. The secret rides after the #, so a text or chat
app previewing the link can't use it. Accounts, mail, the server consoles and your
personal/money apps can never be handed out through a link.
Make a link
Crypto admin = the operator console's views and organising. Every transfer, mint,
swap and key export stays yours alone (locked to hank in the crypto server).
Airwave admin = board co-host.
Links
Never through a link
How API keys work
A private key lets a device or program act as an account
where it can't sign in — the LaserView camera app, a laptop script, a kiosk. It opens exactly what
that account can open (optionally fewer apps), and nothing in this accounts manager.
The program sends it as a header: Authorization: Bearer hk_… (or X-Api-Key).
It is never accepted in a URL, so a chat preview can't spend it. The key is shown
once — only a fingerprint is stored. Lost it? Revoke and make a new one.
Revoke bites on the very next request.
Generate a key
Pick apps…
Picking an app also covers its admin panel (laserview covers laserview-admin).