Credential broker · reviewer

Provider catalog

Each provider exposes scope bundles, default signing policy, and the data-protection facts the reviewer must vouch for before any credential is minted.

Configurable login journeys

New journey

Name Provider Credential kind Scopes (CSV) Egress allow-list (CSV)

M (approvers) N (pool size) TTL seconds

Requires human replay (account holder must physically forward the request) Pool mode Keycloak role (if pool) Description

Existing journeys

Credentials

Mint credential

Label Provider Credential kind Scopes (CSV) Egress allow-list (CSV) Secrets (JSON: {"token":"ghp_..."}) Cookie jar (optional, raw)

Existing credentials

Signing requests

Enqueue request

Credential ID Reason Host Method Path Body preview

Pending + recent

Syndication runs

Queue a run

Assigned human (stackId) Approved request IDs (CSV) Scheduled for (ISO)

All runs

Infrastructure (live-rendered Terraform)

This is the Terraform the broker would emit right now given current journeys and credentials. Apply it standalone or roll it into the compose deploy. Regenerated on every request.

Loading…

Audit log

API endpoints

…