Administration
The admin dashboard, user and environment management, and the bearer-protected admin API.
Admin dashboard
The dashboard (/dashboard) is the operator surface. Its home view surfaces request latency
metrics (authorize / token / validate) broken down by environment and by day:
It provides:
- Full CRUD for users, including per-user environment grants.
- View and manage OAuth clients (with a Dynamic badge + registration-type filter for DCR-registered clients).
- Token activity log viewer.
- Setup area (
Dashboard → Setup) — a tabbed page covering Site identity (title, logo, URL, CDN URL), Admin API, Environments, Scopes, and Password policies (per-environment complexity rules + max password age).
User management
Profiles
- Username, email, avatar.
- Avatar upload to R2 (via the Cloudflare Images API).
- Self-service profile update.
- Gravatar-compatible avatar fallback (MD5-based).
Environment access
Users are granted access to specific environments via a users_environments mapping:
- Grants are edited inline in the admin Users list (and shown as badges per user).
- Grants drive per-user password-policy resolution (the login max-age gate) and are re-checked on every token refresh.
- On upgrade, every existing user is granted every environment for backwards compatibility.
Environments and clients
A regular user's environment is derived from the client id used at sign-in. Admins do not belong to
an environment. DCR-registered clients land in DCR_ENVIRONMENT_ID, so grant the intended users
access to that environment or /authorize will reject them.
Admin API
- Bearer-token protected (a client-credential JWT from a client configured as an admin API client).
- Admin operations: create / update / delete users, manage tokens.
- Drive it programmatically with the client library.
Lock down the admin surface
The admin dashboard (/dashboard*) and admin API (/api/admin/*) should not be reachable by the
general public. Put them behind an IP allowlist or Cloudflare Access in addition to the in-app
bearer protection — see the WAF guide.