Operator Console operator

Operators are the platform super-admins (separate from any tenant login). Add more, break-glass reset a locked-out operator's password or MFA, or remove one. The platform must always keep at least one operator. Secrets are shown once and never stored.

An individual can request to join a corporate tenant. The request itself is their explicit consent — governance changes from self-owned to tenant-governed (they lose self-purge and endpoint control). Approving runs an export-before snapshot, then re-associates their seat to the tenant, flips governance, and sets a permanent one-way lock (they cannot leave or move again). This cannot be undone — review the target carefully.

When a tenant admin requests a password reset for their console login and their account requires operator approval (default ON), the request is held here instead of emailing a link. Approving mints and emails the reset link (or a break-glass temp when email is off); denying discards it. This gates ONLY the control-plane login — the tenant's seats, memory, and MCP connection tokens are never affected. Per-account policy is set from each account's overview.

While "new users require approval" is on (Platform tab, default ON), a new self-serve signup lands here instead of going live. Until you decide, that person is inert: they cannot sign in, they have no seat, no memory store, and no connection key — only a claimed email address.

Approve activates the login, provisions their private memory schema, starts their first-month-free clock, and emails them the welcome/introduction. Deny disables the login permanently (the email stays claimed so it can't be re-used to route around the decision) and sends nothing. Undecided requests expire automatically.

Offline mode takes the product down for users — the memory API and the tenant/individual consoles all return a maintenance page. This console stays up, by design: it is where the switch lives, so it is exempt from its own kill-switch. Nothing is deleted or expired while offline; memory is untouched.

New users require approval holds every new signup for your decision (see the Signup approvals tab). Notification address is emailed when someone is waiting — the queue is the source of truth, so email is only a convenience.

Compose a message that appears in the alert space of the consoles you target. Each recipient can dismiss it for themselves; deactivate to pull it from everyone. Messages are content-checked before they send. This is a heads-up channel (maintenance, notices) — it never touches memory or data.

Origins added here are allowed for every tenant, on top of each tenant's own list — use for shared infrastructure (e.g. a central OpenWebUI) so you don't repeat it per tenant. A tenant's own origins and its enable/disable toggle live on that tenant's Overview → Access control. Origins are the browser-facing allowlist; the connection key + per-tenant schema remain the data boundary.

The platform's billing roster — every account with its plan, seat-tier mix, active seats, monthly recurring bill and contract status. The MRR figure is the sum of every account's current monthly bill. Drill into one account's full bill + ledger under Tenant → Billing. A manual tier override (operator comp) sets a seat's tier with no charge from the account's Users page.

Pick a payment provider and enter its credentials so a real checkout can light up later. This is the configuration surface only — no live card processing is wired yet, so a selected provider still resolves to the honest stub and nothing is charged until a real adapter is written. Credentials are encrypted at rest (never stored or shown in plaintext); saved secrets show as •••• set, write-only. Currency defaults to CAD.

Point the platform at your SMTP relay (your own mail server) so it can send transactional email — today that is the individual "My Memory" password reset. The password is encrypted at rest (never stored or shown in plaintext); a saved password shows as •••• set, write-only. Use send test email to verify the relay before you flip enabled on. Nothing is emailed while disabled.

The account-level flk_ connection key is the bearer OpenWebUI uses for this whole tenant (distinct from per-seat tokens under Users). Rotate mints a new key and revokes the current one immediately — the tenant must re-key their OpenWebUI. Revoke kills a key now (use if one leaks). Full keys are shown ONCE and never re-displayed.

Restrict which browser origins may make authenticated calls for this tenant. ON = only listed origins (this tenant's + global) are allowed; OFF = any origin (less secure). It's defense-in-depth on top of the connection key — never the data boundary (that's the key + per-tenant schema). Server-to-server OpenWebUI calls carry no origin and are unaffected. Global origins apply to every tenant.

The base 5 Standard seats are included & immutable (shown locked). Provision more à-la-carte or by bundle. The ladder is standard → advanced → expert → agent; assign a user to a tier under Users. All amounts are CAD.

Accounts are the login-holders — the email/password logins your customer signs into their tenant console with (distinct from Users, the end-user seats). Add more than one, reset a password or MFA, or remove a login. Secrets are shown once and never stored.

Users are the tenant's end-user seats — the OpenWebUI users that become seats (distinct from Accounts, the login-holders). Oversight + control: read each seat's ingest state and deprovision to reclaim the seat. The operational label and the TRAIN⇄SERVE freeze are edited by the customer in their tenant console — read-only here.

For a standalone client that doesn't auto-seat through OpenWebUI. Leave the UUID blank to generate one. A per-user connection token (flu_) is minted and shown once for a ready-to-connect config. Cap-enforced — at the licensed limit, add capacity in Plan & Capacity first.

Active = normal. Suspend = reversible pause. Lock = hard cutoff (every credential resolves to nothing). Archive = cold (moves to Trash). Only you can clear a tenant's panic lock. These apply to every account type.