Platform admin
Platform admins are Webrizen AI Labs staff who run the SSO service itself: they register products as OIDC clients and look after user accounts across all organizations.
The admin organization role manages one customer's workspace. The platform admin
flag is global and should only be given to your own team.
Becoming a platform admin
Either list emails in PLATFORM_ADMIN_EMAILS before those people sign up, or promote an
existing account:
pnpm --filter @webrizen/accounts make-admin you@company.comAdmins can also promote and demote each other from Platform → Users.
Registering an application
Platform → Applications → Register application
| Field | Guidance |
|---|---|
| Name, homepage, logo | Shown on consent screens and in users' Connected apps |
| Application type | Web app gets a client secret. Single-page and Mobile use PKCE only |
| Redirect URIs | Must match exactly. With the SDK: https://app.example.com/api/auth/webrizen/callback |
| Sign-out redirect URIs | Where users land after a global sign-out |
| First-party | Skips the "Allow access?" screen. Only for Webrizen's own products |
After registering you'll see the credentials as ready-to-paste environment variables. The client secret is shown once.
Redirect URIs must use https in production. For local development, http://localhost
and http://127.0.0.1 are accepted: apps whose redirect URIs are all local are
registered as loopback clients automatically.
Managing an application
Click any app to open its page, where you can:
- copy its client ID and environment variables,
- turn the Directory API on or off, which lets the app list organization members and receive webhooks (see Directory API & webhooks),
- add webhook endpoints, send test events, rotate signing secrets and review or resend deliveries,
- Rotate the client secret, which issues a new secret and invalidates the old one at once,
- Disable / Enable the app, which blocks sign-ins, Directory API calls and webhooks without deleting anything,
- Delete the app permanently.
Managing users
Platform → Users lists every account, with search by name or email. For each user you can:
| Action | Effect |
|---|---|
| Make / remove platform admin | Toggles the global admin flag |
| Sign out everywhere | Revokes every session on every device |
| Ban user | Signs them out and blocks sign-in. Add an optional reason |
| Unban user | Restores access |
The table also shows verification status, whether two-factor is on and the last sign-in method.
All of these actions are recorded in the platform-wide Platform → Audit log, alongside every organization's events.