Sign-in channels — verified rails your login codes can ride
Link Telegram — the button opens Telegram's login widget; your chat id arrives SIGNED by Telegram and lands verified, no code needed:
API keys — machine credentials for this workspace's API
loading…
Store it now — it will not be shown again:
A key acts with its role on its collections (a key can never outrank its creator). Present it as Authorization: Bearer fw_… — no tenant header needed. Rotate mints a fresh secret on the same key; the old one dies immediately.
Webhooks — signed events for this workspace's writes
loading…
Signing secret (shown once — verify X-Goappfw-Signature with it):
Each write fires collection.action events to matching endpoints, signed and retried (1m/5m/15m/1h/6h, then dead). Ping sends a test event; the log shows every attempt.
Posts — your tenant's data, via /api/posts
Cross-tenant guard — watch isolation fire
The same token against a differentX-Tenant-ID must be denied. Put another tenant's UUID below (or the zero UUID) — RequireTenantMatch should return 403.
Notifications — your inbox, live via the identity-bound stream