Console

The console is the admin UI for a cluster. Operators sign in here to create projects, inspect data and files, and ship functions and sites. Project users never use it. Their signup lives on the project host.

The server binary serves the built UI at /console. The API is /console/v1. It is not on a project hostname, and it is not a public signup for reactor.cloud. The UI source is the console/ directory. The image carries the built files. Locally that is http://127.0.0.1:18000/console.

Operators

The first setup call creates the cluster name and the first operator with platform_admin. After that, people are invited onto a project by an owner or admin. A new email gets an operator row and a password set at invite time.

An operator can belong to many projects and still have no row in reactor.users. Membership roles are owner, admin, and developer. Creating a project makes the caller the owner.

Action	Minimum role
Cluster page, console users	platform admin
Create a project	any operator
Data, storage, functions, queue, sites, logs	developer
SQL editor	admin
Project users, team, rotate API keys	admin
Rename or delete the project	owner

Console JWTs use the same Ed25519 key with aud=console and role=console. A session lasts 12 hours. They are rejected by /auth/v1, /data/v1, and /mcp. Project JWTs are rejected by /console/v1.

A console service key uses aud=console-key. A human session mints it from the avatar menu or with reactor service-keys. The secret is shown once. projects.create can create projects. projects.migrate, projects.sql, auth.settings, auth.providers, auth.email, and auth.users work only on projects that same key created. auth.email includes allowing cluster SMTP on those projects when the operator is a platform admin. The cluster mail server stays closed. Revoke deletes the key and clears that stamp.

An operator can enroll a TOTP authenticator or a passkey. When one is enrolled, login finishes through /console/v1/mfa.

Pages

Outside a project the sidebar lists Projects and, for a platform admin, Cluster and Console users. Service keys and Agents are in the avatar menu for every operator. Inside a project it lists Overview, API keys, Auth, Data, SQL, Storage, Functions, and Sites, with Logs, Team, and Settings at the bottom. Queue is in that list only when the cluster has the queue extension.

• Overview shows the project name, counts, and 24-hour traffic for auth, database, functions, and sites. Any other log kind from that window is a chart too, including queue.
• API keys shows the anon key and a hidden service key, with reveal, copy, and rotate. Plaintext exists only at create and rotate.
• Auth has an inner sidebar: Users, Providers, 2FA, Email, and Templates. Users lists project users and whether the email is verified. An owner or admin can change a password or delete a user. Providers turns email verification on or off and stores OAuth client credentials. 2FA turns on a second factor for password sign-in. Email is the project’s SMTP server and link base. A platform admin can allow that project to use the cluster SMTP server, which sends when the project host is empty. Templates edits confirm_email, magic_link, recovery, invite, and otp. /email redirects to Auth → Email.
• Data lists tables, can create one, and opens a grid. That grid is every row in the schema. It does not apply a user’s row-level security policy.
• SQL runs queries as the project database role. It is read-only until you turn that off. DROP, a delete or update without WHERE, and a table created without row-level security ask you to confirm. Run as migration stores the SQL and can revert a CREATE TABLE, CREATE INDEX, CREATE POLICY, or ADD COLUMN. Owners and admins can reset the database role from Settings. That cancels in-flight SQL and migrations. The password is not shown.
• Storage is the blob browser under the project prefix.
• Functions opens Overview, Versions, Logs, Variables, and Test. Promote pins a version. Demote clears the pin. Variables are encrypted per function and the value is never shown again.
• Sites opens the project’s site: Overview, Deployments, Logs, Variables, and Domains. A custom host shows the TXT record until it verifies.
• Queue lists queues in a sidebar and can create one. The selected queue opens Messages and Subscribers. Messages sends a JSON body. Subscribers shows the function, visibility timeout, quantity, and max reads.
• Logs are recent lines of every kind. Search matches kind, name, status, and message. A queue delivery is kind queue. The function it called is a separate function line.
• Settings renames or deletes the project. Delete asks for the project name.

The cluster pill shows the name, where it runs (local Docker, AWS, or Fly), and a health dot. The Cluster page stores the cluster SMTP server. A project uses it for auth mail only after a platform admin allows that project, and only when the project has no SMTP host of its own. Creating a project in the UI returns the same pair the CLI prints once: anon_key and service_key. Later visits show the anon key and a hidden service key. Reveal does not mint a new secret. Rotate does, and the previous keys stop working.

A console call with a project user token is rejected. A project call with a console token is rejected. Login with MFA enrolled returns a short-lived token that only /console/v1/mfa accepts until the second factor succeeds.

iOS

The iPhone app signs into the same /console/v1 API. The source is apps/console-ios. It stores each cluster session in the Keychain: the cluster URL, the operator email, and the console JWT.

Opening a saved cluster uses that token. The app asks for the password again in the last 10 minutes of the 12-hour session, and for an authenticator code or a backup code when the account requires a second factor. Enrolling a passkey still happens in the browser console. The app can hold more than one cluster. Logging out of one does not remove the others.

This session is the console JWT. It is not the MCP refresh token. An agent signed in through /mcp keeps a separate 30-day refresh. See MCP.

Agents

The avatar menu opens Agents. It lists browser MCP sessions and bearer keys for this operator. Revoking a session deletes that refresh family. Creating a key shows rtr_mcp_... once. Revoking the key makes the next call with it fail. Details are on MCP.

Agent

To the right of the avatar, Reactor Operator opens a conversation sidebar for that operator. Turns are stored and polled while they run. The agent can see the project the operator has open. It is not a public API on reactor.cloud.