Identity
HTML flows use signed sessions; APIs accept verified Bearer tokens. Same user, two transport idioms.
This marketing host answers SEO and prospects. The tenant desk holds IAM, workspaces, and your artifacts. They share design language — not databases.
HTML flows use signed sessions; APIs accept verified Bearer tokens. Same user, two transport idioms.
Marketing demos and health checks are allowlisted. Arbitrary /api/* stays behind the gate.
Deploy hooks watch /api/ready; super-admins can unlock full readiness JSON for runbooks.
| Layer | Rule |
|---|---|
| Tools | Prefer GET-query tools so URLs stay shareable and audit-friendly. |
| Marketing API | Whitelist tool IDs + cap payload size + per-IP rate limits. |
| Navigation | New labs ship as routes — the command palette indexes discoverability. |
Product atlas · Calculators · Tour · Sign in