Apelora

Sign in

Both screens ask who you are, unless the control plane runs in development mode without a database.

You haveSign in withGood for
Nothing set up yetAn API token made on the serverThe first administrator, automation
An identity provider (OpenID Connect)Continue with your providerPeople, once an administrator has added it
No providerA username and password (local account)Small installations

The first time: an API token

On the server:

DATABASE_URL=… apelora-control-plane token create --name me --role fabric-admin

The token is shown once. Roles are fabric-admin, operator, studio-designer and auditor; every token expires (90 days unless you choose 1 to 365). In the Console, paste it into API token and choose Sign in. In the Studio, choose the chip that says This browser · not connected, then connect with the token. It is kept only for that browser tab.

The Fabric Console sign-in page: an illustration of connected servers, and a card with a Continue with button for the organisation's identity provider and a link to use an API token instead.
The sign-in page once an identity provider is set up. Sample data.

Then: your organisation's identity provider

An administrator adds the provider in the Console under Identity & Access → Sign-in. People then choose Continue with …; their account is created at the first sign-in without any role, and an administrator gives them one. Apelora never sees their password.

Fabric Console, Sign-in settings: identity providers with their status, a local accounts switch, a directory section and an API tokens section.
Identity providers, local accounts, directories and tokens. Sample data.

Everything else, including messages you may see and how local accounts and directories work, is in the signing-in guide. Roles and what each may do: access, roles and security.