Dashboard authentication

The administrator dashboard is available at /admin and supports GitHub OAuth and email magic-link authentication. It exposes the existing verification metrics without placing the admin API token in a browser.

Configuration

Create a GitHub OAuth App with callback URLs that use your API hosts. For example:

• Production: https://api.example.com/auth/github/callback
• Staging: https://api-staging.example.com/auth/github/callback

Set GITHUB_CLIENT_ID and the environment's SUPERADMIN_GITHUB_USER_IDS or SUPERADMIN_GITHUB_ORG in wrangler.jsonc. Store the client secret as a Worker secret:

npx wrangler secret put GITHUB_CLIENT_SECRET

For email login, Cloudflare Email Sending must have dlbr.app onboarded and the sender configured as EMAIL_FROM=noreply@dlbr.app. The Worker binding is declared in both the top-level and staging Wrangler environments; bindings are not inherited between environments.

SUPERADMIN_GITHUB_USER_IDS is the environment-specific comma-separated list of immutable numeric GitHub user IDs allowed into the id-admin operator console. This superadmin access is separate from the tenant-scoped admin role in dashboard_memberships (owner/admin/developer/viewer). Check the active environment's list before granting access. Do not use usernames as the security boundary: another account can claim a released username.

SUPERADMIN_GITHUB_USERS remains only as a migration fallback for environments that have not yet configured the ID list. Alternatively, set SUPERADMIN_GITHUB_ORG to allow active members of one GitHub organization.

Set GITHUB_LOGIN_HINT to prefill a suggested GitHub username on the OAuth screen, or pass ?login=username to /auth/github for a one-off hint. This is only a convenience; GitHub still authenticates the actual account and the callback enforces the administrator allow-list.

The OAuth access token is used only during the callback and is never stored. The dashboard session is an opaque, Secure, HttpOnly cookie; only its SHA-256 hash is stored in D1. Apply migrations 0008_create_admin_sessions.sql, 0009_create_dashboard_memberships.sql, 0010_add_dashboard_user_to_sessions.sql, and 0011_create_magic_links.sql to each environment before enabling the dashboard.

The compatibility endpoint /admin/api/metrics is reserved for the dedicated id-admin Worker and requires a matching immutable ID in SUPERADMIN_GITHUB_USER_IDS. Tenant members use /dashboard/api/metrics, which is always scoped to their active membership; they cannot use the compatibility endpoint to obtain aggregate metrics for other tenants.

The /auth/github routes are intentionally shared authentication routes. The current callback authorizes only accounts in the administrator allow-list; a future developer portal can reuse the same identity/session layer with its own role policy and redirect target.