seal

Using Seal

Markdown

The console

A tour of console.seal.zone: workspaces, tenants, apps, changes, telemetry and notifications.

The console is a convenience, not an authority. It can't sign a change to your tenant and never holds your secrets.

Accounts and roles#

Sign in with an email link or GitHub. A workspace groups people and tenants. Invite people from Members.

Member
CanSee tenants, read telemetry, propose changes
Manager
CanAlso create tenants, manage members, start or stop Seal's replica, read the activity log
Owner
CanAlso change roles and close a tenant

Roles gate the console only. No role can sign a tenant change. That takes an admin key.

Approve seal login here after checking that its code matches your terminal. Account lists every session and can end any of them.

Creating a tenant#

Owners and managers create tenants from Tenants:

  1. Pick a permanent id: lowercase letters, digits and dashes, up to 32.
  2. Create your first admin key, a passkey or a key file.
  3. Choose who runs the enclave and how long risky changes wait. Then sign.

Add a backup admin key early. If you lose your only one, nobody can change the tenant again.

The tenant pages#

Overview
What it's forThe last 7 days of activity, pending changes, Seal's replica
Connect
What it's forEnv vars, the seal command and code for your app
Seal a secret
What it's forSeal in the browser, or copy the terminal command
Apps
What it's forWho may use your secrets, as which identity, from where. See Apps and identities
Deployments
What it's forSeal's replica and your own. See Where the enclave runs
App Integrity
What it's forAllowed app builds. The rest is a private preview
Changes
What it's forEvery signed change, pending or in force. Any admin can cancel a pending one
Admin keys
What it's forSigners, threshold and pending window
Tenant keys
What it's forKey versions. See Rotating and revoking
Telemetry
What it's forWhat your apps did, verified in your browser
Usage
What it's forThe last 30 days of requests, secrets and sessions
Settings
What it's forNotifications, telemetry readers, freshness signers, closing the tenant

Each page header has a chip. Verified means your browser checked the page against the transparency log. Partly verified shows which part on hover. Not verified is the console's word.

Signing changes#

Your browser applies your edit locally, and you sign with your passkey. Narrows access applies at once. Widens access waits out the pending window. Changes needing more signatures wait on Changes.

A passkey signs a hash, so a compromised page could get a different change signed. That's what the pending window is for. Any admin can cancel a widening change while it waits in public.

Sealing in the browser#

Seal a secret is the only page that takes a secret. Seal serves its code, so a compromised console could read what you type. Use it for test keys, and the seal secret command on its From your terminal tab for real ones.

Telemetry and notifications#

Telemetry shows the enclave's signed record, checked batch by batch in your browser. Totals at the top are the console's count until you press Verify.

Members get emails about changes, integrity events and telemetry gaps. Emails aren't verified, so watch independently with seal changes --watch.