# The console

A tour of console.seal.zone: workspaces, tenants, apps, changes, telemetry and notifications.

Source: https://seal.zone/docs/console

The console is a convenience, not an authority. It can't sign a change to your tenant and never holds your secrets.

## Accounts and roles

Sign in with an email link or GitHub. A workspace groups people and tenants. Invite people from **Members**.

| Role | Can |
| --- | --- |
| Member | See tenants, read telemetry, propose changes |
| Manager | Also create tenants, manage members, start or stop Seal's replica, read the activity log |
| Owner | Also change roles and close a tenant |

Roles gate the console only. No role can sign a tenant change. That takes an [admin key](https://seal.zone/docs/changes).

Approve `seal login` here after checking that its code matches your terminal. **Account** lists every session and can end any of them.

## Creating a tenant

Owners and managers create tenants from **Tenants**:

1. Pick a permanent id: lowercase letters, digits and dashes, up to 32.
2. Create your first admin key, a passkey or a key file.
3. Choose who runs the enclave and how long risky changes wait. Then sign.

Add a backup admin key early. If you lose your only one, nobody can change the tenant again.

## The tenant pages

| Page | What it's for |
| --- | --- |
| **Overview** | The last 7 days of activity, pending changes, Seal's replica |
| **Connect** | Env vars, the seal command and code for your app |
| **Seal a secret** | Seal in the browser, or copy the terminal command |
| **Apps** | Who may use your secrets, as which identity, from where. See [Apps and identities](https://seal.zone/docs/apps) |
| **Deployments** | Seal's replica and your own. See [Where the enclave runs](https://seal.zone/docs/hosting) |
| **App Integrity** | Allowed app builds. The rest is a private preview |
| **Changes** | Every signed change, pending or in force. Any admin can cancel a pending one |
| **Admin keys** | Signers, threshold and pending window |
| **Tenant keys** | Key versions. See [Rotating and revoking](https://seal.zone/docs/revoking) |
| **Telemetry** | What your apps did, verified in your browser |
| **Usage** | The last 30 days of requests, secrets and sessions |
| **Settings** | Notifications, telemetry readers, freshness signers, closing the tenant |

Each page header has a chip. **Verified** means your browser checked the page against the transparency log. **Partly verified** shows which part on hover. **Not verified** is the console's word.

## Signing changes

Your browser applies your edit locally, and you sign with your passkey. **Narrows access** applies at once. **Widens access** waits out the pending window. Changes needing more signatures wait on **Changes**.

A passkey signs a hash, so a compromised page could get a different change signed. That's what the pending window is for. Any admin can cancel a widening change while it waits in public.

## Sealing in the browser

**Seal a secret** is the only page that takes a secret. Seal serves its code, so a compromised console could read what you type. Use it for test keys, and the `seal secret` command on its **From your terminal** tab for real ones.

## Telemetry and notifications

**Telemetry** shows the enclave's [signed record](https://seal.zone/docs/telemetry), checked batch by batch in your browser. Totals at the top are the console's count until you press **Verify**.

Members get emails about changes, integrity events and telemetry gaps. Emails aren't verified, so watch independently with `seal changes --watch`.