Admin guides

These are for the administrator — the person in the console who connects an identity provider, invites the team, registers apps, wires up an agent and answers to an auditor. Building against Cbox ID lives in the framework docs that ship with cboxdk/laravel-id, and deploying the platform lives under operations.

Each guide is the long form of the "?" beside a page title in the console. The console explains itself in two or three sentences; when that is not enough, the "Read the guide" link lands here. The link text below is the console's own name for the page.

If you are a customer's IT admin who was sent a setup link, you want For your customers' IT admins instead.

People and access

• Members — invite the team, send them back to your app, hand ownership over.
• Roles — decide who can do what, including the Admins & support roles held across an environment.
• Permissions — what a role is made of, written here rather than in each app.
• Access reviews — certify who still needs what.
• Role conflicts — roles that must never be combined.
• Support access — signing in to one of your apps as one of its users, for a reason and at most an hour.

Sign-in

• Enterprise SSO — people sign in with the company account they already have, and the email Domains that route them there.
• Directory Sync — the company's directory creates and deactivates people for you, over SCIM.
• Admin Portal — hand Enterprise SSO, Directory Sync, Domains, Log streams and more to the customer's own IT admin with a single-use link.
• Social login — Google, GitHub, Apple and the rest, and how connecting one to an existing account works.
• Outbound provisioning — push your people into your other SaaS products.
• Custom domains — serve an environment's sign-in on your own address, such as login.example.com.
• Languages — which language sign-in, consent, the Admin Portal and their emails are shown in.

Building on an environment

• Applications — register the apps people sign in to.
• APIs — the services your apps call, and which app may be given which of their scopes.
• API keys — Secret, Workspace and Publishable keys, for your own code.
• My API keys and Member API keys — keys people create for your apps' APIs, and how admins see and revoke them.
• Webhooks — get told when something happens.
• Hooks — have a say while it happens.
• Token vault — credentials your apps use elsewhere.

Agents

• Agents and MCP — connect Claude Code, Cursor or another MCP client to an environment or your whole workspace.
• Step-up approvals — make a key's dangerous calls wait for a person, and how an agent retries once approved.
• Approvals — approving a request to act as you, and reviewing every pending request in an environment.
• Trusted devices — a phone as the authenticator that answers those approvals.

The record

• Audit log — Cbox ID's own tamper-evident record of every change.
• App audit logs — your app's own audit events, per customer: send, validate, retain, export, and let each customer read theirs.
• Log streams — mirror the Audit log into your SIEM as it is written.

Getting a new organization running

A sensible order, the first time:

1. Roles, then Members.
2. Applications — the first app people will sign in to.
3. Enterprise SSO and Directory Sync, or an Admin Portal link so the customer's IT admin does both.
4. Log streams, if a security team wants the trail in its own tools.