Identity
Sign-in and SSO
Device login for the CLI, OIDC sign-in for the dashboard, SSO group role mapping.
The CLI and the desktop app sign in with a device login. The dashboard signs in with Supabase Auth, and the registry accepts it over OIDC. Role mappings turn SSO groups into principal roles (admin, reader, service).
After a dashboard sign-in, the API can email a new-device notice when it is configured to; the check never blocks the sign-in.