Reference for what's actually built in this Organization's OneHux Accounts instance — real endpoints, real field names, real limitations. Nothing here describes a feature that doesn't exist yet.
01
Organizations & Applications
Creating an Organization, registering an Application, and the public application launcher.
02
Sign-in methods
Password, magic link, email OTP, Google, and passkeys — the real OAuth 2.0 + PKCE flow behind each.
03
Security
MFA, the device/location step-up gate, bot protection, and login rate limiting.
04
Roles & permissions
Global vs. Application-scoped Permissions, and how access_policy gates an Application.
05
Sessions
What a Session actually is, real-time revocation push, and what revoking one really does.
06
API keys
Real service-account credentials, scoped to a real Permission subset, rate-limited.
07
Profile & passkeys
Self-service identity fields, real avatar upload, and managing your own passkeys.
08
Webhooks
Real signed HTTPS delivery to your own registered endpoint, with retry and a verifiable signature.
09
Audit log
Every real event type this Organization's log records, and how to filter it.
10
Billing & plans
Real usage tracking, the overage rule, and the real Paystack upgrade/cancellation flow.
11
Settings & branding
Custom domain, white-label branding, and the Danger zone — deactivating or deleting your Organization.
12
Inviting members
The real PENDING → ACTIVE invite flow, not an immediately-active account.
13
Portal signup
How a brand-new Organization gets created, and what auto-join to onehux actually grants.
Wiring your own app to this platform as an OAuth 2.0 + PKCE client — real code, against this platform's real endpoint shapes.