Sign in to the surfaces

There are two sign-in paths in the estate, and which one you use depends on the surface, not on you. Studio and console use Pocket ID passkeys. The consumer surface on acumen uses an invite token and a recovery code. The concepts behind both are in Identity and access.

Studio or console (passkey)

Prerequisites:

• An account at the identity provider (auth.tcp.systems). Accounts are operator-provisioned; there is no self-registration.
• A registered passkey on the device you are holding. On first use an operator registers one with you.

Steps:

1. Open the surface (https://studio.tcp.systems or the console host).
2. Follow the sign-in redirect to the identity provider.
3. Approve the passkey prompt from your browser or device.

Expected outcome: the provider redirects you back and the surface opens your workspace. Studio itself is not live until restoration (owner update 2026-11-05); the console is the surface to expect this flow on. The owner passkey login against studio is a 2026-11-02 historical observation, not current availability.

When it fails:

What you see	What it means	Next action
the provider reports an unknown client	the surface is not registered for this realm	tell the operator which surface and which URL you opened
the passkey prompt never appears, or is rejected	no credential for this origin, or the assertion was rejected	check the browser origin matches the surface host exactly, then ask the operator to re-register the passkey
the redirect returns but the session is expired	the surface session ended	sign in again; nothing is lost

Consumer surface (invite and recovery code)

Prerequisites:

• An invite URL from an operator (https://<host>/i/{token}). It is a credential: it is printed once, and an unknown, expired or used token answers 410 without saying which.
• A recovery code you choose on acceptance. There is no password reset by email; the recovery code is the way back in.

Steps:

1. Open the invite URL.
2. Set a recovery code and a display name, and accept the invite.
3. Sign in afterwards at /signin with the email and the recovery code.
4. From /app, create a virtual key for API use. Its plaintext is shown once.

Expected outcome: an acumen_session cookie, a first session grant, and access to /app and /account. The full page-by-page walk is in Onboarding.

When it fails:

What you see	What it means	Next action
410 on the invite link	the token is unknown, expired or already used	ask the operator for a fresh invite
sign-in refuses the recovery code	wrong email or wrong code	re-check both; there is no reset path, so a lost code means a new account
/app will not load after sign-in	the session is gone or the account is frozen	sign in again; if the account page reports a freeze, contact the operator

Signing out

Use the surface’s own sign-out (/signout on the consumer surface, the session teardown on studio and console). Signing out clears the local session only: your passkey stays registered, and a fresh sign-in is seconds. Revoking a passkey or a device is an operator action on the provider.

Operators: provisioning a sign-in

If you are the operator on the other side of this page, the boundary and the client registration steps are on the auth surface page. The deep runbooks live in the tcpsystems/auth repository (docs/CONSOLE-OIDC-LIVE.md for the live Pocket ID path); this site summarises rather than replaces them.