Manage

/manage is where managers run a tenant. From it they look after:

• actors, the people and machines that sign in
• clients, the apps that use masks to sign actors in
• organizations, providers, and the tenant’s settings

You sign in to /manage through masks, like any other app. An actor who holds masks:manage or one of the three narrower manage roles can open it. A manager with a narrower role sees the same pages, and a line at the top of each page says what they can change.

Everything /manage does goes through the manage API, so a script can do the same things.

Finding your way

The bar at the top holds Overview, Actors, Organizations, and Clients, and a button that opens Settings. On a phone, the four sections move to a bar at the bottom of the screen. Actors shows a count of the actors waiting for approval or asking for help.

Every page and tab has its own address:

• /manage/clients/abc/access opens the Access tab of the client abc.
• /manage/actors?lens=waiting opens the actors list with the Awaiting approval filter on.
• If you open one of these links while signed out, masks signs you in and then opens the link. In a browser that has never opened /manage, you land on the overview.

Overview

The overview starts with anything that needs a manager:

• actors waiting for approval
• actors who asked for help signing in
• events from the last day that are worth a look, such as a refused sign-in or a blocked device

While a tenant is new, the overview also shows the steps Let masks send email, Register your first client, and Invite someone. Each step goes away once it is done. Hide puts a step away in this browser only.

Below that, the overview shows counts, a chart of sign-ins per day, the server’s health, the first few organizations, and the latest activity. When the operator has turned the release check on, a line at the top says when a newer version of masks is out.

Actors

The actors list marks what needs attention on each actor, such as an invitation not accepted, a suspension, or a blocked device. Filter the list with Everyone, Invited, Awaiting approval, Asking for help, Managers, and Suspended.

• Add actor adds one actor.
• Invite many invites several actors by email address at once, and can put them in groups.

The same page lists Devices. Each device has a page of its own, with its activity. See sessions and devices.

An actor’s page

When something about an actor needs a manager, the top of their page says so and holds the button that settles it, such as Restore, Resend invitation, or Send a confirmation link.

Tab	What it holds
Profile	Their nickname, email address, other profile details, and photo. Suspend or delete.
Access	Their scopes and groups. The IDs a directory gave them. The apps they have let in. Their connected accounts.
Sign-in	Their password, second factors, and passkeys. Where they are signed in. Their tokens.
Activity	Their latest 25 events, with a link to All activity.

Organizations

To add one, choose Add organization. An organization’s page has five tabs: Members, Sign-in, Roles, Activity, and General. See organizations in /manage for what each tab holds.

Clients

To add a client, choose Add client, then pick What kind of client:

• Signs in as itself
• Signs actors in
• Signs actors in over SAML
• A known product, one of the known products

The clients list marks a client that registered itself, and says whether a manager has approved it. Archived clients show only when the Archived switch is on.

A client’s page

Tab	What it holds
General	Its name and how it proves who it is. Its SAML settings, for a SAML client. What actors see about it, such as its logo. Its Sign-in settings, such as its policy and token lifetimes. Archiving it.
Access	Who may sign in, by group or organization role. The scopes it always gets, and the scopes it may ask for.
Endpoints	Its redirect URIs, post-logout redirect URIs, and resources. Its keys. Its authorization details.
Usage	Who has let it in. Its live tokens. Its activity. The namespaces it claimed.

Settings

Tab	What it holds
General	The tenant’s name and branding. How long activity is kept. How long emailed links last. Dynamic registration. Signing keys. Groups, domains, and namespaces.
Policies	The sign-in policies, and rules for the whole tenant: Primary identifier, Default policy, Who may sign in, and Auto-deletion of idle actors.
Providers	The providers and MCP servers that actors sign in or connect with.
Directory	The LDAP server. Provisioning tokens.
Messages	Sending holds the services that send email and text messages. Templates holds the wording of each email.
Activity	Log holds the tenant’s whole activity, which you can filter, narrow to what is worth a look, and export. Streams holds the event streams.

The settings tabs also show who is signed in, with two buttons:

• Sign out signs you out of masks in this browser.
• Forget client drops this browser’s manage client and asks you to approve a new one. The old client stays under Clients until someone archives it.

A provider’s page

To add a provider, choose Add provider. Start from a known provider, such as Google, GitHub, or Okta, or from a blank OpenID Connect, OAuth 2.0, SAML 2.0, or MCP provider.

Tab	What it holds
Setup	Its name. The values to give the provider. Its endpoints and credentials. Archiving it.
Sign-in	The email domains it signs in. Whether it adds the actors it signs in, and whether it trusts their email addresses. Its security events. Where each claim comes from.
Clients	Delegation: whether clients may use an actor’s account there, and what they may do with it.
Connected accounts	Every actor who has connected an account through it.

Not every provider has every tab. An MCP server has no Sign-in tab, and a SAML provider has no Clients tab.

Your changes on a provider’s page wait in a bar at the bottom of the screen. Choose Save to keep them, or Discard to drop them.

Activity

Each event reads as a short label, such as Signed in or Sign-in refused. It shows who did it, which client it was for, and when.

• On the overview, and on an actor’s or organization’s page, the same event repeated in a row shows as one line with a count.
• Hover over an event’s details to see them in full.