What this page is for#
The portal is the web application you use to administer TERSL/DB: namespaces, keys, grants, users, the record, logs and billing. This page covers what happens before and around the other pages: signing in, creating an account, two-factor sign-in, the frame every page sits in, and the namespace and key pickers that several pages share. After reading it you can get into the portal and know where each page is.
Who can see it#
The sign-in, sign-up, forgotten-password and two-factor pages are open to anonymous visitors. Everything else needs a signed-in user.
Every signed-in user is either an administrator or a limited user. An administrator can do everything in the account, including adding users and keys. A limited user can use only the keys an administrator gave them and read only the logs they were given; they see the namespaces those keys reach, and the administrator pages are refused to them. An administrator sets each person's role on the Users page.
What is on the page#
The sign-in page#
/account/login shows the Email and Password fields and a Sign in button. Below the form, when the deployment offers external providers, the page says Or sign in with and shows one button per provider, such as Continue with Google. When no provider is configured the section is absent. The page ends with two links: Forgot your password? and Create an account, whose caption reads "Signing up creates a new workspace. To join one that exists, ask an administrator to invite you."
The frame#
Every signed-in page has the same frame. The top bar carries the TERSL/DB name, "Command Center" and, on an account on the Free plan, an Upgrade button that opens the pricing page. While a payment is past due or the account is suspended, a banner at the top of every page says so (see Pricing and billing).
The left menu starts with your organisation, shown as the domain of your email address, and lists the portal's pages in the order below. A limited user's menu leaves out Grants and Users. At the bottom of the menu are your email address, an administrator chip if you are one, a Password link to change your password, and Sign out.
| Menu item | What it is for |
|---|---|
| Namespaces | Create, rename, disable, delete and restore namespaces; usage at a glance |
| Explorer | Send queries and declarations to a namespace as one of your keys |
| History | Read a namespace's record step by step, and start a copy |
| Bulk data | Download a namespace's whole state, or upload a file into it |
| Keys | Issue, label, revoke and delete API keys |
| Grants | Edit what each key may do in a namespace (administrators only) |
| Logs | Read the recent customer log of a namespace |
| Users | Invite people and set what they may use (administrators only) |
| Account | Your plan, usage, two-factor sign-in and connected logins |
Three pages are not in the menu. Copy opens from Copy at… and Copies (n) on a namespace card and from History. As of opens at /asof. The pricing and billing pages, described in Pricing and billing, open from Upgrade in the top bar and from the plan action on the Account page.
The namespace and key pickers#
The Explorer, History, As of, Copy and Bulk data pages act on one namespace through one key, and they share two pickers. Namespace lists the active namespaces you may act in, labelled with the name and the Namespace Id, for example Harbour logs — 74XEEJ5. Key lists the keys you hold that the chosen namespace's grants admit; its caption reads "A key reaches only what this namespace grants it. A key the grants do not name gets an empty 404." Press Open (or Read) to load the page for that pair.
If you choose only a namespace, the page picks a key for you: the one you used there last, the only one available, or the most recently used. The pair you last opened travels with the menu links, so moving from the Explorer to History keeps the same namespace and key. When no pair can be offered, the page says why in one sentence: you hold no key, there is no active namespace yet, or none of your keys is granted in the chosen namespace. An administrator sees a link to the page that fixes it.
The pickers only narrow what is offered. Whether a request is allowed is decided by the service on every request, from the namespace's grants.
Actions#
Sign in with a password#
Type the email address you were invited with and your password, and press Sign in. Any failure gets the same sentence, "That email and password do not match an account that can sign in.", whether the address is unknown, the password is wrong or the account is deactivated. After five failed attempts the account is locked for 15 minutes and the page says "Too many failed attempts. Try again in a few minutes, or reset your password." Resetting the password clears the lockout. A session lasts eight hours.
Sign in with Google or an OIDC provider#
Press the provider's button. After the provider answers, one of three things happens. If an account here already uses that provider, you are signed in. If the provider vouches for an email address that has an account here, the provider is connected to that account, you are signed in, and a notice is emailed to you. If the address has no account, the portal asks you to Name your workspace, then creates a new workspace with you as its first administrator; that account has no password, and you sign in with the provider. The portal accepts a provider's identity only when the provider confirms the email address is verified.
Enter a two-factor code#
If your account uses two-factor sign-in, the next page is Check your email. Type the Code that was emailed to you; it is good for a few minutes and works once. Tick Remember this browser for 30 days to skip the code in this browser for that long. Send a new code sends another. Use a recovery code opens a page where one of your saved recovery codes signs you in instead; each recovery code works once. If an administrator turned on the workspace's two-factor requirement and you have not set it up, the portal sends you to set it up before any other page.
Reset a forgotten password#
Forgot your password? opens Reset your password. Type your Email and press Send me a link. The page gives the same answer whether or not the address has an account. The emailed link opens Set your password, where you type a New password and Password again and press Set password. The link works once; using it also clears a lockout and signs you out everywhere else.
Create an account#
Create an account opens /signup. Type an Email, which becomes your sign-in name, and a Workspace name of 1 to 64 characters, then press Send me a link. The page gives the same answer for every address. Signing up always creates a new workspace on the Free plan with you as its administrator; to join an existing workspace, ask one of its administrators to invite you. If the deployment cannot send email, the page says "Sign-up by email is not available on this deployment yet." and offers any configured external providers instead.
Finish signing up#
The emailed link opens Choose a password (/signup/finish). The password rule is printed above the field. Type the password twice and press Create my workspace. The link expires after 72 hours.
Set a password from an invitation#
An administrator's invitation link opens Set your password, the same page a reset link opens. The link works once and stops working after 72 hours.
Sign out#
Sign out at the bottom of the menu ends this session. To end your other sessions as well, use Sign out of other sessions on the Account page.
Related#
- Keys, grants and visibility explains keys, grants and why a key that is not granted gets an empty 404.
- What TERSL/DB is introduces namespaces and keys.
- Users and Account cover roles, invitations and two-factor settings.