id


Panel and API	`https://id.xvii.network` (`/api/v1`)
OIDC	discovery at `/.well-known/openid-configuration`, keys at `/.well-known/jwks.json`
CLI	`xvii login`, `whoami`, `teams`, `projects`, `tokens`

What it does

Passkeys: sign-in without passwords; one passkey works for the whole instance. Sign-in links for onboarding and recovery; browser sessions listed per device; CLI sign-ins approved in the browser.
Teams with roles (viewer, developer, admin, owner), invitations by name or e-mail, invitation links for people without accounts, and a personal team for everyone.
Projects with environments (production, preview, more), protected environments, repository links.
API tokens (xv_…) with a scope (read, deploy, write), optionally narrowed to services, a project and a lifetime.
Trust rules let CI jobs (GitLab id_tokens, GitHub Actions, any OIDC issuer) trade their own token for a short-lived one: repository, branch patterns, protected refs only, scope, lifetime.
Plans and limits: bundles of limits for teams, overrides, caps per project; every service's usage on one tab. See People, teams and limits.
OIDC provider: authorization code with PKCE for panels, device flow for the CLI, client credentials for services, token exchange for CI, rotating refresh tokens, introspection.
Journal: every change with team and IP; superusers see everything.