Application administration

Open the panel

Open Applications admin. Sign in with an authorized Not Organic account. No administrator is assigned by default.

When ready, an operator sets the comma-separated DID allowlist NOTORGANIC_ADMIN_DIDS on the Convex deployment. Assign only verified account DIDs. The client cannot grant itself access; the server checks the allowlist on every admin operation. No password or shared admin token is collected in the panel.

Review an application

1. Filter by status or search the loaded applications. Use Load more for additional pages.
2. Select an app to inspect its owner, website, callback, contact and intended use.
3. Verify control of the origin and discuss data use and services with the applicant.
4. Write a note explaining the decision and next steps. The applicant can read it.
5. Approve the review, decline the application or return it to review. Every panel decision records the operator, time and note. A stale review is rejected rather than overwriting someone else’s work.

Configure launch separately

Approval records a review; it does not provision production access. Configure the approved origin in PUBLIC_CLIENT_PRODUCT_CATALOG and CORS_ALLOWED_ORIGINS, preserving existing mappings. External apps normally use the notorganic product scope. Configure requested model routing, billing, workspace and training services separately, then verify an applicant-approved sign-in and API call.

Recording a rejection does not remove an existing deployed origin mapping. To suspend access, remove that mapping and check refresh behavior. Already-issued access tokens can remain valid for up to five minutes. Do not describe a review decision as a completed deployment or access revocation.

Safe starting state

The panel is deployed without assigning an admin identity. Unauthenticated requests return 401; signed-in accounts without admin access receive 403. The public developer MCP cannot access the queue or change a review.