Portal¶

A web-based management interface for the Operator Platform.

The Portal is the web-based interface for developers and operators to interact with OpenOP. It provides a graphical interface for discovering APIs, managing edge applications, creating API clients, managing federation-related capabilities, and interacting with the AI² agent. A FastAPI backend serves the graphical interface, manages authentication through Keycloak, forwards requests to OEG and AI², and stores session and API-client data in PostgreSQL.

What it does¶

• Sign-in and profile: sign users in through Keycloak, show their roles and API access, and show only the pages their roles allow. Users are managed in Keycloak's admin console, as in Manage users and access.
• API catalog: browse the platform's APIs, search them by title or category, and try them in an interactive reference.
• Application management: register application profiles, start instances and multi-zone deployments in edge cloud zones, and follow their status.
• API clients: create, list and delete API clients for developers' applications, limited to the API products the developer holds.
• Federation and AI²: let operators register partner platforms and manage agreements and zone subscriptions, and let users chat with the AI² agent.

How it works¶

Authentication and session management¶

The Portal uses Keycloak as its OIDC identity provider and user authentication is handled by the backend through the backend-for-frontend (BFF) pattern. When a user accesses the Portal, the backend initiates the OIDC authorization flow and redirects the browser to Keycloak. After successful authentication, Keycloak redirects the browser to the backend, which validates the authentication response and establishes a Portal session.

The backend stores the session and authentication tokens in PostgreSQL in encrypted form. The browser receives only a session cookie and does not directly access or store the user's access or refresh tokens. The backend uses these tokens when communicating with protected platform APIs on behalf of the authenticated user. The backend also handles token refresh and session expiration. When a user logs out, the Portal session is terminated and the user is redirected through Keycloak's logout flow.

With login turned off, as in the Quickstart, there is no Keycloak: every request acts as one local user, dev, with every role and API product.

API client management¶

In addition to authenticating human users, Keycloak manages the credentials used by developers' applications to access OEG APIs. Through the Portal, a developer can create an API client by providing a name and selecting the API products the application is allowed to access. The backend validates the requested permissions against the developer's current permissions in Keycloak before creating the client.

Each API client has a client ID and client secret. Keycloak manages these credentials and issues access tokens using the client credentials grant. Applications use these tokens to authenticate requests to OEG by including them in the HTTP Authorization: Bearer header.

The Portal database stores API-client ownership and approved product entitlements, while Keycloak manages the client credentials and associated roles and scopes. The client secret is returned to the developer only when the client is created; it is not stored in the Portal database. The backend also manages API-client lifecycle operations, including listing and deleting clients, while enforcing ownership and permission checks.

Read in the specs¶

Code and deployment¶