OneOS Docs
Genesis 0.1.12 Console

Enterprise

Access and sign-in

People sign in with their One account. Code and agents use organization API keys with explicit scopes. Both act only inside your organization.

People

  • One account is One's account system. People sign in to the Console and to genesis login with it ("Sign in with One").
  • genesis login --device signs in machines without a browser: the person approves a code from any signed-in browser.
  • People in several organizations switch with genesis orgs switch <org_id> or the Console's organization menu.

Roles

  • Owners and admins manage API keys: create, rotate and revoke. A key can carry only scopes the creating person's role holds.
  • Operations that act for a person, such as approving a Blinds consent request or creating a key, need that person's signed-in session; an API key can't perform them.

Keys for code and agents

  • One key per workload or agent, with the fewest scopes it needs. See Scopes.
  • Set an expiry for short-lived work. Revoke a key and it stops working within about a minute.
  • For agents, create the key into Blinds custody (--blinds) and delegate it; nobody sees the raw value.
  • GET /v1/whoami shows exactly what any credential can do.

One Superintelligence, Inc. · Built from Genesis 0.1.12 and the live gateway on 2026-10-20. Support