Required for public launch. Users verify first; sessions are issued only after code verification.
Sign in, register, and enter the operating platform.
Enter with email code, Google, GitHub, or a limited token fallback. After access, SkillHub routes each user into role-aware developer, publisher, and admin workspaces.
Provider buttons become live redirects only when callback, client id, secret, and state secret are configured.
Reserved for bootstrap, invitations, and recovery. Normal users should use email or configured OAuth.
Browser sessions are scoped to one user and organization; raw tokens stay hidden after first reveal.
Profile, connected identities, session fingerprints, roles, and workspace readiness.
Developerdeveloper / ownerProjects, installs, API keys, policies, runtime tests, billing, team, and webhooks.
Publisherpublisher / ownerUpload, review repair, pricing blockers, buyer demand, feedback, revenue, and payout readiness.
Adminreviewer / finance / adminLaunch readiness, review queues, trust reports, incidents, ledger, payouts, delivery, and audit.
Platform operators use this same login page first, then open /admin with reviewer, finance, support, admin, or super_admin access.
Where the backend lives.
Choose the right workspace before operating projects, publishing, money states, or admin queues.
/login -> /accountSign in, verify email access, inspect connected identities, session fingerprints, roles, and workspace readiness.
/developerCreate projects, manage installed skills, runtime keys, policies, tests, buyer requests, billing, team, and webhooks.
/publisherUpload skills, manage review repair, pricing blockers, buyer demand, feedback, revenue, payout readiness, and notifications.
/adminOperate review queues, launch readiness, identity directory, trust reports, incidents, ledger, payouts, and delivery outbox.
SkillHub supports the account paths real teams expect: email code access, Google login, GitHub login, and token fallback for operators or invitations.
Configure Google client id, client secret, callback base URL, and OAuth state secret before enabling the live redirect.
SKILLHUB_GOOGLE_CLIENT_IDSKILLHUB_GOOGLE_CLIENT_SECRETSKILLHUB_AUTH_CALLBACK_BASE_URLConfigure GitHub client id, client secret, callback base URL, and OAuth state secret before enabling the live redirect.
SKILLHUB_GITHUB_CLIENT_IDSKILLHUB_GITHUB_CLIENT_SECRETSKILLHUB_AUTH_CALLBACK_BASE_URLEmail verification code access is live for workspace signup and existing-user login. Provider delivery can be connected without changing the account model.
Use email codeUser access tokens remain the operator and team-invite fallback until OAuth/passwordless sessions are connected.
Use token fallbackUse email verification for normal workspace access. SkillHub queues the email delivery event now; token fallback stays available for team invites and operators.
Use a token created by an invite or the team console. SkillHub stores it in an httpOnly browser cookie for this app.