Accounts
An Account is the top-level AIGW tenant. It holds Projects and account-level configuration such as identity providers, team membership, events, end users, billing, and API keys.
Create an Account
On first sign-in, the console shows the Account selector. Choose Create Account, enter a name, and create it.
Account home
After selecting an Account, the home page summarizes activity for the last 30 days — Agent sessions, Discoveries (completed/failed), Possession checks (passed/failed), and Consent accepted (with rejected count) — followed by Recent activity and shortcuts to the account areas.
The account sidebar contains:
| Item | What it is for |
|---|---|
| Home | Activity summary and shortcuts |
| Project Management | Create and open Projects |
| IdP Management | Manage built-in availability and account-owned identity providers |
| Team | Invite and manage account members |
| Events | Event log across every Project (time, event type such as aigw.consent.accepted, message, Project, user) |
| End Users | People your agents have acted on behalf of, across every Project |
| Billing | Plan, payment method, and invoices |
| Settings → API Management | Create and manage account API keys |
Account ownership
Choose the account owner based on who operates the integration:
- merchant-operated MCP/UCP → merchant normally owns the Account;
- third-party MCP/UCP → provider normally owns the Account and creates merchant Resources under Projects it operates.
Team roles
Account roles are Owner, Admin, Developer, and Viewer. The creator is Owner. Invitations are issued from Team → Invite member using a single-use invite link; Owner is not offered as an invite role. Pending invitations are listed separately until accepted or expired.
For existing members, the Owner can Transfer ownership to another member or Remove them.
API Management
Only the Account Owner can create API keys under Settings → API Management to connect apps and scripts to the Account. The page tracks Total, Active, Expiring soon, Expired, and Revoked keys. Use search and the Status filter to find keys. Treat API keys like any other server-side secret.
Identity providers are enabled at the Account level, then selected per Resource.
Management API credentials
Console-issued API keys are separate from dashboard sessions and Proxy clients. The management API is available at https://api.aigw.loginid.ai/v1, using permissions such as project:read and project:write. In Create API key, these permissions are labeled PROJECT_READ and PROJECT_WRITE. DevCLI, the aigw command-line tool, uses these credentials to manage your Account.
GET /v1/projects
Authorization: <CONSOLE_API_KEY>
This header carries the raw API key, without a Bearer prefix. User OAuth tokens and Proxy bearers are not management API keys.
End-user identity data
AIGW keeps encrypted end-user identity snapshots per Account and can expose masked data to authorized Owners/Admins. Revealing or erasing data requires an explicit reason and is audited; ordinary project access is not permission to reveal personal data. Use Events and the PII-access history for investigation rather than copying identity payloads into logs.