Sovereign Portals

Keys stay in your browser; the server holds only revocable grants; files are end-to-end encrypted. self-test…

Sign in

Your passkey / security key (YubiKey, Nitrokey, Touch ID, Windows Hello) is the way in. The tokens below are only for the first time or for recovery.

First time here, or recovering access?

Owner — admin token (from your .env; sign in once, then register a passkey)

Delegate — token (the one-time token the owner gave you; register a passkey after)

Connections

Delegates

People who run portals sign in with their token and see only the Portals view — never your credentials. Use a delegate's Grant button to choose which connections they may use; Reset link to reissue a login link; Impersonate to see their view.

New connector

Your key is used here only to mint two revocable stored-access-policy grants (write + read) and is never sent to the server.

One-time per storage account: allow this app's origin in its CORS so the browser can talk to Azure directly —
az storage cors add --services b --methods GET PUT OPTIONS HEAD POST --origins this origin --allowed-headers '*' --exposed-headers '*' --max-age 3600 --account-name <account> --account-key <key>

Account

Container

Grant lifetime (days)

Alias (display name shown everywhere; defaults to account/container) Account key (paste once; leave blank to use your unlocked vault) Vault passphrase (encrypts the key in this browser so you don't re-paste it)

—

Renew grants

Extend the Azure stored-access-policy for so existing portal links keep working. Signed in your browser with your master key — from your unlocked vault, or paste it once.

Extend by (days) Vault passphrase (to unlock your saved key) …or paste the account key (if it isn't in your vault)

—

New portal

You never see the cloud key — only the scoped grant the admin issued to you. People upload into the portal; only you can read the files (100-file limit).

Connection

Your identity passphrase (encrypts your identity key in this browser so uploads come only to you)

—

Settings

Require a passkey for everyday login (tokens then only bootstrap or recover a key).

Clears this browser's identity. Owners: export your key first, or you'll need the admin token to get back in.

Activity log

Sovereign Portals

Sign in

Connections

Delegates

New delegate

New connector

Renew grants

Grant connections to

My portals

New portal

Settings