Console

Authentication

Sign in to the Console with your UPGREAT Identity account. The control-plane API is then called on your behalf with a short-lived bearer token.

Signing in

Sign in to the Console at app.upgreat.ai with your UPGREAT Identity account. Your session is managed for you and stays signed in until it expires.

Two-factor authentication

Set up 2FA under Settings → Security for stronger account protection.

Calling the API

Requests to api.upgreat.ai are authorized with a bearer token issued by UPGREAT Identity when you sign in, sent in the Authorization header. The token identifies you and carries the roles and policies that decide what you may do.

Programmatic access

To call api.upgreat.ai from your own scripts or services, create a service account under Access → Service accounts and exchange its credential for a token with the OAuth2 client_credentials grant. Never embed your personal session token in automation.

The whole flow is two requests — exchange the service account's credential for a token, then call the API with it:

Authorized request

# 1. Exchange the credential for a short-lived access token (~5 min)
TOKEN=$(curl -s -X POST \
  https://identity.upgreat.io/realms/customers/protocol/openid-connect/token \
  -d grant_type=client_credentials \
  -d client_id="$UPGREAT_CLIENT_ID" \
  -d client_secret="$UPGREAT_CLIENT_SECRET" | jq -r .access_token)

# 2. Call the API with it
curl -s https://api.upgreat.ai/v1/orgs \
  -H "Authorization: Bearer $TOKEN"

GET /v1/orgs lists the organizations the caller belongs to — a good first call to confirm a token works. The service accounts guide has the full walkthrough: Python and JavaScript examples, scoping, rotation and troubleshooting.

Three different credentials

The control-plane API (api.upgreat.ai) accepts your UPGREAT Identity session token — or, for automation, a service account token. The LLM inference API (llm.upgreat.ai) uses a project inference key. They are not interchangeable.

Permissions

Access is enforced server-side from your role and any IAM policies attached to you. A call you are not allowed to make returns 403 Forbidden. See Members & roles and Policies for how access is granted.