NeuralStacks

Control Plane

Two doors, one sign-in. Platform owners manage tenants (Keycloak Organizations) and per-product licenses; tenant owners and admins manage their own organization's members and product roles — and only ever their own. Sign-in goes through the NeuralStacks central SSO — the Next.js server is the confidential OIDC client (authorization code + PKCE S256); tokens never reach the browser.

SSO unavailable? Break-glass access (owners only)