Admin console sign-in

Admin login is deliberately separated from the parent, teacher, and student application. Open the Admin console URL supplied by the platform team, normally https://admin.keybaki.com/login.

Sign-in methods

• Use an enrolled passkey, or
• use the email and password armed for your Admin account.

Admin accounts cannot self-register. The Admin console still enforces the configured TOTP policy after the first factor succeeds.

Why it is separate

• The public role picker contains only parent, teacher, school, and student choices.
• Admin authentication uses a host-only cookie that is not shared with the learning application.
• Every Admin response is marked noindex, nofollow, and robots.txt disallows crawling the whole host.
• Role, Admin-tier, and TOTP checks are enforced before protected routes render.

Provisioning a new admin

New admin accounts can't self-sign-up. An existing super-admin:

1. Opens Admin → Users.
2. Searches for the existing user (or creates a new one).
3. Tap Change role → admin. Audit row is written.
4. The new Admin arms a password or passkey and signs in through the Admin console.

Common issues

• A learning-app bookmark opens the Admin console. Legacy /admin/* URLs redirect to the Admin subdomain and preserve the destination.
• A passkey is not accepted after migration. Confirm that WEBAUTHN_RP_ID and WEBAUTHN_ORIGINS include the Admin host, or use the password path while the credential is re-enrolled.