Sign in
Scoping portal
Run engagements, review decision records, and record approvals. Each account belongs to one organization and sees only that organization’s work.
SCOPING_API_URL is not set on this deployment. Deploy the scoping API (root directory scoping/), then set SCOPING_API_URL on the site project. Until then the portal cannot sign anyone in — which is why it says so rather than showing a form that would fail.
How sign-in works
Your password is checked by the engine and exchanged for a session token, which the browser holds only as an httpOnly cookie — not readable from JavaScript, and never present in a page or bundle. Signing out revokes the session on the server, so the token cannot be replayed.
Passwords are stored as salted scrypt hashes and are not recoverable. An administrator issues accounts with the admin CLI, against the same database the API uses:
python -m obligationiq.admin create-user --org org_... \
--username jane --scopes read,write,approveApproving a record needs the approve scope, which is deliberately separate from write. Machine-to-machine integrations use API keys instead of accounts, on the same routes.