Admin Security
Sign-in
The admin panel signs in with email + password (no phone-number login). Phone numbers are intentionally excluded from privileged accounts because of SIM-swap and carrier-side intercept risk.
Endpoint:
POST /auth/admin/signinRole gate: SUPER_ADMIN, ADMIN, MANAGER (enforced server-side; non-admin emails get the same opaque "Invalid credentials" response)
TapSign step-up
Hardware-backed approval for sensitive actions. Each tap produces a one-shot signed receipt that the backend consumes server-side — no long-lived secret leaves the device.
Passkey (WebAuthn)
Phishing-resistant hardware key for this admin account. Required to operate the TapSign Master Switch.
Password login
Enroll a passkey first, then you can disable password login.
Operations protected with TapSign
Pick which actions require a fresh TapSign tap. Enrolled accounts approve each policy change in TapSign Native before it is saved.
These toggles map 1:1 onto the per-user TapSignProtectionPolicy on the backend. The same record is consulted by the PaymentApprovalGuard on every protected route, so changes here apply to every privileged action this admin can take across the API.