Account Management & Developer Console

Ternis Auth provides a comprehensive self-service Account Management Center hosted across account.ternis.org (Community & Developers) and account.ternis.net (Enterprise Customers).

The portal empowers users and developers to manage their credentials, security settings, team memberships, authorized applications, and developer OAuth apps.

1. User Profile & Credentials #

Users can access the profile center at /account/profile:

• Identity Information: Full name, username handle (preferred_username), and company affiliation.
• Email Verification: Primary email address management and re-verification triggers.
• Password Security: Cryptographically salted password updates with minimum complexity enforcement.
• Two-Factor Authentication (2FA): Time-based One-Time Password (TOTP) authenticators (Google Authenticator, 1Password, Authy).

2. Developer OAuth Applications Console #

Developers can register and manage OAuth clients at /account/oauth-apps:

┌─────────────────────────────────────────────────────────────┐
│                 Registered OAuth Applications               │
├─────────────────────────────────────────────────────────────┤
│ • My Hosted SaaS Platform                                  │
│   Client ID: 9dc6e84a-714c-4e89-9a29-bc828cf99874          │
│   Type: Confidential (Backend Web App)                      │
│   Redirect URIs: https://app.example.com/auth/callback      │
│   [ Rotate Secret ]   [ Edit Redirects ]   [ Revoke ]       │
└─────────────────────────────────────────────────────────────┘

Creating an OAuth Application #

1. Click "Register New OAuth Client".
2. Provide an Application Name (e.g. Acme Analytics Hub).
3. Select Client Type:
   • Confidential Client: Backends (Node.js, Python, PHP, Ruby, Go) that securely store a client secret.
   • Public Client: SPAs (React, Vue) or native mobile apps (iOS, Android) using PKCE without a secret.
4. Specify Allowed Redirect URIs (e.g. https://app.example.com/callback).
5. Upon creation, copy the generated client_secret immediately. It is encrypted in the database and never shown again.

3. Authorized Third-Party Applications #

Users maintain full sovereignty over their data at /account/authorized-apps:

• Active Authorizations: Lists all third-party services currently holding access to your profile.
• Scope Disclosures: View exactly what permissions (e.g. email, profile, ternis:customer) each application possesses.
• Instant Revocation: Clicking "Revoke Access" immediately invalidates all active access and refresh tokens for that client application.

4. Single Sign-On (SSO) Audit Telemetry #

For compliance and personal security auditing, the Account Portal logs every authentication event in the sso_audit_logs table:

• Timestamp: Date and time of authentication.
• Originating Domain: e.g. auth.ternis.net, auth.thosted.de.
• Client Application: The specific OAuth application used.
• IP Address & User Agent: Device type, browser, and geographic IP location.
• Authentication Result: Success, failed password, or 2FA challenge.

Users can inspect their audit log at any time and click "Terminate All Other Sessions" to log out of all devices globally.