---
title: Account Management & Developer Console
category: Account Management
order: 11
badge: User Portal
description: Guide to the self-service Account Center, developer OAuth client provisioning, and security management.
---

# Account Management & Developer Console

Ternis Auth provides a comprehensive self-service **Account Management Center** hosted across **`account.ternis.org`** (Community & Developers) and **`account.ternis.net`** (Enterprise Customers).

The portal empowers users and developers to manage their credentials, security settings, team memberships, authorized applications, and developer OAuth apps.

---

## 1. User Profile & Credentials

Users can access the profile center at `/account/profile`:

- **Identity Information**: Full name, username handle (`preferred_username`), and company affiliation.
- **Email Verification**: Primary email address management and re-verification triggers.
- **Password Security**: Cryptographically salted password updates with minimum complexity enforcement.
- **Two-Factor Authentication (2FA)**: Time-based One-Time Password (TOTP) authenticators (Google Authenticator, 1Password, Authy).

---

## 2. Developer OAuth Applications Console

Developers can register and manage OAuth clients at `/account/oauth-apps`:

```
┌─────────────────────────────────────────────────────────────┐
│                 Registered OAuth Applications               │
├─────────────────────────────────────────────────────────────┤
│ • My Hosted SaaS Platform                                  │
│   Client ID: 9dc6e84a-714c-4e89-9a29-bc828cf99874          │
│   Type: Confidential (Backend Web App)                      │
│   Redirect URIs: https://app.example.com/auth/callback      │
│   [ Rotate Secret ]   [ Edit Redirects ]   [ Revoke ]       │
└─────────────────────────────────────────────────────────────┘
```

### Creating an OAuth Application
1. Click **"Register New OAuth Client"**.
2. Provide an Application Name (e.g. `Acme Analytics Hub`).
3. Select Client Type:
   - **Confidential Client**: Backends (Node.js, Python, PHP, Ruby, Go) that securely store a client secret.
   - **Public Client**: SPAs (React, Vue) or native mobile apps (iOS, Android) using PKCE without a secret.
4. Specify Allowed Redirect URIs (e.g. `https://app.example.com/callback`).
5. Upon creation, copy the generated `client_secret` immediately. It is encrypted in the database and never shown again.

---

## 3. Authorized Third-Party Applications

Users maintain full sovereignty over their data at `/account/authorized-apps`:

- **Active Authorizations**: Lists all third-party services currently holding access to your profile.
- **Scope Disclosures**: View exactly what permissions (e.g. `email`, `profile`, `ternis:customer`) each application possesses.
- **Instant Revocation**: Clicking "Revoke Access" immediately invalidates all active access and refresh tokens for that client application.

---

## 4. Single Sign-On (SSO) Audit Telemetry

For compliance and personal security auditing, the Account Portal logs every authentication event in the `sso_audit_logs` table:

- **Timestamp**: Date and time of authentication.
- **Originating Domain**: e.g. `auth.ternis.net`, `auth.thosted.de`.
- **Client Application**: The specific OAuth application used.
- **IP Address & User Agent**: Device type, browser, and geographic IP location.
- **Authentication Result**: Success, failed password, or 2FA challenge.

Users can inspect their audit log at any time and click **"Terminate All Other Sessions"** to log out of all devices globally.