OIDC clients (“Sign in with Tenka”) are administered from the terminal / Claude Code — there is no GUI by design.
List & revoke clients and manage the login-domain allowlist with uv run python oidc_admin.py
(try clients, domains, allow <domain>). Runbook: docs/runbooks/oidc-client-admin.md.
Platform host SSH firewall
This is the dashboard/platform host itself (89.167.29.128 + EUauthSRV) — not a
customer server, so it isn't in the server list. Its :22 is locked to this allowlist on
Hetzner firewall firewall-1. :80/:443 stay open and the web terminal works regardless.
Off-office IPs expire and are removed automatically.
Platform host SSH keys
Install your public key into the platform host's rootauthorized_keys so you can
SSH in (ssh root@89.167.29.128). You'll still need an allowed IP above. Keys go in a managed block;
the host's existing key is left untouched. Temporary keys auto-expire.
Platform secrets /etc/tenka-cloud.env
Rotate a platform secret without SSH. Values are never shown here — this file holds the
Hetzner token, the Stripe key and the session-signing key, so a readable panel would make a stolen
admin cookie as good as root. You can write a new value; you can't read the old one.
Every change needs a tap on your approver, then the service restarts and rolls back automatically
if it doesn't come back healthy.
Loading…
Platform host self-test
Passive functional health + security posture of the platform host itself (service, DBs, nginx, cert,
firewall, TLS/headers, sshd, OS updates). Also runs daily at 06:30 in the security digest.
Not run yet this session.
File uploads
Drop files here or browse images, docs, text/code, archives · max 25 MB
Reports
Templates — Word .docx using {{ placeholder }} fields
Drop a .docx template or browse admin-only · max 20 MB
Generate a report
Generated reports
Users
Name
Email
Role
AI Credit
Status
Last login
All Servers
Subdomain
User
Provider
State
IP
Created
Usage per User
Name
Email
Hours
Records
Total Cost
GuardDuty Findings
Severity
Type
Title
Region
Time
Errors
When
Type
Where
Message
Account
API keys
Use an API key to let external tools (e.g. a ChatGPT Action) manage your servers and
send prompts to the Claude agent on them. A key carries your full account access — treat
it like a password. The full key is shown only once, when created.
Connect from ChatGPT, Claude, Cursor & more (MCP)
Add Tenka as an MCP server in your AI client to list your servers and send prompts to the
Claude agent running on them — you'll only ever see your own servers. Use the URL below and paste
a key (created here) as the bearer token in your client's MCP settings.
https://dashboard.tenka.cloud/mcp
Your keys
Name
Key
Created
Last used
Security
Pair an approver device to sign in by matching a number — no password. When you
log in, a number appears on screen and you tap the matching one on your device.
Tip: pair this on a different device than the one you sign in from (ideally
your phone), so it stays a true second channel.
Your approver devices
Name
Platform
Paired
Last seen
Upload SSH Key
Paste the private key (.pem) for this server to enable the web terminal.
