Login With Internal Access
Use Internal access on the login screen to sign in a provisioned employee or device for a specific access namespace. The login creates the normal Antylogic session; app areas after login depend on existing memberships and role permissions.
In this article
Internal access is for employees and devices that have already been provisioned for a location or organisation namespace. It does not create users, credentials, roles, memberships or permissions.
For the GB documentation runtime, Harbor Soho exposes the non-secret access namespace harbor-soho-65aa418f. A successful-login capture still needs a temporary documentation-runtime internal credential.
Before you start
- Open auth/login or antylogic://auth/login.
- Select Internal access.
- An active access namespace exists for the location or organisation.
- An active internal credential exists for the submitted username, has a valid password, and is linked to an active user.
- Any required OAuth client and consent checks are already satisfied.
Instructions
- 1.
Open Internal Access
On the login screen, switch from Account to Internal access. The form changes to show Access code, Username, Password, Remember me and Log in.
- 2.
Enter The Credential
Enter the access code, internal username and password. Use Remember me only when the device should keep the refresh session for longer. The access code and username are normalised for lookup; the password is used exactly as entered.
- 3.
Submit Login
Select Log in. Antylogic sends the credential to POST /api/auth/login/internal. Valid credentials create the same token and cookie session used elsewhere in the app.
- 4.
Continue Into The App
After login, the app stores the returned tokens, saves the trimmed access code, clears cookie-session-only state, then reloads the current user and permissions.
Validations and limits
- Access code, Username and Password are required in Internal access mode.
- Inactive namespace, missing or inactive credential, wrong password, missing user and inactive user are rejected.
- Too many sensitive auth attempts from the same IP can return 429.
- Internal login does not create users, credentials, roles, memberships or permissions.
- Do not document /api/app/auth/callback/native as the route for this action; current code uses POST /api/auth/login/internal.
- The public demo session start or resume flow is separate from auth.internal.login.
Expected result
The employee or device has a normal Antylogic session. The next visible area depends on a valid non-auth next or return_to target and the permissions returned by the app APIs.