> ## Documentation Index
> Fetch the complete documentation index at: https://infercrane.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Operations console

> Use InferCrane's authenticated browser console without putting provider credentials or PostgreSQL in the frontend.

The InferCrane console is a separate web application over the same authenticated control API used
by the CLI, SDKs, Terraform provider, and terminal workspace. It is not a second backend and never
reads PostgreSQL or provider credentials directly.

<Info>
  The hosted console is currently deny-by-default private preview. The initial public product is
  CLI- and API-first. Local self-hosted use does not require an InferCrane Cloud or Clerk account.
</Info>

## What the console covers

* fleet attention, stable endpoints, and concrete workloads;
* durable operations with reconnectable timelines and cooperative cancellation;
* Request Inspector and deterministic Doctor findings;
* endpoint monitoring for request rate, errors, fallback, TTFT, queueing, latency, and reported token throughput;
* Release Guard, benchmark, replay, revision, and replica evidence where available;
* lifecycle overlays, signed alert policies, sourced FinOps reports, and signed output-quality evidence;
* provider/runtime capability inventory and secret references;
* scoped API-key lifecycle and private-preview team access.

Missing or forbidden evidence remains explicit. A failed optional panel does not make a deployment
look healthy, and an unavailable measurement is never rendered as zero.

The monitoring page queries only the authenticated control API. PostgreSQL request evidence and
lifecycle events form the initial local evidence store; OpenTelemetry GenAI semantics define the
portable names and dimensions. Runtime-internal and GPU metrics remain unavailable until a
qualified runtime or provider adapter reports them.

## Local self-hosted console

From an `infercrane-web` checkout, configure the local adapter:

```bash theme={"theme":{"light":"github-light-default","dark":"vesper"}}
export INFERCRANE_CONSOLE_AUTH_MODE=local
export INFERCRANE_CONSOLE_ORIGIN=http://127.0.0.1:3200
export INFERCRANE_CONTROL_API_URL=http://127.0.0.1:18000
export INFERCRANE_LOCAL_SESSION_SECRET="$(openssl rand -base64 48)"
npm install
npm run dev:console
```

Open `http://127.0.0.1:3200` and exchange an existing InferCrane API credential. The BFF validates
the credential with the control plane and seals it into an eight-hour, encrypted, HttpOnly,
SameSite=Strict session. Browser JavaScript does not receive the raw token after exchange.

<Warning>
  Use a unique session secret and HTTPS in production. Do not place the bootstrap credential in a
  shared browser session; create a scoped service account instead.
</Warning>

## Hosted private preview

Hosted mode uses Clerk for sign-in, sessions, and organization selection. Clerk authentication alone
does not grant access. The Go control plane independently requires a mapped InferCrane user,
organization membership, role/scopes, and active `web_console_access` entitlement. Default access is
denied.

Configure the Go verifier with the Clerk instance's HTTPS issuer and public JWT verification key:

```bash theme={"theme":{"light":"github-light-default","dark":"vesper"}}
export INFERCRANE_HOSTED_AUTH_ISSUER="https://YOUR-CLERK-DOMAIN"
export INFERCRANE_HOSTED_AUTH_AUDIENCE="infercrane-control-api"
export INFERCRANE_HOSTED_AUTH_JWT_KEY_FILE="/run/secrets/clerk-jwt-public.pem"
export INFERCRANE_HOSTED_AUTH_AUTHORIZED_PARTIES="https://app.infercrane.ai"
```

The private-preview Clerk instance must disable public sign-up and restrict organization creation.
Those identity-provider controls improve the sign-in UX; the InferCrane entitlement remains the
authoritative access boundary.

Every protected page and server action resolves a server-side session. Every control API request
then repeats authentication, authorization, and tenant ownership checks. Organization IDs supplied
only by browser input never establish authority.

## Durable work

Closing the browser does not cancel deployment work. Reopen the console or resume from any terminal:

```bash theme={"theme":{"light":"github-light-default","dark":"vesper"}}
infercrane operation watch OPERATION_ID
```

Cancellation is cooperative. Provider cleanup may continue after cancellation is requested or the
browser closes.

## Terminal equivalent

For headless, low-bandwidth, or incident use, the terminal surfaces remain first-class:

```bash theme={"theme":{"light":"github-light-default","dark":"vesper"}}
infercrane inbox
infercrane ui
infercrane status DEPLOYMENT --output json
infercrane events DEPLOYMENT --output json
infercrane explain DEPLOYMENT --output json
infercrane inspect DEPLOYMENT --output json
```

The public Dashboard link intentionally leads to a Coming Soon page until hosted access is ready for
general users.