Dashboard

The dashboard is served by Arc itself at /admin, behind your identity provider or a password.

Who gets in

There is one role, and two ways to get it.

An identity provider, the default and the right choice for anything shared. Sign-in is OpenID Connect with PKCE. An administrator is an identity whose provider says the email is verified and whose address appears in ARC_ADMIN_EMAILS. The allowlist is re-checked on every request, so removing someone revokes their access at once.

A password, when ARC_ADMIN_PASSWORD is set (at least 12 characters). The sign-in page then shows a password form, and the identity-provider variables become optional. The password signs in a single administrator: the first address in ARC_ADMIN_EMAILS, or admin@localhost when there is none. Attempts are limited to five per minute per client address, every failure is logged with that address and never with the value, and the dashboard shows a one-line notice while the mode is on. Both may be set at once, which keeps a way in when the provider is down.

Either way, sessions last 12 hours and Arc keeps only the subject and email in the session: no tokens, because it calls nothing on the administrator's behalf. Someone who signs in but is not on the list gets a page that says so, rather than a blank screen. Rotating SECRET_KEY_BASE ends every session; changing the password does not.

What it shows

Overview leads with the live connection count and a stream of the last two minutes, sampled once a second, then the nodes, per-app counts, and recent changes from the audit log.

Apps lists every app with its live connections and subscriptions. Opening one shows:

• Credentials: app id, key, host and port, each with a copy button
• The channels currently occupied, with subscriber counts and a filter
• Recent webhook deliveries
• Limits and toggles: client events, connection limit, presence ceiling, payload size, subscription_count queries
• Secret rotation and the encryption master key

Webhooks manages endpoints per app: the URL, which events it wants, an optional endpoint secret, and every delivery attempt with its failure reason.

Audit log records who created, changed or deleted apps and webhooks, and every secret rotation.

Secrets are shown once

A newly created or rotated secret appears on exactly one screen, with the copyable Django and JavaScript snippets. It is not stored anywhere it could be read back, and not put in a flash message. If it is lost, rotate it — rotation takes effect on every node immediately, so update your backends in the same deploy.

It cannot slow the data plane

The live numbers come from a metrics aggregator that publishes a snapshot once a second. The dashboard subscribes to that; it never queries the connection registry. Channel lists are the one on-demand read, and they happen when you open the page or press Refresh — never on a timer.