Account and workspace

The Admin is where the customer configures Xokepoint. Signing in to it is different from using Xokepoint: the administrator signs in with a platform account, and the people who use the agents sign in to their company IdP. One does not depend on the other.

Someone without an account uses Create an account. Sign-up asks for e-mail and name, verifies the e-mail and requires a second factor with an authenticator app. After that, someone who belongs to no workspace creates the first one and becomes its administrator.

The first workspaceCopy Anchor Link

The first workspace starts with a ready sample in its Sandbox, so you see Xokepoint working before you connect your own systems. While it is created, the Admin shows the setup steps and then opens the Sandbox. Production stays empty, for your real setup.

The sample has:

• the identity connection Sample Identity, with fictitious people: ana and bruno, in the group Finance, and carla, in Support. All use the password 123;
• the MCP server Sample Billing, with the tools get_order and refund_order;
• the context source Sample Employee Directory, which returns the refund limit of each person;
• the agent refunds-assistant, delegated by ana and bruno, with two rules on refund_order (up to 500 and up to the limit of the person) and Claude Code as its only allowed harness;
• a few calls already made, allowed and denied, so Investigate does not open empty.

To try it from outside the Admin, add the MCP URL of the agent's Harness login card to Claude Code and log in as one of the fictitious people. Harness connection shows the steps.

Workspace and environmentsCopy Anchor Link

A workspace is the customer company. Inside it there are two environments, Sandbox and Production, and everything you configure belongs to one of them: identity connections, MCP servers, context sources and agents. The selector at the top of the Admin switches environment, and each screen shows only what belongs to it.

The usual path is to build and test in Sandbox and repeat in Production. Environments share no configuration, keys or relations: a token issued in Sandbox is not valid in Production. Multitenancy explains the isolation.

Account areaCopy Anchor Link

Account in the profile menu opens the account area. It has no environment selector: it shows everything that belongs to you across your workspaces.

Workspaces lists each workspace you belong to, with your role and its creation date. From there you create another workspace, which starts with its own Sandbox and Production, and open the Admin in any of them. The workspace page renames it and shows both environments with the authorization server issuer of each.

Deleting a workspace removes both environments and everything in them: agents, keys, connections, permissions and records. Its agents get no token afterwards. To confirm, type the workspace name. There is no recovery.

Events export lists the destinations that receive the calls of your workspaces in your SIEM or observability tool, by OTLP or webhook. Events export explains each setting.

Account info changes the name that the people of your workspaces see in the revision history and the Inbox, and shows the e-mail you sign in with. Deleting the account removes your access to every workspace. Before the confirmation, the Admin lists the workspaces that go with the account, because you are their only administrator, with the agent count of each. To confirm, type your e-mail. Afterwards the same e-mail can create a new account.