Docs Operate
Access keys
Phigon has no accounts or passwords. Each person or system that uses the Phigon app signs in with its own access key, a single string that looks like this:
phg_k7m2x9q4ab2c_vk3...
Roles
Every key has exactly one role:
| Role | Can |
|---|---|
| Administrator | Everything, including Guardian policies, storage checks, and creating or revoking keys |
| Operator | Connect machines and request agent actions |
| Viewer | Read the fleet, activity, and analytics |
| Auditor | Export the audit log and consent records through the API. Auditor keys cannot open the app. |
Getting the first key
The Phigon team creates your workspace and its first administrator key when you book a demo. Business deployments create it themselves on their own control plane:
/phigon-api access-key create --name "Owner" --workspace "Acme"
The full key is shown once. Phigon stores only a SHA-256 digest of it.
Adding and revoking keys
In the Phigon app, open Settings → Access keys. Administrators can:
- Create a key for a teammate or another computer, choosing its role. Copy it immediately; it is not shown again.
- Revoke any key except the one they are signed in with. Revoked keys stop working within a minute, including open live views.
The Last used column shows when each key last reached the control plane.
On the computer
The Phigon app stores the key with the operating system's encrypted key store: DPAPI on Windows, Keychain on macOS. It is never shown to the app's interface after sign-in. Settings → Sign out of this computer deletes it from that computer; revoke the key as well if the computer is lost.
If the server rejects a stored key, for example after it was revoked, the app returns to the sign-in screen.
Good practice
- Give every person their own key, named after them.
- Use the least powerful role that does the job.
- Revoke keys when someone leaves or a computer is retired.
- Never put keys in chat, tickets, screenshots, or source control.