Basic concepts¶
DotID is the part of FlexGalaxy.AI that helps you sign in and safely reach the apps you are allowed to use. You do not need to understand every technical detail, but these words appear often in the console.
Account¶
An account is the resource and isolation boundary for one APaaS workspace. It contains applications, service identities, roles, policies, and records. Human identities do not live in Account.
Some accounts stand alone. Other accounts belong to an organization.
In a large organization an account can also be created ahead of time and finished only when it is first used — see Accounts that activate when you use them.
Organization¶
An organization is a group of related accounts. It is useful when a company has several teams, business units, regions, or projects that need separate accounts but shared oversight.
An organization can have:
A management account that controls organization-wide settings.
Member accounts that belong to the organization.
Organization units that help group member accounts.
Management Account¶
The management account is the account that manages the organization. People with the right permission in this account can invite accounts, manage organization structure, and assign access through Identity Center.
Identity Center¶
Identity Center is where an organization manages who can access what.
Use Identity Center to work with:
Users — people who can sign in.
Groups — collections of users.
Permission sets — reusable access packages.
Assignments — links between users or groups, permission sets, and accounts.
For example, a “Widget Operator” permission set can be assigned to a group in one account without giving that group administrator access everywhere.
Profile¶
Profile is your personal area. It is where you manage your name, preferences, password, MFA or passkeys, and active sessions.
Changes in Profile affect you, not the whole organization.
Service user¶
A service user is a non-human user owned by your Account. Tools, scripts, and integrations use service-user access keys to call FlexGalaxy.AI APIs on the Account’s behalf. A service user has no Profile, no password, and cannot sign in to the web console.
Account roots and account admins create service users from the Account workbench. See service users.
Workload identity¶
A workload identity is also a non-human identity in your Account, but it is meant for CI/CD pipelines and runtime workloads. Instead of holding a long-lived access-key secret, a workload identity exchanges a short-lived OIDC token from an external trust root (GitHub Actions, GitLab CI) for a 15-minute FlexGalaxy.AI access token. No long-lived secret lives in your pipeline.
If you are an Account root or account admin asked to “set up federation” for a developer’s CI job, you are creating a workload identity. See the workload federation developer guide for the setup steps.
FGAI CLI¶
The FGAI CLI is a command-line tool for developers and operators. It uses the same DotID permission checks as the console and API: a human CLI profile can list only the Accounts and Organizations that the human can access; a service-user profile remains API-only, and a workload-identity profile exchanges short-lived tokens for automation.
If you are not comfortable with command-line tools, use the web console. The CLI is an alternate interface, not a separate permission system.
MFA and Passkeys¶
MFA means multi-factor authentication. It asks for another proof of identity during sign-in, such as an authenticator app or passkey.
A passkey lets you sign in with a device-based method such as Touch ID, Face ID, Windows Hello, or a hardware security key.
QuotaCenter¶
QuotaCenter shows usage limits and quota requests for your account or organization. You may see quotas for services, applications, or platform capabilities.
If you need more capacity, QuotaCenter is where quota adjustment requests begin.
TraceBook¶
TraceBook shows audit events. It helps you answer questions like:
Who changed this setting?
When did this account get created?
Which user was assigned this permission?
TraceBook is meant for review and investigation. It does not change settings.
PassPort¶
PassPort is a sign-in entry for a specific registered application.
When you sign in through PassPort, you are taken to that application’s homepage. This does not automatically give you access to the APaaS console apps such as Identity Center or QuotaCenter.
PassPort is useful when an application needs DotID sign-in but should keep users inside that application.