Teams
A team is the top-level tenant in auth.is. It owns exactly one issuer, plus the clients, members, and invites that hang off it. Everything you manage belongs to one team, and access is scoped to team membership: you can only see and change teams you are a member of.
Teams and issuers
Creating a team creates its issuer, atomically, in the same operation (create_team). In phase 1 a team has exactly one issuer, served at https://{slug}.auth.is. The slug you choose becomes the permanent DNS label of that issuer's login host.
The issuer.id returned by create_team and get_team is the anchor for the rest of the surface — every client, provider, theming, and signing-key tool takes it as issuerId.
Per-issuer user pools
The people who log in through acme.auth.is live in that issuer's own user pool — a namespace isolated to the issuer. A user of acme.auth.is is not a user of other.auth.is, and neither is a member of your team unless you invite them as one. Two distinct concepts share the word "user":
- Team members — the people who manage the team (owners and members). These are accounts in the auth.is root issuer (
login.auth.is), because auth.is dogfoods its own IdP. See Members. - Issuer users — the end users who log in to your apps through your issuer. These live in your issuer's pool. See Users & identities.
Do not conflate the two. Inviting someone to your team (invite_member) gives them management access to the team — it does not create an end user in your issuer's pool, and vice versa.
Slugs are permanent
The slug is validated as a DNS label: lowercase letters, digits, and hyphens, no leading or trailing hyphen, 3–63 characters. Very short slugs are reserved for the platform, and a taken or reserved slug is refused with a conflict. Because it is the issuer's host, it cannot be changed after creation — pick it deliberately.