CCS / PRIVATE MANAGEMENT / STAGING

STUDIO ADMIN PORTAL

Secure management starts with verified identity and provider connections. Cloudflare Access guards this custom domain; studio Gmail, Calendar, Drive and YouTube permissions are independently authorized.

Checking protected sessionAuthenticating this browser with the server…

SERVICE CONNECTIONS

CONNECTIONS & RECOVERY

SERVER VERIFIED ONLY

Services are unavailable until a backend check confirms valid studio authorization. Expired connections will offer one secure Google reconnection flow when configured.

Google identityChecking

Cloudflare Access login and backend JWT verification.

Studio Google accountNot checked

Approved Gmail, Calendar, Drive and YouTube scopes only.

Requires secure OAuth callback and encrypted storage.

PatreonNot connected

Member activity and studio revenue. Independent approval required.

Cloudflare R2Not verified

Private studio assets and usage tracking.

Repair All Connections

One owner action will refresh eligible service tokens and present any necessary provider sign-ins. It must not bypass consent or create new permissions.

TRUST & AUTHORIZATION

SECURITY STATUS

Cloudflare Access: owner-only Google policy registered for this staging hostname.
Application identity: requires a cryptographically verified Access JWT before returning private user details.
Public Pages preview: no private data or secrets, and server endpoints must independently reject unauthorized requests.
Studio OAuth: not active until configured for backend-only credentials and durable encrypted token storage.

DEPLOYMENT MILESTONES

BUILD PROGRESS

Complete: CCS Google Access identity provider, owner policy, private custom domain, isolated Pages preview.
In development: verified backend identity endpoint, service connection health, OAuth callback, reconnect workflow.
Next: verify unauthorized-user denial, Google service read/refresh, owner-only permissions and audit.