Dashboard launch

Calloop's dashboard (/app) lets your people set up and watch their call center without screens of your own: agents, queues, lines, IVR flows, audio, the live board, listening, calls, recordings, reports. Your own staff sign in with a Calloop account (email, password, two-factor), which a Calloop operator creates for your first owner. A tenant's staff — say a business on your platform with its own call center — are sent in by your product, with no Calloop password: you decide who gets in, with your own users and roles.

Your backend signs a launch token with one of your signing keys (as for agent tokens) and sends the user's browser to https://app.calloop.net/app/launch#token=<token>:

const token = jwt.sign(
    { iss: 'yourproduct', aud: 'calloop-dashboard', sub: user.id, tnt: business.id,
      name: user.name, role: 'ADMIN', jti: crypto.randomUUID() },
    signingKey.secret,
    { algorithm: 'HS256', keyid: signingKey.kid, expiresIn: '2m' },
);
res.redirect(`https://app.calloop.net/app/launch#token=${token}`);

Claim
iss	your consumer slug
aud	calloop-dashboard — an agent token (no aud) is never a launch token, and a launch token is refused on the agent socket
sub	your id for the user (≤191 characters), shown in the dashboard's audit log
tnt	the tenant's ref; the session sees this tenant only
role	ADMIN (the tenant's setup, the live board, listening, ending calls) or SUPERVISOR (the live board, listening, calls, recordings, reports; reads the setup)
name	optional, shown in the dashboard
jti	unique per token: a token is accepted once
exp	at most 5 minutes ahead

• The token travels in the URL's fragment (#), which browsers never send to a server, so it isn't in any access log. Make one per click; don't email it.
• The session lasts up to 8 hours (30 minutes idle) and ends when you revoke the signing key that signed its token or suspend the tenant.
• A launched user can't create tenants, change a tenant's settings or lines, or reach your keys, webhook, push credentials or events — those are for your own staff's accounts. They see your SIP trunks by name only (to pick one for a line), never their carrier settings, diagnostics or the carrier presets.