Platform Features
This section covers CMP-level capabilities that are not tied to a single orchestrator — APIs, notifications, store/marketplace, and other cross-cutting product features.
| Section | Purpose |
|---|---|
| Orchestrator Features | Features per orchestrator (VMs, networks, backups, …) |
| Platform Features (this section) | General CMP product features used across the platform |
Feature list
| Feature | Status | Page |
|---|---|---|
| APIs | Ready | APIs — access tokens, roles, integrations |
| Notifications | Stub | Notifications |
| Multi-language | Ready | Multi-language — end-user portal locales, coverage, limitations |
| Auto Pay | Ready | Auto Pay — prepaid auto top-up when infra credits fall below a threshold |
| Customer Dashboard | In progress | Customer Dashboard — customer portal self-service (quota reports, usage sync, …) |
| StackAI | Beta | StackAI — natural-language cloud operations assistant in the customer console |
| Global Settings | In progress | Global Settings — one page per flag (enable_phone_input, hide_billing_phone, hide_postal_code, …) |
| Marketplace Apps | Ready | Marketplace Apps — pre-installed app images, env vars, credentials email, startup scripts |
| CAPTCHA | Ready | CAPTCHA — Google reCAPTCHA v2 Checkbox and Cloudflare |
| SMS Gateways | Ready | SMS Gateways & Verification — mobile verification at registration, MSG91, Twilio, Spinning Disk |
| Security | Ready | Security — user enumeration protection, tickets and feedback rate limiting |
| Identity Providers | Ready | Keycloak, Zitadel (Beta) — SSO; see overview |
| Terms and Conditions | Ready | Terms and Conditions — one-liner, in-step registration, enforce flag |
| Store & Products | Ready | Store & Products — non-automated catalogue, vendors, orders, customer Store, billing rules |
| Reseller | Ready | Reseller — reseller vs vendor, reseller billing, known limitations |
| Affiliate | Ready | Affiliate — registration, admin, affiliate dashboard, commissions, payouts |
Invoice branding, branches, and tax live under Billing & Invoicing → Invoice Settings. Branch wizard Step 5 (in-page T&C content) is also linked from Terms and Conditions — In-step form.
Identity Providers
CMP supports external identity providers (IdPs) for customer and admin sign-in. Configure them under Admin → Settings → Social Login. Credentials are stored in CMP Social Login settings — do not put provider secrets in .env.
Supported providers
| Provider | Type | Status | Documentation |
|---|---|---|---|
| Keycloak | OIDC / SSO | Supported | Keycloak |
| Zitadel | OIDC / SSO | Beta | Zitadel (Beta) |
| Google Authenticator (TOTP) | MFA | Planned | — |
| Other MFA methods | MFA | Planned | — |
Enable only one SSO provider (Keycloak or Zitadel) at a time. When switching providers, set the previous provider's Status to Inactive in Admin → Settings → Social Login before activating the new one. Stored credentials are retained when a provider is inactive.
Social Login fields
Path: Admin → Settings → Social Login
| Field (typical) | Purpose |
|---|---|
| Client ID | OIDC application identifier from the IdP |
| Client Secret | Confidential Web application secret (OIDC login) |
| Base URL / Realm | Issuer or Keycloak realm URL — provider-specific |
| PAT (Zitadel only) | Machine-user Personal Access Token for admin API / user migration |
| Status | Active enables the provider for login |
Disabling SSO
To turn off Keycloak or Zitadel without removing stored credentials:
- Open Admin → Settings → Social Login
- Open the provider (Keycloak or Zitadel) → Edit
- Set Status to Inactive and save
Password login and password reset become available again until the provider is set back to Active.
Provider setup guides: Keycloak · Zitadel
Add new platform topics here as dedicated pages (for example branding, reports, addons, or email configuration). Identity Providers (Keycloak, Zitadel, 2FA) are documented in this section. Billing and Quota remain in their own sections.