OIDC & SAML
Okta and SAML paths for workspace SSO. Client secret stays in your IdP and our secrets store — never in the public tree.
Built for governed teams
Identity first. Public social login lands on What's New. Enterprise SSO opens the operating machine
when you choose it — with optional Cloudflare Access in front of crm.prime88.studio.
Shared session
Session cookie on .prime88.studio so the door and CRM share identity without a second password tax — unless Zero Trust is required.
Deterministic control
AI assists. Deterministic agents enforce envelopes: policy, human authority, and append-only receipts on consequential actions.
Edge & capacity
Cloudflare edge for public surfaces; private body for operators. Capacity and metering stay versioned — UI displays, does not invent rates.