Permissions and Security

Understand authentication, access control, data isolation, and token handling across the portal.

Permissions and Security

Use this page to understand how access is controlled, how data is isolated, and how credentials are protected.

Authentication

The portal uses Single Sign-On through Mozark's central identity service at auth.mozark.ai.

There are no separate Testing Portal passwords.

Your organization's IT or security team manages credentials at the identity provider level.

Your authentication token is a signed JWT stored in browser local storage.

It includes your user ID, email, role, and expiry time.

The portal validates this token on every action.

If the token expires, the portal redirects you to the sign-in page.

If you remain active, tokens refresh automatically in the background.

The portal applies a 30-second buffer before token expiry to reduce failures during slow operations.

Multi-tab and multi-device behavior

Mozark uses BroadcastChannel to synchronize authentication state across open tabs in the same browser.

This means:

• Signing out in one tab signs you out in all open tabs in that browser.

• Signing in or re-authenticating updates all open tabs in that browser.

• Different browsers and different devices remain independent sessions.

Signing out on one computer does not sign you out on another.

Data isolation

Sessions, bugs, notes, and files are scoped to the active organization and project at the time they are created.

You cannot view data from another organization unless your current context grants access to it.

If you belong to multiple organizations, switching context immediately re-scopes the data shown in the portal.

Role-based access

User roles are managed in the Mozark Admin Control Panel, not in the Testing Portal.

The portal enforces the permissions assigned to your account.

If you cannot see a project, launch a session, or access a module, contact your Mozark account administrator.

They can review your project membership and role assignment.

API authentication

API requests from the Testing Portal to backend services include your JWT in the Authorization: Bearer header.

This is handled automatically during normal portal use.

You do not need to manage API keys for standard UI access.

If you integrate external tools such as Playwright or Appium, use the project-specific credentials shown on the automation hub pages.

Admin Portal

Organization and project management happens in the Admin Portal.

This includes adding users, creating projects, and managing app configurations.

Open it from Admin Settings in the user menu in the top navigation bar.

The Admin Portal opens in a new browser tab.