IT / Admin team playbook

You run the platform. This playbook covers the admin dashboard, provisioning access, wiring integrations, the gated flags that unlock writes, diagnostics, the REST API, and the security model everyone else depends on.

What you can do

• Manage sites, projects, tokens and users in the admin dashboard.
• Connect OAuth integrations (Google, Meta, GitHub) per user.
• Flip the per-site gated flags that unlock publishing and external writes.
• Diagnose a site end-to-end.
• Expose the same capabilities to custom apps over the REST API.
• Understand and enforce the security guardrails.

Admin dashboard

Everything is at /admin (master-token login). Key screens:

Screen	What you do there
Sites	Create/edit sites: platform, base URL, credentials, integration IDs, and the gated flags (in the Danger zone).
Projects	Group sites under a client; grant users at the project level.
Tokens	Mint /mcp tokens: scope to sites, set max_risk, skip_write_confirm, allowed tools. Plaintext shown once.
Users	Create Worker users, force first-login password change, and connect Google / Meta / GitHub per user.
Audit log	Who ran what, when, and the result (ok / denied / error) — including admin actions.

Provisioning access (the usual flow)

1. Create the user (they set a password on first login).
2. Grant them the project(s) or site(s) they work on.
3. Mint a token scoped to those sites with an appropriate max_risk (0 = read-only, 1 = drafts, 2 = external writes, 3 = publish).
4. For analytics/CRM: have the user connect the integration (Google / Meta / GitHub) and set the integration IDs on the site.

The gated flags (default OFF)

These live per-site and only a super-admin sets them. This is how you unlock the higher-risk actions after the safe default.

Flag	Unlocks
allow_publish	publish_post / publish_page (T3)
allow_seo_on_published	set_seo_meta / set_seo_schema on live posts
allow_main_branch_push	Astro writes to the primary branch (else preview branch)
allow_full_repo_write	Astro writes outside the whitelist + bulk_write_astro_files
allow_gohighlevel_write	GoHighLevel create/update/send (money-movement still blocked)
allow_drive_write	drive_save_audit
allow_querymind_write	querymind_create_content_job / querymind_rerun_job

Note

Tokens/users also carry a max_risk ceiling that caps everything by tier, independent of these per-site flags. A write must clear both the flag and the caller’s max_risk, and pass the write-confirm gate. See Account safety.

Core tools

Feature	Tools
Diagnose a site	diagnose_site, ping_site
List / inspect	list_projects, list_sites, get_site
Astro scaffolding	init_astro_project, bulk_write_astro_files, write_astro_file, check_astro_deploy, reset_astro_preview_branch

REST API

For custom apps that don’t speak MCP/JSON-RPC, /api/v1 wraps the same auth, scope, audit and dispatch path with a flatter shape:

curl -H "Authorization: Bearer $TOKEN" \
  https://<worker>/api/v1/tools            # list tools
curl -H "Authorization: Bearer $TOKEN" \
  https://<worker>/api/v1/sites            # list sites
curl -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"site_id":"acme-blog"}' \
  https://<worker>/api/v1/tools/list_drafts

An OpenAPI 3.0 spec is at /api/v1/openapi.json. See REST API.

Diagnostics

Run diagnose_site on "acme-site" and tell me what's broken — REST reachability,
Elementor, RankMath bridge, GitHub app, and (for GHL sites) Drive + Clarity.

diagnose_site branches by platform and reports every integration’s health plus the super-admin gate states.

Security model (enforce these)

Hard rules — not configurable

• Never publish-now, never delete posts/pages. Adapters throw ForbiddenOperationError; no delete tools exist.
• Never delete via any Google service — scopes are read-only / drive.file only, and include_granted_scopes is never set.
• Money movement in GoHighLevel is blocked even with writes enabled.
• Tokens are hashed (sha256); plaintext is shown once and never stored.
• Master token is admin-only; /mcp tokens never reach /admin.

Gotchas

Caution

• A new token’s plaintext is shown once. Copy it immediately; only the hash is stored.
• Super-admins have global access and don’t need per-project grants; regular users see only what they’re granted.
• Google Ads: use a leaf account id, put the MCC in the login-customer-id field, or metrics queries fail.
• Meta needs META_APP_ID + META_APP_SECRET as Worker secrets before any user can connect Meta.

Next

• Deploy to Cloudflare and Master token & users.
• Tokens & scoping — the full risk-tier model.
• Error codes — decode any E_* a teammate reports.