One registration connects your team to Priority through AI — Claude, ChatGPT, Gemini, BI and app generation.
Registration takes about five minutes. One approval provisions the rest: sign-in for every user, a signed gateway key, encrypted tenant credentials, and a BI workspace.
The same application reshapes itself around who signed in. Customers get a self-service portal. Operators and partners get the control plane.
The customer admin
Fill one form, wait for approval, then run your own access: add a Priority tenant, mint a connector token, grant an application to a colleague, invite a new user. No ticket, no email thread, no waiting on a vendor.
The operator or reseller
Every customer key carries its own limits: which Priority servers it may reach, how many companies, when it expires, which advanced surfaces it can touch. Revocation lands on running gateways in seconds. Partners issue inside ceilings you set.
The customer fills one form. The approval does everything else, in one action, and tells them so in their own language.
The operator sends a signed, single-use, time-limited link. There is no open sign-up page and no shared registration URL, so the only way into the portal is a link somebody issued on purpose.
One card collects everything: company and contact details, each Priority tenant URL with its tabula.ini, a master API user, and the list of people who need access. The form states plainly that the details are sent securely and encrypted, and that the master password is shown to no one.
The operator reviews the request and approves it. That single action creates the sign-in groups and the users, writes the Priority credentials encrypted into AWS SSM, redeploys the gateway configuration, mints the customer's gateway key with its tenant allowlist and registers it on the live gateway, opens the BI workspace and starts its schema bootstrap, and writes the audit record.
The first carries a temporary password that expires after seven days. The second, "Your access is ready.", is the numbered setup: open firewall egress for the gateway if the Priority server is closed to the internet, the organization's Cloud API key, the Token Generator, the MCP endpoint for Claude, ChatGPT and Gemini, the web tools, the n8n node, and the portal itself.
Both emails exist in full in both languages. A missing Hebrew string fails the build, so the Hebrew is never the stale half.
The customer manages tenants, users, tokens and application access themselves. The changes that still need an operator — a new Priority tenant, a rotated master password — are proposed from the customer's own portal and land in the operator's Approvals queue.
Five tabs, and a first-run strip that tells a brand-new admin what to do next. Priority tenants, gateway keys, connections, users, applications.
The wizard asks for tenant, company, language, and your Priority username and password. Your username and password go straight to the Priority gateway to mint the token — they are never stored or logged.
The Connections tab hands out a ready-made .mcpb bundle for Claude Desktop. Download it, double-click it, and Claude has Priority. Nothing to assemble by hand.
A new Priority tenant or a rotated master password needs an operator. The customer proposes it from the portal and it arrives in Approvals, with the credentials encrypted the whole way.
Every customer gets one signed key. Everything the gateway will let it do is written inside it.
A key is one string: pk_<payload>.<signature>. The payload carries the entitlements. The signature proves the licensing console issued them.
The company the key belongs to, its customer id, and the key's own id. That key id is what a revocation names.
customer · customerId · keyId
A term chosen at issue: six months, one year, or two years. The console's Expiring soon view watches a 30-day horizon, so renewals happen before a customer notices.
6 months · 1 year · 2 years
Either a named list of servers the key may reach, or a cap under trust on first use, where the first N servers the key connects to become its allowed set. Cloud keys must carry the explicit list.
allowedTenants[] or maxTenants
The same two shapes one level down: a named list of Priority companies, or a maximum number claimed on first use.
allowedCompanies[] or maxCompanies
On-prem only. It binds the key to the customer gateway's machine fingerprint; a mismatch makes the key unusable. A copied key file is worth nothing on another machine.
deployment: on-prem · MID-…
Optional bits that decide which advanced surfaces a key can reach: code authoring, schema changes, destructive schema changes, query admin, service keys, and operator admin.
authoring · schema · sqli-admin · admin
Entitlements live inside the key and verify offline. The gateway checks the signature locally with an embedded secret and never phones home, so a licensing outage cannot take a customer's integration down. The signing secret never leaves the operator side. Only the licensing console can mint a key the gateway will accept.
Offline verification is what makes a key fast. Live registration and revocation are what keep it under control.
Keys register and revoke on running cloud gateways. There is no restart, no redeploy, and no window where a pulled key still works. The revocation queue also sweeps that user's connector tokens.
A reconciler diffs the licensing registry against the live gateway's keys and against the sign-in pool, then repairs the difference in both directions. Manual edits and half-finished changes do not accumulate.
Each customer holds one canonical key, and its allowed-server list is the deduped union of that customer's tenants. Add or remove a tenant and the key reissues itself: mint the new one, revoke the old one, promote it. Nobody hand-edits an allowlist.
A dashboard on a 30-day horizon lists every key approaching its term. Expiry is a commercial control, not an outage waiting to happen.
A product is a group. A grant on an active user of an active customer is the license. There are no seat tiers and no license arithmetic: entitle the person, and the products they hold follow them.
Access profiles bundle products under a name. Edit the profile and the change sweeps every holder, so an entitlement decision is made once rather than repeated per user.
A reseller is a customer flagged as a reseller and given a limits profile. Every issuing path checks that profile at one chokepoint, so there is a single place where a partner's boundaries are decided.
Set once per partner. Checked on every artifact they try to issue.
A partner with no limits profile can issue nothing. No partner can ever issue an admin token.
Inside their portfolio reservation, partners run the same one-click approval you do. They do not queue behind you, and they cannot exceed the aggregate you reserved for them.
The Ownership screen reassigns a customer between a partner and House (direct). A deal that changes hands is a reassignment, not a re-onboarding.
A partner who also uses the suite switches between their reseller view and their own organization's portal in place, without a second login.
A licensing console that holds ERP credentials would be the wrong shape. This one holds as little as it can, and says exactly where the rest lives.
Credentials are stored encrypted in AWS SSM — never in this console's database. The master password is encrypted and shown to no one, and a tenant can carry a separate limited login identity so day-to-day traffic never runs as the master.
Your username and password go straight to the Priority gateway to mint the token — they are never stored or logged. The portal arranges the exchange; it does not sit in the middle of it.
The secret that signs keys stays on the operator side. The console signs and re-verifies a probe key at start-up, and a build check blocks the web console from importing key-custody code at all.
Nothing stops. Keys are signed and verified locally, so the gateway answers requests without ever calling the licensing service. Issue-time control, not request-time dependency.
An on-prem key binds to the customer gateway's machine fingerprint. A mismatch makes the key unusable, so a leaked key file does not become a working key somewhere else.
A tenant can carry up to ten outbound headers, for customers who front Priority with Cloudflare Access or a similar gate. The gateway presents them on every call to that tenant.
The portal itself runs on Amazon Web Services, in Amazon's Tel Aviv region, with Cloudflare in front of every request: TLS, DDoS protection, a web application firewall, rate limiting and bot filtering. The servers accept no inbound connections — they dial out to Cloudflare and traffic comes back down that tunnel, so there is no public port to scan, and the operator surfaces sit behind a second gate. Deploys run from a versioned pipeline, and the secrets above live encrypted in AWS Parameter Store.
The portal is the front door. Behind it sits the gateway every product speaks to Priority through, and the tools your team signs into with the one account this registration created.