> For the complete documentation index, see [llms.txt](https://mozarkdocs.gitbook.io/appx_documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mozarkdocs.gitbook.io/appx_documentation/test-infrastructure-documentation/permissions-and-security.md).
# Permissions and Security
## Permissions and Security
Use this page to understand how access is controlled, how data is isolated, and how credentials are protected.
### Authentication
The portal uses Single Sign-On through Mozark's central identity service at `auth.mozark.ai`.
There are no separate Testing Portal passwords.
Your organization's IT or security team manages credentials at the identity provider level.
Your authentication token is a signed JWT stored in browser local storage.
It includes your user ID, email, role, and expiry time.
The portal validates this token on every action.
If the token expires, the portal redirects you to the sign-in page.
If you remain active, tokens refresh automatically in the background.
The portal applies a 30-second buffer before token expiry to reduce failures during slow operations.
### Multi-tab and multi-device behavior
Mozark uses `BroadcastChannel` to synchronize authentication state across open tabs in the same browser.
This means:
* Signing out in one tab signs you out in all open tabs in that browser.
* Signing in or re-authenticating updates all open tabs in that browser.
* Different browsers and different devices remain independent sessions.
Signing out on one computer does not sign you out on another.
### Data isolation
Sessions, bugs, notes, and files are scoped to the active organization and project at the time they are created.
You cannot view data from another organization unless your current context grants access to it.
If you belong to multiple organizations, switching context immediately re-scopes the data shown in the portal.
### Role-based access
User roles are managed in the Mozark Admin Control Panel, not in the Testing Portal.
The portal enforces the permissions assigned to your account.
If you cannot see a project, launch a session, or access a module, contact your Mozark account administrator.
They can review your project membership and role assignment.
### API authentication
API requests from the Testing Portal to backend services include your JWT in the `Authorization: Bearer` header.
This is handled automatically during normal portal use.
You do not need to manage API keys for standard UI access.
If you integrate external tools such as Playwright or Appium, use the project-specific credentials shown on the automation hub pages.
### Admin Portal
Organization and project management happens in the Admin Portal.
This includes adding users, creating projects, and managing app configurations.
Open it from **Admin Settings** in the user menu in the top navigation bar.
The Admin Portal opens in a new browser tab.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://mozarkdocs.gitbook.io/appx_documentation/test-infrastructure-documentation/permissions-and-security.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.