Your organizations
Sign in to see the organizations you own and their status.
Start your space
You are signed in and you do not own a space yet. Create one now — it takes a moment, costs nothing, and only your address can sign in to it.
Building your space
This takes up to a minute while we set up your space's storage, sign-in and web address. This page updates on its own when it's ready.
Address not verified
An organization is assigned to your address, but your identity provider did not confirm that the address is verified, so we will not claim ownership on your behalf. Signing in with a verified Google account resolves this.
Signed in with the wrong provider
An organization is assigned to your address, but it is bound to a different sign-in — another provider. Sign out and sign back in with that provider to see it. We will not move the binding for you: it is what stops a re-registered address from taking an organization over.
Your organizations
Could not load your organizations
Something went wrong reaching aice. Reload to try again.
Address
Your space answers on the addresses below. You can also claim one name of your choosing under aicex.app — it starts working the moment it is yours, alongside the address you already have.
Your own domain
Serve on a domain you own, like intranet.acme.com. You will publish two DNS records in your domain's zone; nothing about your space changes until the second one is in place, so a domain that is live elsewhere stays up while you set this up.
Publish both CNAME records, exactly as shown. The first proves you own the domain and issues its certificate; the second sends visitors to your space.
Names are shown in full; the Copy buttons give the zone-relative name, since most DNS providers append your domain themselves. Values copy exactly as shown.
- Certificate validation — record name:
record value: - Traffic — record name:
record value:
- It stops serving straight away. Its front door is detached and its certificate is deleted.
- Anyone who opens it after that gets a security warning from their browser — not a redirect, and not an aice page. The record you published still points here, but there is no longer a certificate for that name.
- Your own DNS is untouched. Once this is done you can delete the records you published for it at your DNS provider.
- Your organization keeps serving on its allocated address, and on the name you picked if you claimed one.
- The hostname becomes claimable again — by you, or by anyone else.
The new hostname needs a DNS-validated certificate of its own before it can serve, so there is a gap: the current one goes dark as soon as this starts, and the new one works once you publish its two records and the certificate issues.
People
Who can reach this organization, and who administers it. Adding someone here lets them sign in and publish; it does not make them an administrator.
Loading who can reach this organization…
Members
Nobody is admitted by name — an allowed email domain below is what admits people here.
Allowed email domains
No email domain is allowed, so only the named addresses above can sign in.
Administrators
Their sign-in link
Send them this link. It is not a secret — it only works for an address this organization admits.
Set up sign-in
Sign-in for runs on your organization's own identity provider, so the accounts that can reach your space stay yours.
Right now you sign in with your aice-x account, so there is nothing to set up. Connect your organization's own Google Workspace or Microsoft Entra ID below when you want to bring other people in.
- In the Google Cloud console, create an OAuth client ID of type Web application.
- Add the authorized redirect URI below, exactly.
- Add the authorized JavaScript origin below.
- Paste the client ID and secret Google gives you.
- In the Azure portal, open Microsoft Entra ID → App registrations and register a new application.
- Under Authentication, add a Web platform and paste the redirect URI below as its Redirect URI.
- Under Certificates & secrets, create a client secret and copy its Value — Azure shows it once.
- Under Token configuration, add the optional claim email to the ID token. Without it Entra sends no address and every sign-in is refused.
- Under API permissions, grant admin consent if your organization requires it.
- From the app's Overview, copy the Application (client) ID and the Directory (tenant) ID.
Authorized redirect URI
Authorized JavaScript origin
Your storage
This space's content lives in — an S3 bucket your organization owns, in region . For it to serve and update, the bucket must grant this service access. Set that up below; every check runs live against the bucket.
- In the AWS account that owns the bucket, open its Permissions tab
and set this bucket policy, exactly:
- Only if the bucket is encrypted with a customer-managed KMS key: merge these
statements into that key policy (skip this otherwise):
- Your organization runs a public site, so the site editor uploads images
straight from the browser. On the same bucket, set this CORS configuration
(Permissions tab, or aws s3api put-bucket-cors --cors-configuration), exactly,
and set it again whenever your organization's addresses change:
- Check that the grant is live — cross-account permissions can take a minute to propagate, and checking again is always safe.
Branding
Your space wears its default look. Branding lets you put your own colours, logo and type on every page it serves.
Loading your organization's colours…
Read your website and we will suggest the whole look — colours for light and dark, your typeface, your corners and your logo — or pick a colour and a logo yourself and everything else is derived for you. Open Palette or Advanced when you want more. Nothing changes on your space until you save, and Reset always brings your space's default look back.
Every role, in both modes. Leave one alone and it keeps following your colour; change one and that single value is what gets saved.
Type and shape. Typefaces come from a list we host ourselves, so your pages never call out to anyone else to render.
Preview
A page and a slide from your space: your saved look under Current, what you have picked under Preview. Drag the handle — or focus it and use the arrow keys — to move the split. Nothing is saved yet.
Showing the last preview that passed. What is listed below has to be fixed before this can be saved.
Features
What your organization allows. Every change here takes effect within about a minute, and none of them undoes anything that already happened.
There are no organization features to change yet.
Front page
Who can change what your organization's front page says. The people you name
here can set its opening line from their own agent — with
aice root set-intro or the aice connector. Everyone else is refused,
and so is everyone while this list is empty.
Nobody can change your front page yet. Add someone below.
Use an address that can sign in to your organization — the same address they use for aice, not the one you sign in to this console with.
CMS administrators
Who runs your organization's public site. A CMS administrator manages the site's editors, saves and previews its content through the site editor, and publishes it only when you have also made them a publisher; they write no template, schema or page directly. They have no access to this console and nothing else in your organization changes for them.
The site's spaces now
Administrators
No CMS administrator beyond the space owner.
Use addresses that sign in to your organization — the ones they use for aice, not the one you sign in to this console with. The space owner holds every site space (content, templates and each public site space) and is always a named author; it is required, and replacing it removes the previous owner's authority over them.
Named authors
Named authors write the site's templates, static files and pages directly, with the CLI, an AI agent or the page overlay. CMS administrators and editors change content only through the site editor. Removing an author takes effect for new sessions at once, and for an already-open write session within the hour.
The first save below stores these authors together with the administrators and the space owner.
Publishers
A publisher makes the site's saved and previewed changes live. A CMS administrator publishes only when also listed under Publishers, and changes by anyone else wait in the publish queue until a publisher publishes them. An AI agent signed in as a person publishes only when that person is a publisher. The agent key publishes only when it is listed here, and only content it can already edit.
Publishers and approval can be set once you have taken the site over: save the administrators and the space owner above first.
With this on, every publish needs the approval of a second CMS administrator or the space owner, so the space owner's own changes need someone else's approval too.
Apps
APIs your organization's pages can call as the person viewing them. aice signs a short-lived token for each API registered here, and the API checks it with the settings shown under each entry.
No APIs are registered yet. Add one below.
This organization has registered 20 APIs, the most it can. Remove one to add another.
Registering an API lets every author in your organization obtain tokens for it as whoever views their pages. Register only an API you would let any author call on a viewer's behalf.
A change takes effect within about a minute.
Agent key
One key that lets an agent or a script use aice for your organization without signing in.
Rotate ends every session of the old key and revoke deletes the agent. The previous key keeps working for up to five minutes in an aice session it already opened.
Agent key
Try it with the aice CLI
Or send it as a header
This key publishes as aice-agent, reads what any member reads, and cannot read ACL-locked pages. It will not be shown again, so copy it now.
Billing
What your organization is on, and how to change it. Publishing is never interrupted by anything on this page.
Loading your billing details…
- Plan
- Authors
- Seats billed
Upgrade your plan
Manage your subscription
Your plan, your payment method, your invoices and cancellation are all in Stripe's billing portal.
Close organization
This organization is closed. If closing did not finish, close it again here to finish it.
- Closing removes this organization's sign-in straight away.
- It keeps every page. Its address shows an archived page instead of the site.
- You can reopen it from this console any time until it is deleted, and it comes back at the same address.
Closing ends billing at the end of the current period, with no refund. Reopen before then to keep the subscription.
Want a copy of your pages first? Run aice export before you close. You do not have to.
Delete my sign-in
This deletes only your aice-x sign-in. It changes no organization, and it is refused while you own or co-manage a live organization.