The dashboard
The dashboard is at irt.io/app. It is served from the same origin as this site and the control API, so there is no separate console domain and no second login.
It is a read-mostly view of what the CLI already tells you, plus one thing the CLI has no command for: editing your project’s allowed origins.
Signing in
Register at /app/register, open the link in the email that follows, enter the password you
chose, and choose Confirm. After that, /app/login signs you in with a session cookie. Addresses
are not case-sensitive.
A signup that is never confirmed is deleted after 7 days. Until it is confirmed, registering the same address again replaces the password, and only the link in the newest email works. If the confirm page says your password does not match, register again with the same address and use the link in the new email.
The CLI signs in through the same site. npx irtio login opens /cli-auth, and once you are signed
in there the page hands a token back to the waiting CLI. See deploying a room.
Account security
The Tokens page holds everything this account signs in with, and everything on it can be revoked.
CLI tokens. Every irtio login mints one. Revoking a token signs that CLI out immediately.
Changing your password. Your current password is required, so a session on its own is not enough to take an account over. Changing it signs out every other browser, leaves the one you are using signed in, and revokes every CLI token on the account. Five attempts an hour.
Signing out everywhere. Ends every session on the account, the one you are using included, and
revokes every CLI token, so you sign in again and run irtio login again afterwards. Use it if you
have lost a device, or think someone else has your session. Five presses an hour.
Sessions last 30 days.
Resetting a forgotten password
Choose Forgot your password? on /app/login and enter your address. If it has an account, we
email a link to /app/reset, where you choose a new password. The link works once and expires in
60 minutes. Saving the new password signs out every session and revokes every CLI token on the
account, so you sign in again and run irtio login again afterwards. It also confirms the address
if the signup email was never opened.
Picking a project
Everything below the switcher in the sidebar is scoped to one project. The switcher lists the projects your account owns and puts the choice in the URL, so a link to a page keeps its project.
The pages
| Page | What it shows |
|---|---|
| Overview | Live room count, deployment count, the current version, and your five most recent rooms and deploys |
| Rooms | Every room irtio has heard about, with its status and when it was last seen |
| Rooms, then one room | That room’s status plus a tail of its own log lines |
| Metrics | Your project’s reported counters, as time series |
| Deployments | Every version, newest first, with what changed |
| Logs | The project’s log stream, with a room picker and a live tail |
| Leaderboards | Every board with its row count and how it is scoped, and a page of one ranking |
| API keys | Your public project key and the allowed-origins list |
| Tokens | Your CLI tokens, your password, and the sessions this account has open |
| Projects | The projects on your account |
Rooms
A room’s row is what was reported the last time it was reported: the room id, its lifecycle state
(starting, running, hibernating, hibernated, waking, closed), and a last-seen time.
Read last-seen as “last confirmed alive”. A room that goes away stops being reported rather than being deleted, so its row stays with a frozen timestamp until the retention window prunes it.
The In and Out columns are the bytes that room has received from and sent to clients since it
started, as of its newest metrics sample. Totals, not rates: one sample cannot carry a rate. A dash
means nothing has been reported for that room yet, which is a different reading from zero. For a
breakdown of what those bytes were, by collection and field, run irtio dev --profile against the same room locally, or read the same
totals from the terminal with irtio status.
The two menus above the table are the list route’s own filters, applied server-side: awake or
asleep (active=), and idle longer than 1h, 1d or 7d (idle-longer-than=). Both live in the page
URL, so a narrowed list survives a reload and can be pasted into a ticket, and both mean what they
mean in the rooms API and in irtio rooms. The box beside
them is different: it hides rows already on the page whose id does not contain what you type, and
never goes to the server.
Opening a room gives you its log tail, narrowed server-side to that room. A room that has already idled out of the room list still has logs inside the retention window, so this page shows them instead of a 404.
Delete removes that room’s saved state permanently, after a confirm. If the row shows the room as
awake, its players are disconnected first. If it shows the room as asleep but the room has woken up
since the page loaded, the delete is refused and says so; reload, and the row will show it awake.
It is the same route irtio rooms delete uses, so the
same rules apply, including the refusal for relay projects and the refusal when we cannot reach the
server holding the room.
Deployments
One row per version, newest marked live and the rest superseded, each with a summary of its schema
diff (2 additive, 1 breaking, first deploy) and whether a migration was attached. This is the
fastest way to answer “did my deploy land, and what did it change”. See schema changes and migrations.
Logs
The same stream as npx irtio logs, with the room picker doing what --room does and a live tail
doing what --follow does. Both narrow on the server, so a quiet room is not crowded out of the
page by a noisy neighbour. Full details on the logs page.
Leaderboards
One row per board, with its row count, its direction and its scope: all-time, or its period and
the key it is writing into now, and buckets when it has them. Selecting a board reads one ranking
and pages through it. A rotating board gets a picker over the periods it still keeps, so last
week’s board is one click away; a bucketed board gets a field to type the bucket in, because bucket
names are your game’s own strings and there is no read across all of them. The field remembers the
last bucket you typed, in your browser. Full details on the leaderboards page.
Removing a player removes them from every period and every bucket of that board, which is what a privacy request means.
API keys
There is no list of API keys, because irtio does not use them. Your project id is your public project key: it ships in your client bundle and it is what a joining client sends. What keeps it yours is the allowed-origins list, and that is what this page edits. Add an origin with the form, remove one with its button.
An empty list accepts only localhost, which is always allowed on any port, so a dev server pointed
at your deployed project needs nothing here. Every other origin has to be on the list, matched on
scheme, host and port. A site published with irtio deploy --static registers its own origin when
it activates, so it appears here on its own. Add * to accept every origin, which is what a build
hosted somewhere you do not control (itch.io, an embed) needs. If that host serves other games
from the same origin, see shared origins before you use identity: true.
Local inspector
Run irtio dev and open http://localhost:7070/__irt/ to inspect live room state while developing.