Private command center access stays behind a real sign-in flow.

Request a magic link with your approved admin email. Hidden routes alone are not treated as security controls.

Allowlist enforced

Only invited admin emails should be able to enter `/admin`.

Server-side checks

Sensitive admin APIs are protected separately from the page route.

Admin Login

Magic-link sign-in with Supabase Auth

Admin email