> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gensparx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Dashboard

# Dashboard (Control UI)

The Gateway dashboard is the browser Control UI served at `/` by default
(override with `gateway.controlUi.basePath`).

Quick open (local Gateway):

* [http://127.0.0.1:18789/](http://127.0.0.1:18789/) (or [http://localhost:18789/](http://localhost:18789/))

Key references:

* [Control UI](/web/control-ui) for usage and UI capabilities.
* [Tailscale](/gateway/tailscale) for Serve/Funnel automation.
* [Web surfaces](/web) for bind modes and security notes.

Authentication is enforced at the WebSocket handshake via `connect.params.auth`
(token or password). See `gateway.auth` in [Gateway configuration](/gateway/configuration).

Security note: the Control UI is an **admin surface** (chat, config, exec approvals).
Do not expose it publicly. The UI stores the token in `localStorage` after first load.
Prefer localhost, Tailscale Serve, or an SSH tunnel.

## Fast path (recommended)

* After onboarding, the CLI auto-opens the dashboard and prints a clean (non-tokenized) link.
* Re-open anytime: `gensparx dashboard` (copies link, opens browser if possible, shows SSH hint if headless).
* If the UI prompts for auth, paste the token from `gateway.auth.token` (or `GENSPARX_GATEWAY_TOKEN`) into Control UI settings.

What you should expect on first load:

* A connect screen with the gateway URL, token, and optional password fields.
* A short checklist for `gensparx gateway run` and `gensparx dashboard --no-open`.
* Once connected, the overview page surfaces health, recent sessions, skills, automation, and logs in one place.

## Token basics (local vs remote)

* **Localhost**: open `http://127.0.0.1:18789/`.
* **Token source**: `gateway.auth.token` (or `GENSPARX_GATEWAY_TOKEN`); the UI stores a copy in localStorage after you connect.
* If `gateway.auth.token` is SecretRef-managed, `gensparx dashboard` prints/copies/opens a non-tokenized URL by design. This avoids exposing externally managed tokens in shell logs, clipboard history, or browser-launch arguments.
* If `gateway.auth.token` is configured as a SecretRef and is unresolved in your current shell, `gensparx dashboard` still prints a non-tokenized URL plus actionable auth setup guidance.
* **Not localhost**: use Tailscale Serve (tokenless for Control UI/WebSocket if `gateway.auth.allowTailscale: true`, assumes trusted gateway host; HTTP APIs still need token/password), tailnet bind with a token, or an SSH tunnel. See [Web surfaces](/web).

## If you see "unauthorized" / 1008

* Ensure the gateway is reachable (local: `gensparx status`; remote: SSH tunnel `ssh -N -L 18789:127.0.0.1:18789 user@host` then open `http://127.0.0.1:18789/`).
* Retrieve or supply the token from the gateway host:
  * Plaintext config: `gensparx config get gateway.auth.token`
  * SecretRef-managed config: resolve the external secret provider or export `GENSPARX_GATEWAY_TOKEN` in this shell, then rerun `gensparx dashboard`
  * No token configured: `gensparx doctor --generate-gateway-token`
* In the dashboard settings, paste the token into the auth field, then connect.