Restricted administration

Staff sign-in

TukApp staff access uses the backend session contract directly. Permissions and scope are checked again on every request.