The panel

Type /keystone panel in game. Keystone puts a link in chat, you click it, and the editor opens signed in. That is the whole thing — no account, no portal, no password to invent.

Where the page comes from

Your own server. The editor is built into the jar and served off the same process that runs the game, on the local API's address. Nothing is fetched from us and nothing is sent to us, which is why it works with the network cable pulled out and why it cannot stop working because something of ours is down.

The link, and why it expires

A chat line is not a secret. It is in a log file, possibly in a screenshot, and on a staffed server it was read by whoever was standing nearby. So the token in the link:

• works once — the second person to click it gets nothing,
• lasts five minutes,
• and is exchanged for an ordinary key, not for a session that lives forever.

The key behind it is named after you (panel: <your name>), lasts a day, and carries the scopes you already had. keystone key revoke <id> takes it back early, and revoking yours touches nobody else's.

If a link is clicked late, or twice, the page says so and tells you to type the command again. Which of the two it was is deliberately not said — that is not the clicker's business.

What is in it

Screen	What it is for
Operations	What is scheduled — restarts, backups, cleanups, notices — and what has already run, including what was skipped and why. Anything on the timetable can be run by hand, and it takes the same road: the same warnings, the same countdown, the same record.
Players	Who is on, who has been, and what each of them is allowed.
Groups	Permission groups, and what inherits from what.
Performance	Every load test this server has run and what gave out first.
Console	The server's own console, live, with the commands you would type into it.
Assistant	Questions about this server, answered from its own state. Needs a model address set.
Settings	Every setting Keystone has, with what it means. Saving applies without a restart.
Keys	The keys that can reach the local API, what each may do, and a way to take one back.

A screen never appears before it answers. There is no tab that errors and no tab labelled "coming soon".

If the page does not open

• "No editor in this build" — the jar was built without the editor. Use a release build rather than one built from source without the front end.
• The browser cannot reach the address. The local API listens on 127.0.0.1 by default, so the link works from the machine the server runs on. From anywhere else, either tunnel or set api.reachable-at (below) — and read the local API on what you are exposing before you change it.
• The link expired. Type /keystone panel again; they are free.

When the editor has to be reachable from elsewhere (0.1.1 and newer)

The address the API listens on and the address somebody types into a browser are not the same thing. 0.0.0.0 is a good answer to the first and an unusable answer to the second — a link reading http://0.0.0.0:25586/… opens nowhere. So:

/keystone set api.address 0.0.0.0
/keystone set api.reachable-at 192.168.1.100

Leave api.reachable-at empty with the API on a real address and that address is used. Leave it empty with the API on 0.0.0.0 and the mod asks the machine for its own address on the network, with loopback only as a last resort. Setting it wins, which is what you need behind a router, through a tunnel, or under a name you gave the machine.

The link is composed when you ask for one rather than when the server booted, so this setting applies immediately — which matters, because it is the setting you reach for after a link did not open.

Turning it off

/keystone set api.enabled false stops the local API, and the panel with it. Everything else keeps working — the panel is a way in, not a dependency.