> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamly.watch/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles Overview

> Operator, tenant owner, viewer, and platform roles in Streamly — who signs in where and what they can do.

Streamly separates **operator**, **tenant owner**, and **viewer** access. Auth uses Supabase with **separate cookie jars** so admin sessions never collide with viewer sessions.

## Role Map

| Role             | Signs in at                    | Primary UI                       | Can do                                                             |
| ---------------- | ------------------------------ | -------------------------------- | ------------------------------------------------------------------ |
| **Operator**     | `/admin/login`                 | `/admin/*`                       | Activate license, manage catalog, themes, plugins, plans, settings |
| **Tenant owner** | Viewer-style auth + membership | `/dashboard/*`                   | Tenant-scoped ops (movies, providers, branding, API keys, …)       |
| **Viewer**       | `/login`, `/signup`            | Storefront                       | Browse (gated routes), watch, subscribe, profiles, my list         |
| **Anonymous**    | —                              | Public marketing + gated prompts | View public landing; movies/shows routes require auth              |

## Operator

* Activated with Envato/CodeCanyon purchase code (or demo license when `ENABLE_DEMO` / `ADMIN_ALLOW_DEMO_LICENSE` is set).
* Cookie scope: `sb-streamly-operator-auth-token`.
* Platform host only for admin UI (tenant hosts redirect to `NEXT_PUBLIC_PLATFORM_HOST`).

## Viewer

* Standard email/password (and Supabase auth callback at `/auth/callback`).
* Cookie scope: `sb-streamly-viewer-auth-token`.
* After login, **Who’s Watching** may force `/profiles` until a `viewer_profiles` row is selected (`streamly_viewer_profile` cookie).

Demo viewer (when configured): `demo@streamly.watch` / `demo123456` — **not** the operator account.

## Tenant Owner

Uses the dashboard nav in `lib/streamly/dashboard-nav.ts`. Several items are **inactive** in the current UI (genres, homepage, metadata, viewer plans, viewers, reports) — do not treat those as shipped until enabled.

## Platform vs Tenant Host

| Concern                | Platform host                  | Tenant host                      |
| ---------------------- | ------------------------------ | -------------------------------- |
| `/admin`, `/dashboard` | Served here                    | Redirect to platform host        |
| Storefront             | Default / brand tenant         | That tenant’s catalog + branding |
| Marketing rewrites     | `/about` → `/site/about`, etc. | Tenant landing where applicable  |

## Permissions Model

Fine-grained checks are enforced in middleware, RLS, and API handlers. Operators use `/api/operator/*`; viewers and tenant clients use `/api/v1/*` with tenant context from the host and session.

Details: [Authentication Flow](/authentication/authentication-flow), [Roles & Permissions](/authentication/roles-permissions).

## Related

* [Authentication Flow](/authentication/authentication-flow)
* [Profiles (Who’s Watching)](/authentication/profiles)
* [Admin Overview](/admin-dashboard/overview)