> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blend.money/llms.txt
> Use this file to discover all available pages before exploring further.

# Portal Operations

> Day-to-day portal operations: flow plans, credentials, team management, and audit logs.

Day-to-day portal operations: flow plans, credentials, team management, and audit logs.

## Flow plans

Flow plans are rebalancing orders that move user funds to match your account type's target allocations. Blend generates them automatically when drift is detected.

### How a flow plan works

1. Blend detects that a user's positions have drifted from the target allocation.
2. A flow plan is created with the transfers needed to rebalance.
3. The plan executes (or waits for your approval, depending on your auto-approve setting).

### Flow plan statuses

```mermaid theme={"theme":{"light":"github-light","dark":"github-dark"}}
flowchart LR
    PA[PENDING_APPROVAL] --> Q[QUEUED]
    Q --> S[SOLVING]
    S --> E[EXECUTING]
    E --> SE[SETTLED]
    E --> F[FAILED]
    PA --> C[CANCELLED]
    Q --> C

    classDef active fill:#3b82f6,stroke:#1e40af,color:#fff
    classDef terminal fill:#10b981,stroke:#047857,color:#fff
    classDef error fill:#ef4444,stroke:#b91c1c,color:#fff

    class PA,Q,S,E active
    class SE terminal
    class F,C error
```

| Status                 | What's happening                             | Terminal? |
| ---------------------- | -------------------------------------------- | --------- |
| **`PENDING_APPROVAL`** | Waiting for an Admin or Operator to approve  | No        |
| **`QUEUED`**           | Approved and in the execution queue          | No        |
| **`SOLVING`**          | Blend is computing the optimal transfer path | No        |
| **`EXECUTING`**        | On-chain transactions are in progress        | No        |
| **`SETTLED`**          | All transfers completed                      | Yes       |
| **`FAILED`**           | One or more transfers failed on-chain        | Yes       |
| **`CANCELLED`**        | Manually cancelled before execution          | Yes       |

### Approving flow plans

When auto-approve is off, flow plans wait in `PENDING_APPROVAL` until an Admin or Operator reviews them.

**Single approval**: Click a flow plan to see the transfer details, then click **Approve**. The plan moves to `QUEUED` and starts executing.

**Batch approval**: Select multiple plans from the list and click **Approve Selected**. All selected plans move to `QUEUED` at once.

### Auto-approve

Turn on auto-approve in your account type settings to skip manual review. New flow plans move straight from creation to `QUEUED`. This is the recommended setting for production once you're comfortable with your allocations.

<Warning>
  Deposits and withdrawals return a 409 error (`FLOWPLAN_CONFLICT`) while a flow plan is executing. Your SDK integration should handle this by retrying after the plan settles.
</Warning>

## Credentials

Manage all authentication credentials under **Settings > Credentials**.

### SIWE domain

The SIWE domain tells Blend which domain can sign in users via wallet signatures. Enter your app's domain as `yourdomain.com` or `yourdomain.com:3000` for local development. Blend normalizes this to lowercase.

Frontend SDK authentication won't work without a SIWE domain configured.

### Publishable keys

Each account type gets its own publishable key (`pk_live_` followed by 64 hex characters). Find it on the account type detail page. This key is safe for client-side code and identifies your account type in frontend SDK calls.

### API keys

API keys authenticate server-to-server calls. Create them under **Settings > Credentials**.

**Creating a key**: Click **Create API Key** and give it a name like "production-server" or "staging". The full secret is shown once. Copy it immediately and store it in your server's environment variables.

**Rotating a key**: Create a new key, update your server config, then deactivate the old one. You can have multiple active keys during the transition.

**Deactivating a key**: Deactivation is one-way. A deactivated key can't be reactivated. Create a new key instead.

<Tip>
  Never expose API keys in frontend code, version control, or logs. They look like `sk_live_` followed by a long random string.
</Tip>

### Signing key rotation

Rotating the signing key invalidates every active SDK session. All signed-in users will need to sign in again. The portal limits this to 3 rotations per hour.

Only rotate the signing key if you suspect it has been compromised.

## Team management

Manage your team under **Settings > Members**.

### Roles

| Role          | Read | Write | Manage members | Approve flow plans | Edit org settings |
| ------------- | ---- | ----- | -------------- | ------------------ | ----------------- |
| **Admin**     | Yes  | Yes   | Yes            | Yes                | Yes               |
| **Operator**  | Yes  | Yes   | No             | Yes                | No                |
| **Developer** | Yes  | Yes   | No             | No                 | No                |
| **Viewer**    | Yes  | No    | No             | No                 | No                |

Admins have full control. Operators can approve flow plans but can't manage team members. Developers can create account types and manage credentials. Viewers have read-only access.

### Inviting members

Click **Invite** to send an email invitation. Enter the email address and assign a role. Invitees appear in a pending section until they accept.

### Changing roles

Click a member to change their role. The portal prevents you from removing the last Admin. If you need to step down, promote someone else first.

### Disabling members

Disabled members lose portal access but remain in the member list. You can re-enable them later. Disabled members appear in a collapsible section at the bottom of the members page.

## Audit logs

Every portal action is logged. View audit logs under **Settings > Audit Logs**.

### What's logged

All state-changing actions: account type creation, allocation changes, flow plan approvals, member invites, role changes, credential operations, and settings updates. Each log entry records who did what, when, and to which entity.

### Filtering

Filter logs by action type, entity type, entity ID, or date range. Results are paginated with 25 entries per page.

### Detail view

Click any log entry to see the full metadata, including the raw JSON payload of the change. Use this for debugging or compliance reviews.

These logs are the portal half of Blend's [per-account audit trail](/blend/compliance). On-chain activity is independently verifiable on any block explorer.

<CardGroup cols={2}>
  <Card title="Test with Try Position" icon="flask-vial" href="/build/portal/try-position">
    Test deposits and withdrawals directly in the portal.
  </Card>

  <Card title="Managing products" icon="grid-2" href="/build/portal/managing-products">
    Set up account types, browse the catalog, and track metrics.
  </Card>
</CardGroup>