Monitor every workspace and every user, and act on any of them — plan, status, seat cap, session revocation, password reset, and audited "Login as". Nothing here touches a tenant's own login; this is the control plane.
Sign in to manage every Bridge CRM workspace.
Only ACTIVE workspaces on a priced plan are billed, one invoice per workspace per month. Pressing this twice cannot double-bill anyone.
| Workspace | Period | Plan | Amount | Due | Status | Action |
|---|
| Workspace | Plan | Status | Users | Online | Leads | Monthly | Paid through | Record payment |
|---|
One reviewed app, and every plan connects through it. The plan mapping is here so a plan can be moved to a different app from this screen instead of by redeploying environment variables — leave a plan unset and it uses the default app.
| App | App ID | Secret | Scopes | Active |
|---|
| Workspace | Plan | App | App ID | Source |
|---|
Bridge CRM's own verified developer apps. When one is complete and switched on, every workspace connects that platform with one click — no developer app, no keys. A workspace that saves its own app keeps using it. Secrets are write-only: leave a secret box blank to keep what is stored.
Straight from the people using the CRM — owners, managers and agents, on web and on the phone. Nothing here is anonymous: every entry carries who said it and from which workspace.
| When | Who | Workspace | From | Rating | What they said | Status |
|---|
Every customer account. Change a plan or seat limit, suspend, or open a workspace to manage its people.
Protect the console itself. Every super-admin sign-in should need a password and a code from your phone.
After setup completes, every super-admin login requires password plus current six-digit authenticator code. Do not leave this page before saving recovery material outside CRM.
Google Authenticator → + → Enter a setup key. Account: Bridge CRM Control. Copy secret once; it disappears when you leave this page.
Platform operator assistant. It can prepare tenant actions from a clear command. Every write shows a preview and requires explicit confirmation. Secrets never enter the conversation or response.
Supported now: add Agent, Manager, or Admin to a workspace. Say name, email, role, and workspace. Password creation stays inside secure user-invite flow.
No pending action.
High-risk actions — deletion, billing, credentials, access revocation — require separate MFA-backed flows.
Add encrypted keys. Bridgy web voice uses Deepgram Voice Agent; Groq GPT-OSS handles reasoning. Text Bridgy uses Groq GPT-OSS. Keys never return to this page; only short fingerprints show. Lower priority runs first. Disable before removal when rotating.
No saved key can be revealed. Change label, state, or priority; removal is permanent.
| Provider | Label | Fingerprint | Priority | State | Updated | Actions |
|---|
Every user in this workspace. "Login as" mints a short-lived, audited tenant session; "Kill" revokes all of a user's sessions; "Reset" issues a one-time password link; "Delete" removes the user permanently.
| Name | Role | Active | Last seen | Leads | Calls today | Actions |
|---|
Recent activity types and times. Customer notes and lead names stay in the workspace.
Your own Razorpay / Stripe keys — the ones this business collects subscription money with. Every secret is encrypted with AES-256-GCM the moment it is saved and is never sent back to this screen: a field can only ever tell you whether something is stored. A workspace's own gateway, for collecting fees from its customers, is a separate setting inside that workspace.
Manual is the honest default: you set each account's plan and status by hand and invoice off-platform. Saving keys here does not start charging anyone — subscription checkout is not built — but it does put the keys in the server's hands, and the live check below proves they work.
Dashboard → Account & Settings → API Keys for the pair, then Settings → Webhooks for the secret. A key beginning rzp_test_ authenticates perfectly and collects nothing real — the live check names which kind you pasted.
Dashboard → Developers → API keys for the pair, then Developers → Webhooks for the signing secret (it begins whsec_). The publishable key is not a secret and is shown back to you; the secret key is not.
What actually reached those URLs, and whether its signature verified against the secret saved above. A rejected delivery is recorded too — the gateway's own dashboard shows you a bare 401 and nothing about why. Send a test event from the gateway, then refresh.
Nothing has arrived yet.
Deliveries are verified and logged, and nothing else: an inbound event never changes a plan, a status or a trial. That stays a decision you make on the workspaces screen, so no payload can buy an upgrade.