Admin Web App
The admin web app is the operator-facing control plane for a ThinkWork deployment. Platform operators, agent authors, and audit owners live here — configuring the tenant platform agent, Spaces, threads, MCP servers, webhooks, tenant settings, and controls. End users live in the Mobile App.
The admin app is a Vite + React 19 single-page application with file-based routing through TanStack Router. It talks to the same GraphQL + REST endpoints the mobile app does, scoped with an x-tenant-id header on every request, and it authenticates through AWS Cognito with optional Google SSO.
Who uses it
Section titled “Who uses it”Three rough personas:
- Platform operators — the people who stood up ThinkWork in AWS and configure the tenant. They live under Dashboard, Threads, Spaces, Tenant Agent, Webhooks, Settings, and Observability.
- Agent authors — the people building and iterating on the tenant agent, Space workspaces, folder specialists, templates, skills, Memory sources, and guardrails. They live under Tenant Agent, Spaces, Agent Templates, Skills, Memory, and Security Center.
- Audit / observability owners — the people watching usage, cost, and safety. They live under Analytics, Security Center, Inbox, and the thread audit view.
All three are tenant-scoped. The admin app is multi-tenant at the routing level: the _authed/_tenant layout enforces a tenant selection before loading any tenant data.
Navigate this section
Section titled “Navigate this section”The admin sub-pages mirror the admin app’s own sidebar — Work, Platform, and Manage groups — plus a few foundational pages up front.
Foundations
Section titled “Foundations”- Authentication & Tenancy — Cognito sign-in, tenant resolution, JWT plumbing, global dialogs, layout components
- Dashboard — the landing page with metric cards, recent activity, and recent threads
- Threads — the thread list and detail view with Kanban, grouped table, live subscriptions, inline edit, and thread audit
- Inbox — the approval queue for agent-requested human-in-the-loop actions, including system-agent workspace reviews
- Automations — recurring agent work, scheduled jobs, and routine triggers (cron, rate, one-shot, multi-step workflows)
Platform
Section titled “Platform”- Memory — Memory, Pages, Knowledge Bases, and Sources verification/configuration in one tabbed surface
- Tenant Agent — the platform agent baseline, workspace, and folder specialists for the tenant
- Spaces — contextual workrooms with workspace files, KBs, triggers, settings, and Private Space members
- Agent Templates — reusable and legacy template bundles for agent authoring infrastructure
- Agent Invites — BYOB agent invitations and join-request approvals
- Skills Catalog — the public catalog, tenant-installed skills, and the custom skill builder
- Tenant MCP Servers — registering MCP servers at the tenant level (user tokens are issued from mobile)
- Built-in Tools — platform-owned tools such as Web Search, Code Sandbox, Browser Automation, and Send Email
- Security Center — guardrails, stats, template assignments, and the blocks audit
Manage
Section titled “Manage”- Analytics — Activity, Cost, and Performance views
- Webhooks — custom HTTP webhooks that fire agents or routines on external POSTs
- Model Catalog — tenant Bedrock model imports, pricing health, display names, and availability
- Artifacts — thread-generated reports, plans, notes, and digests
- Humans — tenant user management and invites
- Settings — tenant configuration and read-only deployment metadata
- Managed Applications — operator-owned optional applications such as Cognee, Twenty CRM, and Plane
What lives in the admin app vs the mobile app
Section titled “What lives in the admin app vs the mobile app”The rule of thumb: the admin app configures the tenant; the mobile app is where end users do the work.
| Capability | Where |
|---|---|
| Configure the tenant platform agent or a Space | Admin |
| Register an agent template for reusable authoring infrastructure | Admin |
| Connect your personal Google account to an agent | Mobile |
| Register a tenant-level MCP server (URL, transport, auth type) | Admin |
| Grant your personal OAuth token to that MCP server | Mobile |
| Configure guardrails, budgets, Space settings, and audit retention | Admin |
| Chat with an agent, review threads, act on external tasks | Mobile |
| Upload knowledge-base documents or inspect Memory | Admin |
| Register a webhook with a signing secret | Admin |
| See a push notification when you’re assigned a task | Mobile |
When in doubt: tenant-level → admin, user-level → mobile.
Related pages
Section titled “Related pages”- Mobile App — the end-user client
- CLI — the
thinkwork-clideploy and management tool - Managed Applications — optional app deployment controls exposed through Spaces Settings
- Architecture — how the admin app fits into the three-tier deployment model
- Spaces — the contextual workroom model
- Integrations — the OSS integration foundation for MCP, OAuth, webhooks, and premium modules
- Concepts: Threads — the underlying work-record model the admin app exposes