Admin Web App

The admin web app is the operator-facing control plane for a ThinkWork deployment. Platform operators, agent authors, and audit owners live here — configuring agents, watching threads, wiring up connectors, managing tenant settings, and enforcing controls. End users live in the Mobile App.

The admin app is a Vite + React 19 single-page application with file-based routing through TanStack Router. It talks to the same GraphQL + REST endpoints the mobile app does, scoped with an x-tenant-id header on every request, and it authenticates through AWS Cognito with optional Google SSO.

Note

Tenant-level configuration (MCP servers, connector credentials, guardrails, budgets, webhooks) lives in the admin app. Per-user connections — where an end user grants their personal OAuth credentials — live in the Mobile App. Admin owns infrastructure; users own their own credentials.

Who uses it

Three rough personas:

• Platform operators — the people who stood up ThinkWork in AWS and configure the tenant. They live under Threads, Connectors, Webhooks, Settings, and Observability.
• Agent authors — the people building and iterating on agents, templates, skills, knowledge bases, and guardrails. They live under Agents, Agent Templates, Skills, Memory, and Security Center.
• Audit / observability owners — the people watching usage, cost, and safety. They live under Analytics, Security Center, Inbox, and the thread audit view.

All three are tenant-scoped. The admin app is multi-tenant at the routing level: the _authed/_tenant layout enforces a tenant selection before loading any tenant data.

Navigate this section

The admin sub-pages mirror the admin app’s own sidebar — Work, Agents, and Manage groups — plus a few foundational pages up front.

Foundations

• Authentication & Tenancy — Cognito sign-in, tenant resolution, JWT plumbing, global dialogs, layout components

Work

• Dashboard — the landing page with metric cards, recent activity, and recent threads
• Threads — the thread list and detail view with Kanban, grouped table, live subscriptions, inline edit, and thread audit
• Inbox — the approval queue for agent-requested human-in-the-loop actions, including system-agent workspace reviews
• Automations — recurring agent work, scheduled jobs, and routine triggers (cron, rate, one-shot, multi-step workflows)

Agents

• Agents — the agent roster plus the per-agent detail tabs (Skills, Knowledge, Memory, Sub-agents, Workspaces, Scheduled Jobs)
• Agent Templates — reusable template bundles and the explicit sync flow to linked agents
• Agent Invites — BYOB agent invitations and join-request approvals
• Skills Catalog — the public catalog, tenant-installed skills, and the custom skill builder
• Tenant MCP Servers — registering MCP servers at the tenant level (user tokens are issued from mobile)
• Built-in Tools — platform-owned tools such as Web Search, Code Sandbox, Browser Automation, and Send Email
• Security Center — guardrails, stats, template assignments, and the blocks audit

Manage

• Memory — the memory corpus viewer with semantic search and an optional 3D knowledge-graph view
• Knowledge Bases — Bedrock KB management, document upload, and sync status
• Analytics — Activity, Cost, and Performance views
• Webhooks — custom HTTP webhooks that fire agents or routines on external POSTs
• Artifacts — thread-generated reports, plans, notes, and digests
• Humans — tenant user management and invites
• Settings — tenant configuration and read-only deployment metadata

What lives in the admin app vs the mobile app

The rule of thumb: the admin app configures the tenant; the mobile app is where end users do the work.

Capability	Where
Register an agent or agent template	Admin
Connect your personal Google account to an agent	Mobile
Register a tenant-level MCP server (URL, transport, auth type)	Admin
Grant your personal OAuth token to that MCP server	Mobile
Configure guardrails, budgets, and audit retention	Admin
Chat with an agent, review threads, act on external tasks	Mobile
Upload knowledge-base documents	Admin
Register a webhook connector with a signing secret	Admin
See a push notification when you’re assigned a task	Mobile

When in doubt: tenant-level → admin, user-level → mobile.

Related pages

• Mobile App — the end-user client
• CLI — the thinkwork-cli deploy and management tool
• Architecture — how the admin app fits into the three-tier deployment model
• Concepts — the underlying product model the admin app exposes