SSO and domain settings

Team identity panel with name and identifier fields, a default member role Select, who-can-invite radio rows, and a discoverable toggle with its privacy consequence spelled out.

2FA settings panel with authenticator app, SMS fallback, and backup codes rows plus a workspace-wide require 2FA toggle.

Webhook endpoint list with mono URLs, event Badges, per-row delivery status, a masked signing secret with reveal and roll actions, and retry policy prose.

Workspace identity panel with name, slug, URL preview, rename warning, logo upload, and default role select.

API keys list with prefix-masked values, environment badges, created and last used dates, and a Revoke action.

Theme tile selector, accent color swatches, interface density toggle, and a reduce-motion Switch for personal look-and-feel.

Audit log configuration with a retention period select, an admins-only access note, a CSV export with recent export history, and an immutability callout.

Spend alert switches at 80 and 100 percent of plan, a hard-cap option with stated consequence, and a recipient email field.

Workspace branding panel with logo upload, accent color swatches, a subdomain field, and an honest note on where branding actually appears.

Ruled list of OAuth apps with scope badges, connected date, authorizing member, and an instant Revoke action per row.

Calm account settings panel with section navigation, editable profile fields, content toggles, and a language selector.

Three escalating workspace actions stating exactly what each destroys and what survives, with outline buttons.