Control plane
Sign in with Keycloak (OIDC + PKCE), an IdP broker (Microsoft Entra, GitHub, Google), an API key, or OAuth2 client credentials for M2M agents (dev/testing). Hypermesh / Hyperme.sh uses this Keycloak sign-in plus org invite and groups. There is no second Hypermesh IdP.
SSO uses the same Keycloak PKCE client with kc_idp_hint. Brokers need real client IDs in the realm (see infra/keycloak/README.md).
or
API key mode
Sends X-Api-Key + X-Tenant-ID.
or
OAuth2 client credentials (M2M)
Uses NEXT_PUBLIC_KEYCLOAK_ISSUER token endpoint; stores access token in sessionStorage only.