Signing in proves who you are. Whether you may open the console is a separate check against an operator allowlist, made on every request — so access is granted and revoked by editing that list, and there is no session to wait out. The console shows customer names, emails, wallets and balances, and can approve real sends, which is why the two checks are kept apart.

Deployments with no browser login have a command-line route instead: npm run console:token <email> mints a signed cookie for an address already on the allowlist.