> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.
# Lender console
> The Lender web console: how it signs in, the screens it ships with today, and the work it deliberately leaves to the API.
The **Lender console** is a browser interface over the same [API](/en/products/lender/lender-rest-api) you can drive programmatically. It is a single environment-agnostic bundle: a deployment serves the console its configuration at start-up, so the same image points at any environment.
This page documents the screens that are in the build today. Screens still running against mocked data while their backend lands are deliberately left out of it.
## Signing in
***
The console is a standard OpenID Connect client. It runs the authorization-code flow with PKCE straight from the browser to the identity provider you configure — point it at the same Access Manager that issues the API tokens — exchanges the code for tokens, and refreshes them on demand before they expire.
Tokens live in memory only. They are never written to browser storage, so a reload or a new tab starts from the sign-in screen rather than from a session someone else could read off the device.
After the exchange the console asks Lender who the caller is, and takes the permissions it renders from that answer rather than from the token. An action the identity may not perform is not shown, unless the deployment's tokens carry no declared permissions at all: the console then shows every action and lets the server refuse the ones the identity may not take. Signing out ends the local session and, when you configure the provider's end-session URL, signs the user out at the provider too; without that URL the provider's own session survives and the next sign-in skips the prompt.
**Authentication ships turned off.** In its default configuration the console establishes no session, shows every screen, and sends no bearer token — which is the state a deployment gets if nobody configures the identity provider. Turn it on and supply the authorization endpoint, the token endpoint, and the client id before the console reaches anyone. Turning it on without those three is refused loudly, with a misconfiguration screen rather than partial access.
## What you can do in it
***
| Area | Screens | What an operator does there |
| ---------- | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Portfolio | Dashboard | The landing screen. Exposure, delinquency buckets, the trend over recent months, and the delinquent-loan register for a business date, each row opening the loan account behind it. See [Portfolio and delinquency](/en/products/lender/portfolio-and-delinquency). |
| Credit | Loan products | List and filter the catalog, walk the wizard that creates a product and its first version, and build a version's accounting profile. See [Define a loan product](/en/products/lender/define-a-loan-product). |
| Credit | Loan applications | List and filter applications, create one against a product version after previewing its schedule, and open one to approve, reject, withdraw, or disburse it. See [Originate a loan](/en/products/lender/originate-a-loan). |
| Credit | Credit instrument | Emit the CCB for an application against the loan product's published document template, list the instruments already emitted for it, and download one. |
| Credit | Loan accounts | List live accounts and open one for its schedule, transactions, charges, and audit trail, with record-repayment, prepay, and reschedule actions and the Brazilian panel for PDD stage, prepayment quote, and tax. See [Service a loan](/en/products/lender/service-a-loan). |
| Accounting | Accrual runs | Queue a run for a business date, and retry the items of one that did not finish. See [Accounting and accrual runs](/en/products/lender/accounting-and-accrual-runs). |
| Accounting | Journal references | Resolve a correlation id or a reference id to the posting it names. |
| Operations | Divergence queue | The consignado exception desk: filter by category, effect, status, assignee, and breached deadline, then open one to compare the client's declared fact against Lender's own, assign it, dispose of it, or send it back to the queue. |
| Operations | Assignment desk | Assemble a set of receivables for a fund, check its eligibility, approve it, produce the offer file, ingest the remessa the fund returns, record the endorsement term, and work the exceptions the set raises. |
| Settings | Jurisdictions | Read the jurisdiction profiles compiled into the service. |
The console has no permission model of its own. Every action it offers goes through the same API operation, authorized by the same identity and tenant.
## What the console does not do
***
Five surfaces were removed from the build because nothing behind them answered: reconciliation, CNAB export, rescission capture, portability capture, and the consignado contract sheet and list. An account already in a portability-requested state still displays as one; what is gone is the screen that claimed to start it.
There is no consignado contract screen because a consignado contract is not created in the console. A CLT contract arrives as a fact from the gateway once the client's own systems have registered it with the payroll rail, and private and INSS lending is originated through the ordinary loan application above. See [Consignado privado](/en/products/lender/consignado-privado).
## Next steps
***
Everything the console does, driven programmatically.