Admin access only

Secure the control room before anything else.

Every admin page now requires verified sign-in. The token is stored in an HTTP-only server cookie so it stays out of browser storage and is sent securely with admin requests.

Protected routes

Dashboard, products, categories, orders, customers, and settings all redirect here until login succeeds.

Server cookie

Admin auth is now carried in a secure HTTP-only cookie instead of exposing the token to client-side storage.

OTP login

Use an admin-approved phone number