diff --git a/build/api/react-client-tenant.api.md b/build/api/react-client-tenant.api.md
index 6e74bcff6d..4c23f26c5c 100644
--- a/build/api/react-client-tenant.api.md
+++ b/build/api/react-client-tenant.api.md
@@ -4,18 +4,1489 @@
 
 ```ts
 
+import { ChangeMyPasswordErrorCode } from '@contember/graphql-client-tenant';
+import { ConfirmOtpErrorCode } from '@contember/graphql-client-tenant';
+import { Context } from 'react';
+import { CreateApiKeyErrorCode } from '@contember/graphql-client-tenant';
+import { CreatePasswordResetRequestErrorCode } from '@contember/graphql-client-tenant';
+import { CreateSessionTokenErrorCode } from '@contember/graphql-client-tenant';
 import { Fetcher } from 'graphql-ts-client-api';
+import { InitSignInIDPErrorCode } from '@contember/graphql-client-tenant';
+import { InviteErrorCode } from '@contember/graphql-client-tenant';
+import { InviteOptions } from '@contember/graphql-client-tenant';
+import { JSX as JSX_2 } from 'react/jsx-runtime';
+import { MembershipInput } from '@contember/graphql-client-tenant';
 import { ModelType } from 'graphql-ts-client-api';
+import { MutationFetcher } from '@contember/graphql-client-tenant';
+import { ReactElement } from 'react';
+import { ReactNode } from 'react';
+import { ResetPasswordErrorCode } from '@contember/graphql-client-tenant';
+import { SetStateAction } from 'react';
+import { SignInErrorCode } from '@contember/graphql-client-tenant';
+import { SignInIDPErrorCode } from '@contember/graphql-client-tenant';
+import * as TenantApi from '@contember/graphql-client-tenant';
+import { UpdateProjectMemberErrorCode } from '@contember/graphql-client-tenant';
+
+// @public (undocumented)
+export const addProjectMemberMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.AddProjectMemberErrorCode;
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        } & {
+            readonly membershipValidation?: readonly ({
+                readonly code: TenantApi.MembershipValidationErrorCode;
+            } & {
+                readonly role: string;
+            } & {
+                readonly variable?: string | undefined;
+            })[] | undefined;
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly projectSlug: string;
+    readonly identityId: string;
+    readonly memberships: readonly TenantApi.MembershipInput[];
+}>;
+
+// @public (undocumented)
+export type AddProjectMemberMutationVariables = Parameters<ReturnType<typeof useAddProjectMemberMutation>>[0];
+
+// @public (undocumented)
+export const ChangeMyPasswordForm: ({ children, onSuccess }: ChangeMyPasswordFormProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type ChangeMyPasswordFormContextValue = FormContextValue<ChangeMyPasswordFormValues, ChangeMyPasswordFormErrorCode>;
+
+// @public (undocumented)
+export type ChangeMyPasswordFormError = FormError<ChangeMyPasswordFormValues, ChangeMyPasswordFormErrorCode>;
+
+// @public (undocumented)
+export type ChangeMyPasswordFormErrorCode = ChangeMyPasswordErrorCode | 'FIELD_REQUIRED' | 'INVALID_VALUE' | 'PASSWORD_MISMATCH' | 'UNKNOWN_ERROR';
+
+// @public (undocumented)
+export interface ChangeMyPasswordFormProps {
+    // (undocumented)
+    children: ReactElement;
+    // (undocumented)
+    onSuccess?: () => void;
+}
+
+// @public (undocumented)
+export type ChangeMyPasswordFormState = FormState;
+
+// @public (undocumented)
+export type ChangeMyPasswordFormValues = {
+    currentPassword: string;
+    newPassword: string;
+    passwordConfirmation: string;
+};
+
+// @public (undocumented)
+export const changeMyPasswordMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.ChangeMyPasswordErrorCode;
+        } & {
+            readonly developerMessage: string;
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly currentPassword: string;
+    readonly newPassword: string;
+}>;
+
+// @public (undocumented)
+export type ChangeMyPasswordMutationVariables = Parameters<ReturnType<typeof useChangeMyPasswordMutation>>[0];
+
+// @public (undocumented)
+export const confirmOtpMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.ConfirmOtpErrorCode;
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly otpToken: string;
+}>;
+
+// @public (undocumented)
+export type ConfirmOtpMutationVariables = Parameters<ReturnType<typeof useConfirmOtpMutation>>[0];
+
+// @public (undocumented)
+export const CreateApiKeyForm: ({ children, onSuccess, projectSlug, initialMemberships }: CreateApiKeyFormProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type CreateApiKeyFormContextValue = FormContextValue<CreateApiKeyFormValues, CreateApiKeyFormErrorCode>;
+
+// @public (undocumented)
+export type CreateApiKeyFormError = FormError<CreateApiKeyFormValues, CreateApiKeyFormErrorCode>;
+
+// @public (undocumented)
+export type CreateApiKeyFormErrorCode = CreateApiKeyErrorCode | 'UNKNOWN_ERROR' | 'FIELD_REQUIRED';
+
+// @public (undocumented)
+export interface CreateApiKeyFormProps {
+    // (undocumented)
+    children: ReactElement;
+    // (undocumented)
+    initialMemberships?: readonly MembershipInput[];
+    // (undocumented)
+    onSuccess?: (args: {
+        result: CreateApiKeyMutationResult;
+    }) => void;
+    // (undocumented)
+    projectSlug: string;
+}
+
+// @public (undocumented)
+export type CreateApiKeyFormState = FormState;
+
+// @public (undocumented)
+export type CreateApiKeyFormValues = {
+    description: string;
+    memberships: readonly MembershipInput[];
+};
+
+// @public (undocumented)
+export const createApiKeyMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.CreateApiKeyErrorCode;
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        } & {
+            readonly membershipValidation?: readonly ({
+                readonly code: TenantApi.MembershipValidationErrorCode;
+            } & {
+                readonly role: string;
+            } & {
+                readonly variable?: string | undefined;
+            })[] | undefined;
+        }) | undefined;
+    } & {
+        readonly result?: {
+            readonly apiKey: {
+                readonly id: string;
+            } & {
+                readonly token?: string | undefined;
+            } & {
+                readonly identity: {
+                    readonly id: string;
+                } & {
+                    readonly description?: string | undefined;
+                } & {
+                    readonly roles?: readonly string[] | undefined;
+                };
+            };
+        } | undefined;
+    }) | undefined;
+}, {
+    readonly projectSlug: string;
+    readonly memberships: readonly TenantApi.MembershipInput[];
+    readonly description: string;
+    readonly tokenHash?: string | undefined;
+}>;
+
+// Warning: (ae-forgotten-export) The symbol "createApiKeyMutationResult" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export type CreateApiKeyMutationResult = ModelType<typeof createApiKeyMutationResult>;
+
+// @public (undocumented)
+export type CreateApiKeyMutationVariables = Parameters<ReturnType<typeof useCreateApiKeyMutation>>[0];
+
+// @public (undocumented)
+export const createGlobalApiKeyMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.CreateApiKeyErrorCode;
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        }) | undefined;
+    } & {
+        readonly result?: {
+            readonly apiKey: {
+                readonly id: string;
+            } & {
+                readonly token?: string | undefined;
+            } & {
+                readonly identity: {
+                    readonly id: string;
+                } & {
+                    readonly description?: string | undefined;
+                } & {
+                    readonly roles?: readonly string[] | undefined;
+                };
+            };
+        } | undefined;
+    }) | undefined;
+}, {
+    readonly description: string;
+    readonly roles?: readonly string[] | undefined;
+    readonly tokenHash?: string | undefined;
+}>;
+
+// Warning: (ae-forgotten-export) The symbol "createGlobalApiKeyMutationResult" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export type CreateGlobalApiKeyMutationResult = ModelType<typeof createGlobalApiKeyMutationResult>;
+
+// @public (undocumented)
+export type CreateGlobalApiKeyMutationVariables = Parameters<ReturnType<typeof useCreateGlobalApiKeyMutation>>[0];
+
+// @public (undocumented)
+export const createResetPasswordRequestMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: "PERSON_NOT_FOUND";
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly email: string;
+    readonly options?: TenantApi.CreateResetPasswordRequestOptions | undefined;
+}>;
+
+// @public (undocumented)
+export type CreateResetPasswordRequestMutationVariables = Parameters<ReturnType<typeof useCreateResetPasswordRequestMutation>>[0];
+
+// @public (undocumented)
+export const CreateSessionTokenForm: ({ children, onSuccess, expiration, apiToken }: CreateSessionTokenFormProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type CreateSessionTokenFormContextValue = FormContextValue<CreateSessionTokenFormValues, CreateSessionTokenFormErrorCode>;
+
+// @public (undocumented)
+export type CreateSessionTokenFormError = FormError<CreateSessionTokenFormValues, CreateSessionTokenFormErrorCode>;
+
+// @public (undocumented)
+export type CreateSessionTokenFormErrorCode = CreateSessionTokenErrorCode | 'UNKNOWN_ERROR' | 'FIELD_REQUIRED';
+
+// @public (undocumented)
+export interface CreateSessionTokenFormProps {
+    // (undocumented)
+    apiToken?: string;
+    // (undocumented)
+    children: ReactElement;
+    // (undocumented)
+    expiration?: number;
+    // (undocumented)
+    onSuccess?: (args: {
+        result: CreateSessionTokenMutationResult;
+    }) => void;
+}
+
+// @public (undocumented)
+export type CreateSessionTokenFormState = FormState;
+
+// @public (undocumented)
+export type CreateSessionTokenFormValues = {
+    email: string;
+};
+
+// @public (undocumented)
+export const createSessionTokenMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.CreateSessionTokenErrorCode;
+        } & {
+            readonly developerMessage: string;
+        }) | undefined;
+    } & {
+        readonly result?: ({
+            readonly token: string;
+        } & {
+            readonly person: {
+                readonly id: string;
+            } & {
+                readonly email?: string | undefined;
+            } & {
+                readonly name?: string | undefined;
+            } & {
+                readonly otpEnabled: boolean;
+            };
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly email?: string | undefined;
+    readonly personId?: string | undefined;
+    readonly expiration?: number | undefined;
+}>;
+
+// Warning: (ae-forgotten-export) The symbol "createSessionTokenMutationResult" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export type CreateSessionTokenMutationResult = ModelType<typeof createSessionTokenMutationResult>;
+
+// @public (undocumented)
+export type CreateSessionTokenMutationVariables = Parameters<ReturnType<typeof useCreateSessionTokenMutation>>[0];
+
+// @public (undocumented)
+export const createTenantMutation: <TResult, TError extends string = never, TVariables extends object = {}>(fetcher: MutationFetcher<TenantMutation<TResult, TError>, TVariables>, defaultOptions?: TenantApiOptions) => ({ headers, apiToken }?: TenantApiOptions) => (variables: TVariables) => Promise<TenantMutationResponse<TResult, TError>>;
+
+// @public (undocumented)
+export const disableApiKeyMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: "KEY_NOT_FOUND";
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly id: string;
+}>;
+
+// @public (undocumented)
+export type DisableApiKeyMutationVariables = Parameters<ReturnType<typeof useDisableApiKeyMutation>>[0];
+
+// @public (undocumented)
+export const disableOtpMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: "OTP_NOT_ACTIVE";
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        }) | undefined;
+    }) | undefined;
+}, {}>;
+
+// @public (undocumented)
+export type DisableOtpMutationVariables = Parameters<ReturnType<typeof useDisableOtpMutation>>[0];
+
+// @public (undocumented)
+export const DisableOtpTrigger: ({ onSuccess, ...props }: DisableOtpTriggerProps) => JSX_2.Element;
+
+// @public (undocumented)
+export interface DisableOtpTriggerProps {
+    // (undocumented)
+    children: ReactElement;
+    // (undocumented)
+    onError?: (e: unknown) => void;
+    // (undocumented)
+    onSuccess?: () => void;
+}
+
+// @internal (undocumented)
+export const FormContext: Context<FormContextValue<any, any, any>>;
+
+// Warning: (ae-forgotten-export) The symbol "FormValueType" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export interface FormContextValue<V extends FormValueType, E extends string, S extends string = never> {
+    // (undocumented)
+    errors: FormError<V, E>[];
+    // (undocumented)
+    setValue: <F extends keyof V>(field: F, value: V[F]) => void;
+    // (undocumented)
+    setValues: (values: SetStateAction<V>) => void;
+    // (undocumented)
+    state: FormState | S;
+    // (undocumented)
+    values: V;
+}
+
+// @public (undocumented)
+export type FormError<V extends FormValueType, E extends string> = {
+    field?: keyof V;
+    code: FormErrorCode | E;
+    developerMessage?: string;
+};
+
+// @public (undocumented)
+export type FormErrorCode = 'UNKNOWN_ERROR';
+
+// @public (undocumented)
+export type FormState = 'loading' | 'initial' | 'submitting' | 'error' | 'success';
+
+// @public (undocumented)
+export interface Identity {
+    // (undocumented)
+    readonly id: string;
+    // (undocumented)
+    readonly permissions: {
+        readonly canCreateProject: boolean;
+    };
+    // (undocumented)
+    readonly person?: Person;
+    // (undocumented)
+    readonly projects: IdentityProject[];
+}
+
+// @internal (undocumented)
+export const IdentityContext: Context<Identity | undefined>;
+
+// @public (undocumented)
+export interface IdentityMethods {
+    // (undocumented)
+    clearIdentity: () => void;
+    // (undocumented)
+    refreshIdentity: () => Promise<void>;
+}
+
+// @internal (undocumented)
+export const IdentityMethodsContext: Context<IdentityMethods>;
+
+// @public (undocumented)
+export interface IdentityProject {
+    // (undocumented)
+    readonly name: string;
+    // (undocumented)
+    readonly roles: readonly string[];
+    // (undocumented)
+    readonly slug: string;
+}
+
+// @public (undocumented)
+export const IdentityProvider: React.FC<IdentityProviderProps>;
+
+// @public (undocumented)
+export interface IdentityProviderProps {
+    // (undocumented)
+    children: ReactNode;
+}
+
+// @public (undocumented)
+export const IdentityState: ({ state, children }: IdentityStateProps) => JSX_2.Element | null;
+
+// @internal (undocumented)
+export const IdentityStateContext: Context<IdentityStateValue>;
+
+// @public (undocumented)
+export interface IdentityStateProps {
+    // (undocumented)
+    children: ReactNode;
+    // (undocumented)
+    state: IdentityStateValue | IdentityStateValue[];
+}
+
+// @public (undocumented)
+export type IdentityStateValue = 'none' | 'loading' | 'failed' | 'cleared' | 'success';
+
+// @public (undocumented)
+export const IDP: ({ children, onResponseError, onInitError, onLogin }: IDPProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type IDPInitError = InitSignInIDPErrorCode | 'UNKNOWN_ERROR';
+
+// @public (undocumented)
+export const IDPInitTrigger: ({ identityProvider, ...props }: IDPInitTriggerProps) => JSX_2.Element;
+
+// @public (undocumented)
+export interface IDPInitTriggerProps {
+    // (undocumented)
+    children: ReactElement;
+    // (undocumented)
+    identityProvider: string;
+}
+
+// @public (undocumented)
+export type IDPMethods = {
+    initRedirect: (args: {
+        provider: string;
+    }) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        error: IDPInitError;
+    }>;
+};
+
+// @internal (undocumented)
+export const IDPMethodsContextProvider: Context<IDPMethods>;
+
+// @public (undocumented)
+export interface IDPProps {
+    // (undocumented)
+    children: ReactNode;
+    // (undocumented)
+    onInitError?: (error: IDPInitError) => void;
+    // (undocumented)
+    onLogin?: () => void;
+    // (undocumented)
+    onResponseError?: (error: IDPResponseError) => void;
+}
+
+// @public (undocumented)
+export type IDPResponseError = SignInIDPErrorCode | 'INVALID_LOCAL_STATE' | 'UNKNOWN_ERROR';
+
+// @public (undocumented)
+export const IDPState: ({ state, children }: IDPStateProps) => JSX_2.Element | null;
+
+// @internal (undocumented)
+export const IDPStateContextProvider: Context<IDPStateValue>;
+
+// @public (undocumented)
+export interface IDPStateProps {
+    // (undocumented)
+    children: ReactNode;
+    // (undocumented)
+    state: IDPStateType | IDPStateType[];
+}
+
+// @public (undocumented)
+export type IDPStateType = IDPStateValue['type'];
+
+// @public (undocumented)
+export type IDPStateValue = {
+    type: 'nothing';
+} | {
+    type: 'processing_init';
+} | {
+    type: 'processing_response';
+} | {
+    type: 'success';
+} | {
+    type: 'init_failed';
+    error: IDPInitError;
+} | {
+    type: 'response_failed';
+    error: IDPResponseError;
+};
+
+// @public (undocumented)
+export type InitSignInIDPMutationResult = ModelType<typeof TenantApi.initSignInIDPResult$$>;
+
+// @public (undocumented)
+export type InitSignInIDPMutationVariables = {
+    identityProvider: string;
+    data: {
+        redirectUrl?: string;
+    } & {
+        [key: string]: string;
+    };
+};
+
+// @public (undocumented)
+export const InviteForm: ({ children, onSuccess, projectSlug, initialMemberships, inviteOptions }: InviteFormProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type InviteFormContextValue = FormContextValue<InviteFormValues, InviteFormErrorCode>;
+
+// @public (undocumented)
+export type InviteFormError = FormError<InviteFormValues, InviteFormErrorCode>;
+
+// @public (undocumented)
+export type InviteFormErrorCode = InviteErrorCode | 'UNKNOWN_ERROR' | 'FIELD_REQUIRED';
+
+// @public (undocumented)
+export interface InviteFormProps {
+    // (undocumented)
+    children: ReactElement;
+    // (undocumented)
+    initialMemberships?: readonly MembershipInput[];
+    // (undocumented)
+    inviteOptions?: InviteOptions;
+    // (undocumented)
+    onSuccess?: (args: {
+        result: InviteMutationResult;
+    }) => void;
+    // (undocumented)
+    projectSlug: string;
+}
+
+// @public (undocumented)
+export type InviteFormState = FormState;
+
+// @public (undocumented)
+export type InviteFormValues = {
+    email: string;
+    name: string;
+    memberships: readonly MembershipInput[];
+};
+
+// @public (undocumented)
+export const inviteMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.InviteErrorCode;
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        } & {
+            readonly membershipValidation?: readonly ({
+                readonly code: TenantApi.MembershipValidationErrorCode;
+            } & {
+                readonly role: string;
+            } & {
+                readonly variable?: string | undefined;
+            })[] | undefined;
+        }) | undefined;
+    } & {
+        readonly result?: ({
+            readonly isNew: boolean;
+        } & {
+            readonly person: {
+                readonly id: string;
+            } & {
+                readonly email?: string | undefined;
+            } & {
+                readonly name?: string | undefined;
+            } & {
+                readonly otpEnabled: boolean;
+            } & {
+                readonly identity: {
+                    readonly id: string;
+                } & {
+                    readonly description?: string | undefined;
+                } & {
+                    readonly roles?: readonly string[] | undefined;
+                };
+            };
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly email: string;
+    readonly name?: string | undefined;
+    readonly projectSlug: string;
+    readonly memberships: readonly TenantApi.MembershipInput[];
+    readonly options?: TenantApi.InviteOptions | undefined;
+}>;
+
+// Warning: (ae-forgotten-export) The symbol "inviteMutationResult" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export type InviteMutationResult = ModelType<typeof inviteMutationResult>;
+
+// @public (undocumented)
+export type InviteMutationVariables = Parameters<ReturnType<typeof useInviteMutation>>[0];
+
+// @public (undocumented)
+export const LoginForm: ({ children, expiration, onSuccess }: LoginFormProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type LoginFormContextValue = FormContextValue<LoginFormValues, LoginFormErrorCode, LoginFormState>;
+
+// @public (undocumented)
+export type LoginFormError = FormError<LoginFormValues, LoginFormErrorCode>;
+
+// @public (undocumented)
+export type LoginFormErrorCode = SignInErrorCode | 'FIELD_REQUIRED' | 'INVALID_VALUE' | 'UNKNOWN_ERROR';
+
+// @public (undocumented)
+export interface LoginFormProps {
+    // (undocumented)
+    children: ReactElement;
+    // (undocumented)
+    expiration?: number;
+    // (undocumented)
+    onSuccess?: () => void;
+}
+
+// @public (undocumented)
+export type LoginFormState = FormState | 'otp-required';
+
+// @public (undocumented)
+export type LoginFormValues = {
+    email: string;
+    password: string;
+    otpToken: string;
+};
+
+// @public (undocumented)
+export const LoginToken: unique symbol;
+
+// @public (undocumented)
+export const LogoutTrigger: ({ children }: {
+    children: ReactNode;
+}) => JSX_2.Element;
+
+// Warning: (ae-forgotten-export) The symbol "identityFragment" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export type MeQueryData = ModelType<typeof identityFragment>;
 
 export { ModelType }
 
 // @public (undocumented)
-export const useTenantApi: () => <TData extends object, TVariables extends object>(fetcher: Fetcher<'Query' | 'Mutation', TData, TVariables>, options?: {
+export const OtpConfirmForm: ({ children, onSuccess }: OtpConfirmFormProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type OtpConfirmFormContextValue = FormContextValue<OtpConfirmFormValues, OtpConfirmFormErrorCode>;
+
+// @public (undocumented)
+export type OtpConfirmFormError = FormError<OtpConfirmFormValues, OtpConfirmFormErrorCode>;
+
+// @public (undocumented)
+export type OtpConfirmFormErrorCode = ConfirmOtpErrorCode | 'FIELD_REQUIRED' | 'UNKNOWN_ERROR';
+
+// @public (undocumented)
+export interface OtpConfirmFormProps {
+    // (undocumented)
+    children: ReactElement;
+    // (undocumented)
+    onSuccess?: () => void;
+}
+
+// @public (undocumented)
+export type OtpConfirmFormState = FormState;
+
+// @public (undocumented)
+export type OtpConfirmFormValues = {
+    otpToken: string;
+};
+
+// @public (undocumented)
+export const OtpPrepareForm: ({ children, onSuccess }: OtpPrepareFormProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type OtpPrepareFormContextValue = FormContextValue<OtpPrepareFormValues, OtpPrepareFormErrorCode>;
+
+// @public (undocumented)
+export type OtpPrepareFormError = FormError<OtpPrepareFormValues, OtpPrepareFormErrorCode>;
+
+// @public (undocumented)
+export type OtpPrepareFormErrorCode = 'UNKNOWN_ERROR';
+
+// @public (undocumented)
+export interface OtpPrepareFormProps {
+    // (undocumented)
+    children: ReactElement;
+    // (undocumented)
+    onSuccess?: (args: {
+        result: PrepareOtpMutationResult;
+    }) => void;
+}
+
+// @public (undocumented)
+export type OtpPrepareFormState = FormState;
+
+// @public (undocumented)
+export type OtpPrepareFormValues = {
+    label: string;
+};
+
+// @public (undocumented)
+export const PasswordResetForm: ({ children, onSuccess, token }: PasswordResetFormProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type PasswordResetFormContextValue = FormContextValue<PasswordResetFormValues, PasswordResetFormErrorCode>;
+
+// @public (undocumented)
+export type PasswordResetFormError = FormError<PasswordResetFormValues, PasswordResetFormErrorCode>;
+
+// @public (undocumented)
+export type PasswordResetFormErrorCode = ResetPasswordErrorCode | 'FIELD_REQUIRED' | 'INVALID_VALUE' | 'PASSWORD_MISMATCH' | 'UNKNOWN_ERROR';
+
+// @public (undocumented)
+export interface PasswordResetFormProps {
+    // (undocumented)
+    children: ReactElement;
+    // (undocumented)
+    onSuccess?: () => void;
+    // (undocumented)
+    token?: string;
+}
+
+// @public (undocumented)
+export type PasswordResetFormState = FormState;
+
+// @public (undocumented)
+export type PasswordResetFormValues = {
+    token: string;
+    password: string;
+    passwordConfirmation: string;
+};
+
+// @public (undocumented)
+export const PasswordResetRequestForm: ({ children, onSuccess }: PasswordResetRequestFormProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type PasswordResetRequestFormContextValue = FormContextValue<PasswordResetRequestFormValues, PasswordResetRequestFormErrorCode>;
+
+// @public (undocumented)
+export type PasswordResetRequestFormError = FormError<PasswordResetRequestFormValues, PasswordResetRequestFormErrorCode>;
+
+// @public (undocumented)
+export type PasswordResetRequestFormErrorCode = CreatePasswordResetRequestErrorCode | 'FIELD_REQUIRED' | 'INVALID_VALUE' | 'UNKNOWN_ERROR';
+
+// @public (undocumented)
+export interface PasswordResetRequestFormProps {
+    // (undocumented)
+    children: ReactElement;
+    // (undocumented)
+    onSuccess?: () => void;
+}
+
+// @public (undocumented)
+export type PasswordResetRequestFormState = FormState;
+
+// @public (undocumented)
+export type PasswordResetRequestFormValues = {
+    email: string;
+};
+
+// @public (undocumented)
+export interface Person {
+    // (undocumented)
+    readonly email?: string;
+    // (undocumented)
+    readonly id: string;
+    // (undocumented)
+    readonly otpEnabled: boolean;
+}
+
+// @public (undocumented)
+export const prepareOtpMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly result?: ({
+            readonly otpUri: string;
+        } & {
+            readonly otpSecret: string;
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly label?: string | undefined;
+}>;
+
+// @public (undocumented)
+export type PrepareOtpMutationResult = ModelType<typeof TenantApi.prepareOtpResult$$>;
+
+// @public (undocumented)
+export type PrepareOtpMutationVariables = Parameters<ReturnType<typeof usePrepareOtpMutation>>[0];
+
+// Warning: (ae-forgotten-export) The symbol "projectMembershipsFragment" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export type ProjectMembershipsQueryResult = readonly ModelType<typeof projectMembershipsFragment>[];
+
+// @public (undocumented)
+export type ProjectMembershipsQueryVariables = {
+    projectSlug: string;
+    identityId: string;
+};
+
+// Warning: (ae-forgotten-export) The symbol "projectIdentityRelationFragment" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export type ProjectMembersQueryResult = readonly ModelType<typeof projectIdentityRelationFragment>[];
+
+// @public (undocumented)
+export type ProjectMembersQueryVariables = {
+    projectSlug: string;
+} & TenantApi.ProjectMembersInput;
+
+// Warning: (ae-forgotten-export) The symbol "projectRolesDefinitionFragment" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export type ProjectRoleDefinition = ModelType<typeof projectRolesDefinitionFragment>;
+
+// @public (undocumented)
+export type ProjectRolesDefinitionQueryResult = readonly ProjectRoleDefinition[];
+
+// @public (undocumented)
+export interface ProjectRolesDefinitionQueryVariables {
+    // (undocumented)
+    slug: string;
+}
+
+// @public (undocumented)
+export const removeProjectMemberMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.RemoveProjectMemberErrorCode;
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly projectSlug: string;
+    readonly identityId: string;
+}>;
+
+// @public (undocumented)
+export type RemoveProjectMemberMutationVariables = Parameters<ReturnType<typeof useRemoveProjectMemberMutation>>[0];
+
+// @public (undocumented)
+export const RemoveProjectMemberTrigger: ({ identityId, projectSlug, ...props }: RemoveProjectMemberTriggerProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type RemoveProjectMemberTriggerProps = RemoveProjectMemberMutationVariables & {
+    children: ReactElement;
+    onSuccess?: () => void;
+    onError?: (e: unknown) => void;
+};
+
+// @public (undocumented)
+export const resetPasswordMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.ResetPasswordErrorCode;
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly token: string;
+    readonly password: string;
+}>;
+
+// @public (undocumented)
+export type ResetPasswordMutationVariables = Parameters<ReturnType<typeof useResetPasswordMutation>>[0];
+
+// @public (undocumented)
+export const signInIDPMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.SignInIDPErrorCode;
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        }) | undefined;
+    } & {
+        readonly result?: ({
+            readonly token: string;
+        } & {
+            readonly person: {
+                readonly id: string;
+            } & {
+                readonly email?: string | undefined;
+            } & {
+                readonly name?: string | undefined;
+            } & {
+                readonly otpEnabled: boolean;
+            };
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly identityProvider: string;
+    readonly data?: unknown;
+    readonly expiration?: number | undefined;
+    readonly idpResponse?: TenantApi.IDPResponseInput | undefined;
+    readonly redirectUrl?: string | undefined;
+    readonly sessionData?: unknown;
+}>;
+
+// Warning: (ae-forgotten-export) The symbol "signInIdpFragment" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export type SignInIDPMutationResult = ModelType<typeof signInIdpFragment>;
+
+// @public (undocumented)
+export type SignInIDPMutationVariables = {
+    identityProvider: string;
+    expiration?: number;
+    data: {
+        url?: string;
+        redirectUrl?: string;
+        sessionData?: any;
+    } & {
+        [key: string]: any;
+    };
+};
+
+// @public (undocumented)
+export const signInMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.SignInErrorCode;
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        }) | undefined;
+    } & {
+        readonly result?: ({
+            readonly token: string;
+        } & {
+            readonly person: {
+                readonly id: string;
+            } & {
+                readonly email?: string | undefined;
+            } & {
+                readonly name?: string | undefined;
+            } & {
+                readonly otpEnabled: boolean;
+            };
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly email: string;
+    readonly password: string;
+    readonly expiration?: number | undefined;
+    readonly otpToken?: string | undefined;
+}>;
+
+// Warning: (ae-forgotten-export) The symbol "signInResultFragment" needs to be exported by the entry point index.d.ts
+//
+// @public (undocumented)
+export type SignInMutationResult = ModelType<typeof signInResultFragment>;
+
+// @public (undocumented)
+export type SignInMutationVariables = Parameters<ReturnType<typeof useSignInMutation>>[0];
+
+// @public (undocumented)
+export const signOutMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.SignOutErrorCode;
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly all?: boolean | undefined;
+}>;
+
+// @public (undocumented)
+export type SignOutMutationVariables = Parameters<ReturnType<typeof useSignOutMutation>>[0];
+
+// @public (undocumented)
+export type TenantApiOptions = {
+    readonly headers?: Record<string, string>;
+    readonly apiToken?: string | typeof LoginToken;
+};
+
+// @public (undocumented)
+export type TenantMutation<Result, Error> = {
+    readonly mutation?: {
+        readonly ok: boolean;
+        readonly error?: {
+            readonly code: Error;
+            readonly developerMessage: string;
+        };
+        readonly result?: Result;
+    };
+};
+
+// @public (undocumented)
+export type TenantMutationErrorResponse<Error> = {
+    ok: false;
+    error: Error;
+    developerMessage?: string;
+};
+
+// @public (undocumented)
+export type TenantMutationOkResponse<Result> = {
+    ok: true;
+    result: Result;
+};
+
+// @public (undocumented)
+export type TenantMutationResponse<Result, Error> = TenantMutationOkResponse<Result> | TenantMutationErrorResponse<Error>;
+
+// @public (undocumented)
+export type TenantQueryLoaderMethods = {
+    refresh: () => void;
+};
+
+// @public (undocumented)
+export type TenantQueryLoaderState<Result> = {
+    state: 'loading';
+} | {
+    state: 'error';
+    error: unknown;
+} | {
+    state: 'success';
+    data: Result;
+} | {
+    state: 'refreshing';
+    data: Result;
+};
+
+// @public (undocumented)
+export const UpdateProjectMemberForm: ({ children, onSuccess, identityId, projectSlug }: UpdateProjectMemberFormProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type UpdateProjectMemberFormContextValue = FormContextValue<UpdateProjectMemberFormValues, UpdateProjectMemberFormErrorCode>;
+
+// @public (undocumented)
+export type UpdateProjectMemberFormError = FormError<UpdateProjectMemberFormValues, UpdateProjectMemberFormErrorCode>;
+
+// @public (undocumented)
+export type UpdateProjectMemberFormErrorCode = UpdateProjectMemberErrorCode | 'UNKNOWN_ERROR' | 'FIELD_REQUIRED';
+
+// @public (undocumented)
+export interface UpdateProjectMemberFormProps {
+    // (undocumented)
+    children: ReactElement;
+    // (undocumented)
+    identityId: string;
+    // (undocumented)
+    onSuccess?: (args: {}) => void;
+    // (undocumented)
+    projectSlug: string;
+}
+
+// @public (undocumented)
+export type UpdateProjectMemberFormState = FormState;
+
+// @public (undocumented)
+export type UpdateProjectMemberFormValues = {
+    memberships: readonly MembershipInput[];
+};
+
+// @public (undocumented)
+export const updateProjectMemberMutation: TenantApi.MutationFetcher<{
+    readonly mutation?: ({
+        readonly ok: boolean;
+    } & {
+        readonly error?: ({
+            readonly code: TenantApi.UpdateProjectMemberErrorCode;
+        } & {
+            readonly developerMessage: string;
+        } & {
+            readonly endUserMessage?: string | undefined;
+        } & {
+            readonly membershipValidation?: readonly ({
+                readonly code: TenantApi.MembershipValidationErrorCode;
+            } & {
+                readonly role: string;
+            } & {
+                readonly variable?: string | undefined;
+            })[] | undefined;
+        }) | undefined;
+    }) | undefined;
+}, {
+    readonly projectSlug: string;
+    readonly identityId: string;
+    readonly memberships: readonly TenantApi.MembershipInput[];
+}>;
+
+// @public (undocumented)
+export type UpdateProjectMemberMutationVariables = Parameters<ReturnType<typeof useUpdateProjectMemberMutation>>[0];
+
+// @public (undocumented)
+export const useAddProjectMemberMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly projectSlug: string;
+    readonly identityId: string;
+    readonly memberships: readonly TenantApi.MembershipInput[];
+}) => Promise<TenantMutationResponse<unknown, TenantApi.AddProjectMemberErrorCode>>;
+
+// @public (undocumented)
+export const useChangeMyPasswordForm: () => ChangeMyPasswordFormContextValue;
+
+// @public (undocumented)
+export const useChangeMyPasswordMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly currentPassword: string;
+    readonly newPassword: string;
+}) => Promise<TenantMutationResponse<unknown, TenantApi.ChangeMyPasswordErrorCode>>;
+
+// @public (undocumented)
+export const useConfirmOtpMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly otpToken: string;
+}) => Promise<TenantMutationResponse<unknown, TenantApi.ConfirmOtpErrorCode>>;
+
+// @public (undocumented)
+export const useCreateApiKeyForm: () => CreateApiKeyFormContextValue;
+
+// @public (undocumented)
+export const useCreateApiKeyMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly projectSlug: string;
+    readonly memberships: readonly TenantApi.MembershipInput[];
+    readonly description: string;
+    readonly tokenHash?: string | undefined;
+}) => Promise<TenantMutationResponse<    {
+readonly apiKey: {
+readonly id: string;
+} & {
+readonly token?: string | undefined;
+} & {
+readonly identity: {
+readonly id: string;
+} & {
+readonly description?: string | undefined;
+} & {
+readonly roles?: readonly string[] | undefined;
+};
+};
+}, TenantApi.CreateApiKeyErrorCode>>;
+
+// @public (undocumented)
+export const useCreateGlobalApiKeyMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly description: string;
+    readonly roles?: readonly string[] | undefined;
+    readonly tokenHash?: string | undefined;
+}) => Promise<TenantMutationResponse<    {
+readonly apiKey: {
+readonly id: string;
+} & {
+readonly token?: string | undefined;
+} & {
+readonly identity: {
+readonly id: string;
+} & {
+readonly description?: string | undefined;
+} & {
+readonly roles?: readonly string[] | undefined;
+};
+};
+}, TenantApi.CreateApiKeyErrorCode>>;
+
+// @public (undocumented)
+export const useCreateResetPasswordRequestMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly email: string;
+    readonly options?: TenantApi.CreateResetPasswordRequestOptions | undefined;
+}) => Promise<TenantMutationResponse<unknown, "PERSON_NOT_FOUND">>;
+
+// @public (undocumented)
+export const useCreateSessionTokenForm: () => CreateSessionTokenFormContextValue;
+
+// @public (undocumented)
+export const useCreateSessionTokenMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly email?: string | undefined;
+    readonly personId?: string | undefined;
+    readonly expiration?: number | undefined;
+}) => Promise<TenantMutationResponse<    {
+readonly token: string;
+} & {
+readonly person: {
+readonly id: string;
+} & {
+readonly email?: string | undefined;
+} & {
+readonly name?: string | undefined;
+} & {
+readonly otpEnabled: boolean;
+};
+}, TenantApi.CreateSessionTokenErrorCode>>;
+
+// @public (undocumented)
+export const useDisableApiKeyMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly id: string;
+}) => Promise<TenantMutationResponse<unknown, "KEY_NOT_FOUND">>;
+
+// @public (undocumented)
+export const useDisableOtpMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {}) => Promise<TenantMutationResponse<unknown, "OTP_NOT_ACTIVE">>;
+
+// @public (undocumented)
+export const useFetchIdentity: () => [{
+    state: IdentityStateValue;
+    identity: Identity | undefined;
+}, IdentityMethods];
+
+// @public (undocumented)
+export const useForm: () => FormContextValue<any, any, any>;
+
+// @public (undocumented)
+export const useIdentity: () => Identity | undefined;
+
+// @public (undocumented)
+export const useIdentityMethods: () => IdentityMethods;
+
+// @public (undocumented)
+export const useIdentityState: () => IdentityStateValue;
+
+// @public (undocumented)
+export const useIDPMethods: () => IDPMethods;
+
+// @public (undocumented)
+export const useIDPState: () => IDPStateValue;
+
+// @public (undocumented)
+export const useInitSignInIDPMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: InitSignInIDPMutationVariables) => Promise<TenantMutationResponse<    {
+readonly authUrl: string;
+} & {
+readonly sessionData: unknown;
+}, TenantApi.InitSignInIDPErrorCode>>;
+
+// @public (undocumented)
+export const useInviteForm: () => InviteFormContextValue;
+
+// @public (undocumented)
+export const useInviteMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly email: string;
+    readonly name?: string | undefined;
+    readonly projectSlug: string;
+    readonly memberships: readonly TenantApi.MembershipInput[];
+    readonly options?: TenantApi.InviteOptions | undefined;
+}) => Promise<TenantMutationResponse<    {
+readonly isNew: boolean;
+} & {
+readonly person: {
+readonly id: string;
+} & {
+readonly email?: string | undefined;
+} & {
+readonly name?: string | undefined;
+} & {
+readonly otpEnabled: boolean;
+} & {
+readonly identity: {
+readonly id: string;
+} & {
+readonly description?: string | undefined;
+} & {
+readonly roles?: readonly string[] | undefined;
+};
+};
+}, TenantApi.InviteErrorCode>>;
+
+// @public (undocumented)
+export const useLoginForm: () => LoginFormContextValue;
+
+// @public (undocumented)
+export const useLogout: () => ({ noRedirect }?: {
+    noRedirect?: boolean | undefined;
+}) => Promise<void>;
+
+// @public (undocumented)
+export const useMeQuery: (options?: TenantApiOptions) => ({}: {}) => Promise<MeQueryData>;
+
+// @public (undocumented)
+export const useOtpConfirmForm: () => OtpConfirmFormContextValue;
+
+// @public (undocumented)
+export const useOtpPrepareForm: () => OtpPrepareFormContextValue;
+
+// @public (undocumented)
+export const usePasswordResetForm: () => PasswordResetFormContextValue;
+
+// @public (undocumented)
+export const usePasswordResetRequestForm: () => PasswordResetRequestFormContextValue;
+
+// @public (undocumented)
+export const usePrepareOtpMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly label?: string | undefined;
+}) => Promise<TenantMutationResponse<    {
+readonly otpUri: string;
+} & {
+readonly otpSecret: string;
+}, never>>;
+
+// @public (undocumented)
+export const useProjectMembershipsQuery: (options?: TenantApiOptions) => (input: ProjectMembershipsQueryVariables) => Promise<ProjectMembershipsQueryResult>;
+
+// @public (undocumented)
+export const useProjectMembersQuery: ({ headers, apiToken }?: TenantApiOptions) => ({ projectSlug, ...membersInput }: ProjectMembersQueryVariables) => Promise<ProjectMembersQueryResult>;
+
+// @public (undocumented)
+export const useProjectRolesDefinitionQuery: ({ headers, apiToken }?: TenantApiOptions) => (variables: ProjectRolesDefinitionQueryVariables) => Promise<ProjectRolesDefinitionQueryResult>;
+
+// @public (undocumented)
+export const useRemoveProjectMemberMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly projectSlug: string;
+    readonly identityId: string;
+}) => Promise<TenantMutationResponse<unknown, TenantApi.RemoveProjectMemberErrorCode>>;
+
+// @public (undocumented)
+export const useResetPasswordMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly token: string;
+    readonly password: string;
+}) => Promise<TenantMutationResponse<unknown, TenantApi.ResetPasswordErrorCode>>;
+
+// @public (undocumented)
+export const useSignInIDPMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: SignInIDPMutationVariables) => Promise<TenantMutationResponse<    {
+readonly token: string;
+} & {
+readonly person: {
+readonly id: string;
+} & {
+readonly email?: string | undefined;
+} & {
+readonly name?: string | undefined;
+} & {
+readonly otpEnabled: boolean;
+};
+}, TenantApi.SignInIDPErrorCode>>;
+
+// @public (undocumented)
+export const useSignInMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly email: string;
+    readonly password: string;
+    readonly expiration?: number | undefined;
+    readonly otpToken?: string | undefined;
+}) => Promise<TenantMutationResponse<    {
+readonly token: string;
+} & {
+readonly person: {
+readonly id: string;
+} & {
+readonly email?: string | undefined;
+} & {
+readonly name?: string | undefined;
+} & {
+readonly otpEnabled: boolean;
+};
+}, TenantApi.SignInErrorCode>>;
+
+// @public (undocumented)
+export const useSignOutMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly all?: boolean | undefined;
+}) => Promise<TenantMutationResponse<unknown, TenantApi.SignOutErrorCode>>;
+
+// @public (undocumented)
+export const useTenantApi: ({ headers, apiToken }?: TenantApiOptions) => <TData extends object, TVariables extends object>(fetcher: Fetcher<'Query' | 'Mutation', TData, TVariables>, options?: {
     readonly variables?: TVariables;
     readonly headers?: Record<string, string>;
-    readonly apiToken?: string;
+    readonly apiToken?: string | typeof LoginToken;
 }) => Promise<TData>;
 
+// @public (undocumented)
+export const useTenantMutation: <TResult, TError extends string = never, TVariables extends object = {}>(fetcher: MutationFetcher<TenantMutation<TResult, TError>, TVariables>, { headers, apiToken }?: TenantApiOptions) => (variables: TVariables) => Promise<TenantMutationResponse<TResult, TError>>;
+
+// @public (undocumented)
+export const useTenantQueryLoader: <TVariables extends object, Result>(fetcher: (variables: TVariables) => Promise<Result>, variables: TVariables) => [TenantQueryLoaderState<Result>, TenantQueryLoaderMethods];
+
+// @public (undocumented)
+export const useUpdateProjectMemberForm: () => UpdateProjectMemberFormContextValue;
+
+// @public (undocumented)
+export const useUpdateProjectMemberMutation: ({ headers, apiToken }?: TenantApiOptions) => (variables: {
+    readonly projectSlug: string;
+    readonly identityId: string;
+    readonly memberships: readonly TenantApi.MembershipInput[];
+}) => Promise<TenantMutationResponse<unknown, TenantApi.UpdateProjectMemberErrorCode>>;
+
 // (No @packageDocumentation comment for this package)
 
 ```
diff --git a/build/api/react-identity.api.md b/build/api/react-identity.api.md
index fd11848e09..a34b6f5f05 100644
--- a/build/api/react-identity.api.md
+++ b/build/api/react-identity.api.md
@@ -5,7 +5,7 @@
 ```ts
 
 import { Environment } from '@contember/react-binding';
-import { JSX as JSX_2 } from 'react/jsx-runtime';
+import { Identity } from '@contember/react-client-tenant';
 import { NamedExoticComponent } from 'react';
 import { ReactNode } from 'react';
 
@@ -20,79 +20,18 @@ export interface HasRoleProps {
     role: RoleCondition;
 }
 
-// @public (undocumented)
-export interface Identity {
-    // (undocumented)
-    readonly id: string;
-    // (undocumented)
-    readonly permissions: {
-        readonly canCreateProject: boolean;
-    };
-    // (undocumented)
-    readonly person?: Person;
-    // (undocumented)
-    readonly projects: IdentityProject[];
-}
-
 // @public (undocumented)
 export const identityEnvironmentExtension: Environment.Extension<Identity | null, {
     identity: Identity | undefined;
 }>;
 
 // @public (undocumented)
-export interface IdentityMethods {
-    // (undocumented)
-    clearIdentity: () => void;
-    // (undocumented)
-    refreshIdentity: () => Promise<void>;
-}
-
-// @public (undocumented)
-export interface IdentityProject {
-    // (undocumented)
-    readonly name: string;
-    // (undocumented)
-    readonly roles: readonly string[];
-    // (undocumented)
-    readonly slug: string;
-}
-
-// @public (undocumented)
-export const IdentityProvider: React.FC<IdentityProviderProps>;
-
-// @public (undocumented)
-export interface IdentityProviderProps {
-    // (undocumented)
-    children: ReactNode;
-}
-
-// @public (undocumented)
-export const IdentityState: ({ state, children }: IdentityStateProps) => JSX_2.Element | null;
+export const IdentityEnvironmentProvider: React.FC<IdentityEnvironmentProviderProps>;
 
 // @public (undocumented)
-export interface IdentityStateProps {
-    // (undocumented)
-    children: ReactNode;
+export interface IdentityEnvironmentProviderProps {
     // (undocumented)
-    state: IdentityStateValue | IdentityStateValue[];
-}
-
-// @public (undocumented)
-export type IdentityStateValue = 'none' | 'loading' | 'failed' | 'cleared' | 'success';
-
-// @public (undocumented)
-export const LogoutTrigger: ({ children }: {
     children: ReactNode;
-}) => JSX_2.Element;
-
-// @public (undocumented)
-export interface Person {
-    // (undocumented)
-    readonly email?: string;
-    // (undocumented)
-    readonly id: string;
-    // (undocumented)
-    readonly otpEnabled: boolean;
 }
 
 // @public (undocumented)
@@ -107,27 +46,10 @@ export type ProjectUserRoles = Set<string>;
 export type RoleCondition = string | ((roles: Set<string>) => boolean);
 
 // @public (undocumented)
-export const useFetchIdentity: () => [{
-    state: IdentityStateValue;
-    identity: Identity | undefined;
-}, IdentityMethods];
-
-// @public (undocumented)
-export const useIdentity: () => Identity | undefined;
-
-// @public (undocumented)
-export const useIdentityMethods: () => IdentityMethods;
-
-// @public (undocumented)
-export const useIdentityState: () => IdentityStateValue;
+export const useProjectUserRoles: () => ProjectUserRoles;
 
-// @public (undocumented)
-export const useLogout: () => ({ noRedirect }?: {
-    noRedirect?: boolean | undefined;
-}) => Promise<void>;
 
-// @public (undocumented)
-export const useProjectUserRoles: () => ProjectUserRoles;
+export * from "@contember/react-client-tenant";
 
 // (No @packageDocumentation comment for this package)
 
diff --git a/build/api/react-routing.api.md b/build/api/react-routing.api.md
index f252d2a82e..25ad208c9d 100644
--- a/build/api/react-routing.api.md
+++ b/build/api/react-routing.api.md
@@ -273,6 +273,14 @@ export class RoutingParameter {
 // @public (undocumented)
 export type RoutingParameterResolver = (name: string) => RequestParameterValue | undefined;
 
+// @public (undocumented)
+export const RoutingProvider: ({ children, ...props }: RoutingProviderProps) => JSX_2.Element;
+
+// @public (undocumented)
+export type RoutingProviderProps = Partial<RoutingContextValue> & {
+    children: ReactNode;
+};
+
 // @public (undocumented)
 export interface SelectedDimension {
     // (undocumented)
diff --git a/contember.yaml b/contember.yaml
index dca5d5c11b..fe9c5e7ef6 100644
--- a/contember.yaml
+++ b/contember.yaml
@@ -1,3 +1,2 @@
 projects:
-  admin-sandbox: packages/admin-sandbox
   playground: packages/playground
diff --git a/docker-compose.yaml b/docker-compose.yaml
index fd57d5e15d..52e377557c 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -144,6 +144,7 @@ services:
       CONTEMBER_SKIP_VERSION_CHECK: 1
       CONTEMBER_API_URL: 'http://contember-engine:4000/'
       CONTEMBER_API_TOKEN: '0000000000000000000000000000000000000000'
+      CONTEMBER_PROJECT_NAME: playground
 
     volumes:
       - ./:/src
diff --git a/packages/admin/src/components/Identity/IdentityProvider.tsx b/packages/admin/src/components/Identity/IdentityProvider.tsx
index ab4c746435..19783d8ebd 100644
--- a/packages/admin/src/components/Identity/IdentityProvider.tsx
+++ b/packages/admin/src/components/Identity/IdentityProvider.tsx
@@ -2,7 +2,7 @@ import { Message, SpinnerOverlay } from '@contember/ui'
 import { ReactNode, useEffect } from 'react'
 import { MiscPageLayout } from '../MiscPageLayout'
 import { InvalidIdentityFallback } from './InvalidIdentityFallback'
-import { IdentityProvider as BaseIdentityProvider, IdentityState } from '@contember/react-identity'
+import { IdentityProvider as BaseIdentityProvider, IdentityEnvironmentProvider, IdentityState } from '@contember/react-identity'
 
 export interface IdentityProviderProps {
 	children: ReactNode
@@ -28,21 +28,23 @@ const ClearIdentityHandler = ({ onInvalidIdentity }: {
 export const IdentityProvider: React.FC<IdentityProviderProps> = ({ children, onInvalidIdentity, allowUnauthenticated }) => {
 	return (
 		<BaseIdentityProvider>
-			<IdentityState state={'cleared'}>
-				<ClearIdentityHandler onInvalidIdentity={onInvalidIdentity}/>
-				<MiscPageLayout>
-					<Message size="large" padding="large" display="block">Logging out&hellip;</Message>
-				</MiscPageLayout>
-			</IdentityState>
-			<IdentityState state={'failed'}>
-				<InvalidIdentityFallback />
-			</IdentityState>
-			<IdentityState state={allowUnauthenticated ? 'loading' : ['loading', 'none']}>
-				<SpinnerOverlay />
-			</IdentityState>
-			<IdentityState state={allowUnauthenticated ? ['success', 'none'] : 'success'}>
-				{children}
-			</IdentityState>
+			<IdentityEnvironmentProvider>
+				<IdentityState state={'cleared'}>
+					<ClearIdentityHandler onInvalidIdentity={onInvalidIdentity}/>
+					<MiscPageLayout>
+						<Message size="large" padding="large" display="block">Logging out&hellip;</Message>
+					</MiscPageLayout>
+				</IdentityState>
+				<IdentityState state={'failed'}>
+					<InvalidIdentityFallback />
+				</IdentityState>
+				<IdentityState state={allowUnauthenticated ? 'loading' : ['loading', 'none']}>
+					<SpinnerOverlay />
+				</IdentityState>
+				<IdentityState state={allowUnauthenticated ? ['success', 'none'] : 'success'}>
+					{children}
+				</IdentityState>
+			</IdentityEnvironmentProvider>
 		</BaseIdentityProvider>
 	)
 }
diff --git a/packages/interface/src/bootstrap/ApplicationEntrypoint.tsx b/packages/interface/src/bootstrap/ApplicationEntrypoint.tsx
index 6a1c9b2bdc..f78b49eef3 100644
--- a/packages/interface/src/bootstrap/ApplicationEntrypoint.tsx
+++ b/packages/interface/src/bootstrap/ApplicationEntrypoint.tsx
@@ -1,9 +1,9 @@
 import { Environment, EnvironmentContext, EnvironmentExtensionProvider } from '@contember/react-binding'
 import { ContemberClient, ContemberClientProps } from '@contember/react-client'
 import { ReactNode } from 'react'
-import { RequestProvider, RouteMap, RoutingContext, RoutingContextValue, SelectedDimension } from '@contember/react-routing'
+import { RequestProvider, RouteMap, RoutingContext, RoutingContextValue, RoutingProvider, SelectedDimension } from '@contember/react-routing'
 import { DataViewPageNameKeyProvider } from './DataViewPageNameKeyProvider'
-import { IdentityProvider, projectEnvironmentExtension } from '@contember/react-identity'
+import { IdentityEnvironmentProvider, IdentityProvider, projectEnvironmentExtension } from '@contember/react-identity'
 
 export interface ApplicationEntrypointProps extends ContemberClientProps {
 	basePath: string
@@ -36,25 +36,25 @@ export const ApplicationEntrypoint = (props: ApplicationEntrypointProps) => {
 
 	return (
 		<EnvironmentContext.Provider value={rootEnv}>
-			<RoutingContext.Provider value={routing}>
-				<RequestProvider>
-					<ContemberClient
-						apiBaseUrl={props.apiBaseUrl}
-						sessionToken={props.sessionToken}
-						loginToken={props.loginToken}
-						project={props.project}
-						stage={props.stage}
-					>
-						<EnvironmentExtensionProvider extension={projectEnvironmentExtension} state={props.project ?? null}>
-							<DataViewPageNameKeyProvider>
-								<IdentityProvider>
+			<RoutingProvider {...routing}>
+				<ContemberClient
+					apiBaseUrl={props.apiBaseUrl}
+					sessionToken={props.sessionToken}
+					loginToken={props.loginToken}
+					project={props.project}
+					stage={props.stage}
+				>
+					<EnvironmentExtensionProvider extension={projectEnvironmentExtension} state={props.project ?? null}>
+						<DataViewPageNameKeyProvider>
+							<IdentityProvider>
+								<IdentityEnvironmentProvider>
 									{props.children}
-								</IdentityProvider>
-							</DataViewPageNameKeyProvider>
-						</EnvironmentExtensionProvider>
-					</ContemberClient>
-				</RequestProvider>
-			</RoutingContext.Provider>
+								</IdentityEnvironmentProvider>
+							</IdentityProvider>
+						</DataViewPageNameKeyProvider>
+					</EnvironmentExtensionProvider>
+				</ContemberClient>
+			</RoutingProvider>
 		</EnvironmentContext.Provider>
 	)
 }
diff --git a/packages/playground/admin/.env.development b/packages/playground/admin/.env.development
index 313e4539c8..ae8b9bc7b6 100644
--- a/packages/playground/admin/.env.development
+++ b/packages/playground/admin/.env.development
@@ -1,3 +1,4 @@
 VITE_CONTEMBER_ADMIN_API_BASE_URL=http://localhost:3001
 VITE_CONTEMBER_ADMIN_SESSION_TOKEN=0000000000000000000000000000000000000000
+VITE_CONTEMBER_ADMIN_LOGIN_TOKEN=1111111111111111111111111111111111111111
 VITE_CONTEMBER_ADMIN_PROJECT_NAME=playground
diff --git a/packages/playground/admin/.env.production b/packages/playground/admin/.env.production
index c91bc3e887..9a64004ec7 100644
--- a/packages/playground/admin/.env.production
+++ b/packages/playground/admin/.env.production
@@ -1,2 +1,3 @@
 VITE_CONTEMBER_ADMIN_API_BASE_URL=/_api
 VITE_CONTEMBER_ADMIN_SESSION_TOKEN=__SESSION_TOKEN__
+VITE_CONTEMBER_ADMIN_LOGIN_TOKEN=__LOGIN_TOKEN__
diff --git a/packages/playground/admin/app/components/navigation.tsx b/packages/playground/admin/app/components/navigation.tsx
index 88de28ffda..9c43b8673c 100644
--- a/packages/playground/admin/app/components/navigation.tsx
+++ b/packages/playground/admin/app/components/navigation.tsx
@@ -1,4 +1,4 @@
-import { ArchiveIcon, BrushIcon, FormInputIcon, GripVertical, HomeIcon, KanbanIcon, LanguagesIcon, PencilIcon, TableIcon, UploadIcon } from 'lucide-react'
+import { ArchiveIcon, BrushIcon, FormInputIcon, GripVertical, HomeIcon, KanbanIcon, KeyRoundIcon, LanguagesIcon, LockKeyholeIcon, PencilIcon, TableIcon, UploadIcon, UserIcon, UsersIcon } from 'lucide-react'
 import { Menu, MenuItem } from '../../lib/components/ui/menu'
 
 
@@ -8,6 +8,11 @@ export const Navigation = () => {
 		<div>
 			<Menu>
 				<MenuItem icon={<HomeIcon size={16} />} label={'Home'} to={'index'} />
+				<MenuItem icon={<UserIcon size={16} />} label={'Tenant'}>
+					<MenuItem icon={<LockKeyholeIcon />} label={'Security'} to={'tenant/security'} />
+					<MenuItem icon={<UsersIcon />} label={'Members'} to={'tenant/members'} />
+					<MenuItem icon={<KeyRoundIcon />} label={'API keys'} to={'tenant/apiKeys'} />
+				</MenuItem>
 				<MenuItem icon={<BrushIcon size={16} />} label={'UI'}>
 					<MenuItem icon={line} label={'Buttons'} to={'ui/button'} />
 					<MenuItem icon={line} label={'Toasts'} to={'ui/toast'} />
diff --git a/packages/playground/admin/config.ts b/packages/playground/admin/app/config.ts
similarity index 85%
rename from packages/playground/admin/config.ts
rename to packages/playground/admin/app/config.ts
index fe47dbbf02..7dd15ebfd8 100644
--- a/packages/playground/admin/config.ts
+++ b/packages/playground/admin/app/config.ts
@@ -1,14 +1,13 @@
 export const getConfig = () => {
 
 	let project = import.meta.env.VITE_CONTEMBER_ADMIN_PROJECT_NAME
+
 	if (project === '__PROJECT_SLUG__') {
 		project = window.location.pathname.split('/')[1]
 	}
 
-	let basePath = import.meta.env.BASE_URL ?? '/'
-	if (basePath === './') {
-		basePath = `/${project}/`
-	}
+	const basePath = `/${window.location.pathname.split('/')[1]}/`
+
 	const apiBaseUrl = import.meta.env.VITE_CONTEMBER_ADMIN_API_BASE_URL as string
 	if (!apiBaseUrl) {
 		throw new Error('VITE_CONTEMBER_ADMIN_API_BASE_URL is not set')
diff --git a/packages/playground/admin/app/index.html b/packages/playground/admin/app/index.html
new file mode 100644
index 0000000000..d6c212019e
--- /dev/null
+++ b/packages/playground/admin/app/index.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+	<meta charset="utf-8">
+	<meta name="viewport" content="width=device-width, viewport-fit=cover, initial-scale=1">
+	<link rel="icon" type="image/png" href="../favicon.png">
+	<link rel="apple-touch-icon" href="../apple-touch-icon.png">
+	<title>Contember Interface</title>
+	<script type="module" src="/app/index.tsx"></script>
+
+</head>
+
+</html>
diff --git a/packages/playground/admin/app/index.tsx b/packages/playground/admin/app/index.tsx
new file mode 100644
index 0000000000..3778c76c8e
--- /dev/null
+++ b/packages/playground/admin/app/index.tsx
@@ -0,0 +1,40 @@
+import { ApplicationEntrypoint, PageModule, Pages } from '@contember/interface'
+import { SlotsProvider } from '@contember/react-slots'
+import { Layout } from './components/layout'
+import '../index.css'
+import { Toaster } from '../lib/components/ui/toast'
+import { createErrorHandler, DevBar, DevPanel } from '@contember/react-devbar'
+import { LogInIcon } from 'lucide-react'
+import { LoginWithEmail } from '../lib/components/dev/login-panel'
+import { createRoot } from 'react-dom/client'
+import { getConfig } from './config'
+import { OutdatedApplicationDialog } from '../lib/components/outdated-application-dialog'
+
+const errorHandler = createErrorHandler((dom, react, onRecoverableError) => createRoot(dom, { onRecoverableError }).render(react))
+
+const rootEl = document.body.appendChild(document.createElement('div'))
+
+errorHandler(onRecoverableError => createRoot(rootEl, { onRecoverableError }).render(<>
+	<SlotsProvider>
+		<ApplicationEntrypoint
+			{...getConfig()}
+			children={
+				<>
+					<Toaster>
+						<Pages
+							layout={Layout}
+							children={import.meta.glob<PageModule>(
+								'./pages/**/*.tsx',
+								{ eager: true },
+							)}
+						/>
+						{import.meta.env.DEV && <DevBar>
+							<DevPanel heading="Login" icon={<LogInIcon />}><LoginWithEmail /></DevPanel>
+						</DevBar>}
+					</Toaster>
+					<OutdatedApplicationDialog />
+				</>
+			}
+		/>
+	</SlotsProvider>
+</>))
diff --git a/packages/playground/admin/app/pages/tenant.tsx b/packages/playground/admin/app/pages/tenant.tsx
new file mode 100644
index 0000000000..11771f728c
--- /dev/null
+++ b/packages/playground/admin/app/pages/tenant.tsx
@@ -0,0 +1,125 @@
+import { ChangeMyPasswordForm, CreateApiKeyForm, InviteForm } from '@contember/react-identity'
+import { Card, CardContent, CardHeader, CardTitle } from '../../lib/components/ui/card'
+import { ChangeMyPasswordFormFields } from '../../lib/components/tenant/changeMyPasswordForm'
+import { ToastContent, useShowToast } from '../../lib/components/ui/toast'
+import { OtpSetup } from '../../lib/components/tenant/otpSetup'
+import { PersonList } from '../../lib/components/tenant/personList'
+import { InviteFormFields } from '../../lib/components/tenant/inviteForm'
+import { useProjectSlug } from '@contember/react-client'
+import { Input } from '../../lib/components/ui/input'
+import { CreateApiKeyFormFields } from '../../lib/components/tenant/createApiKeyForm'
+import { ApiKeyList } from '../../lib/components/tenant/apiKeyList'
+import { useRef } from 'react'
+import { MemberListController } from '../../lib/components/tenant/memberList'
+
+export const Security = () => {
+	const showToast = useShowToast()
+	return (
+		<div className="flex flex-col items-center gap-4">
+			<Card className="w-[40rem] max-w-full">
+				<CardHeader>
+					<CardTitle className="text-2xl">Change Password</CardTitle>
+				</CardHeader>
+				<CardContent>
+					<ChangeMyPasswordForm onSuccess={() => showToast(<ToastContent>Password changed</ToastContent>, { type: 'success' })}>
+						<form className="grid gap-4">
+							<ChangeMyPasswordFormFields />
+						</form>
+					</ChangeMyPasswordForm>
+				</CardContent>
+			</Card>
+			<Card className="w-[40rem] max-w-full">
+				<CardHeader>
+					<CardTitle className="text-2xl">Two-factor setup</CardTitle>
+				</CardHeader>
+				<CardContent>
+					<OtpSetup />
+				</CardContent>
+			</Card>
+		</div>
+	)
+}
+
+
+export const Members = () => {
+	const projectSlug = useProjectSlug()!
+	const showToast = useShowToast()
+	const memberListController = useRef<MemberListController>()
+	return (
+		<div className="grid md:grid-cols-2 gap-4">
+			<div>
+				<Card className="w-[40rem] max-w-full">
+					<CardHeader>
+						<CardTitle className="text-2xl">Members</CardTitle>
+					</CardHeader>
+					<CardContent>
+						<PersonList controller={memberListController} />
+					</CardContent>
+				</Card>
+			</div>
+			<div>
+				<Card className="w-[40rem] max-w-full">
+					<CardHeader>
+						<CardTitle className="text-2xl">Invite</CardTitle>
+					</CardHeader>
+					<CardContent>
+						<InviteForm
+							projectSlug={projectSlug}
+							initialMemberships={[{ role: 'admin', variables: [] }]}
+							onSuccess={args => {
+								showToast(<ToastContent>Invitation sent to {args.result.person?.email}</ToastContent>, { type: 'success' })
+								memberListController.current?.refresh()
+							}}
+						>
+							<form className="grid gap-4">
+								<InviteFormFields projectSlug={projectSlug} />
+							</form>
+						</InviteForm>
+					</CardContent>
+				</Card>
+			</div>
+		</div>
+	)
+}
+
+export const ApiKeys = () => {
+	const projectSlug = useProjectSlug()!
+	const showToast = useShowToast()
+	const memberListController = useRef<MemberListController>()
+	return (
+		<div className="grid md:grid-cols-2 gap-4">
+			<div>
+				<Card className="w-[40rem] max-w-full">
+					<CardHeader>
+						<CardTitle className="text-2xl">API keys</CardTitle>
+					</CardHeader>
+					<CardContent>
+						<ApiKeyList controller={memberListController} />
+					</CardContent>
+				</Card>
+			</div>
+			<div>
+				<Card className="w-[40rem] max-w-full">
+					<CardHeader>
+						<CardTitle className="text-2xl">Create API key</CardTitle>
+					</CardHeader>
+					<CardContent>
+						<CreateApiKeyForm
+							projectSlug={projectSlug}
+							initialMemberships={[{ role: 'admin', variables: [] }]}
+							onSuccess={args => {
+								showToast(<ToastContent title="API key created"><Input value={args.result.apiKey.token} type="text" /></ToastContent>, { type: 'success' })
+								memberListController.current?.refresh()
+							}}
+						>
+							<form className="grid gap-4">
+								<CreateApiKeyFormFields projectSlug={projectSlug} />
+							</form>
+						</CreateApiKeyForm>
+					</CardContent>
+
+				</Card>
+			</div>
+		</div>
+	)
+}
diff --git a/packages/playground/admin/app/pages/ui/button.tsx b/packages/playground/admin/app/pages/ui/button.tsx
index 58f1c5811c..f9c84a88ec 100644
--- a/packages/playground/admin/app/pages/ui/button.tsx
+++ b/packages/playground/admin/app/pages/ui/button.tsx
@@ -3,7 +3,7 @@ import { HomeIcon } from 'lucide-react'
 
 export default <>
 
-	<div className={'flex flex-col gap-2 items-start'}>
+	<div className={'flex flex-col gap-2 items-start h-screen'}>
 		<h2 className={'text-2xl'}>Button variants</h2>
 		<Button>Default button</Button>
 		<Button variant={'outline'}>Outline button</Button>
diff --git a/packages/playground/admin/index.html b/packages/playground/admin/index.html
index 189bd7f3c9..07d3d87b7c 100644
--- a/packages/playground/admin/index.html
+++ b/packages/playground/admin/index.html
@@ -4,10 +4,10 @@
 <head>
 	<meta charset="utf-8">
 	<meta name="viewport" content="width=device-width, viewport-fit=cover, initial-scale=1">
-	<link rel="icon" type="image/png" href="./favicon.png">
-	<link rel="apple-touch-icon" href="./apple-touch-icon.png">
+	<link rel="icon" type="image/png" href="favicon.png">
+	<link rel="apple-touch-icon" href="apple-touch-icon.png">
 	<title>Contember Interface</title>
-	<script type="module" src="./index.tsx"></script>
+	<script type="module" src="/index.tsx"></script>
 </head>
 
 </html>
diff --git a/packages/playground/admin/index.tsx b/packages/playground/admin/index.tsx
index 0c9bc56b30..f164f3eeaf 100644
--- a/packages/playground/admin/index.tsx
+++ b/packages/playground/admin/index.tsx
@@ -1,40 +1,251 @@
-import { ApplicationEntrypoint, PageModule, Pages } from '@contember/interface'
-import { SlotsProvider } from '@contember/react-slots'
-import { Layout } from './app/components/layout'
 import './index.css'
-import { Toaster } from './lib/components/ui/toast'
-import { createErrorHandler, DevBar, DevPanel } from '@contember/react-devbar'
-import { LogInIcon } from 'lucide-react'
-import { LoginWithEmail } from './lib/components/dev/login-panel'
+import { createErrorHandler } from '@contember/react-devbar'
 import { createRoot } from 'react-dom/client'
-import { getConfig } from './config'
-import { OutdatedApplicationDialog } from './lib/components/outdated-application-dialog'
+import { LoginFormFields } from './lib/components/tenant/loginForm'
+import { ContemberClient } from '@contember/react-client'
+import { IdentityProvider, IdentityState, IDP, IDPInitTrigger, IDPState, LoginForm, LogoutTrigger, PasswordResetForm, PasswordResetRequestForm } from '@contember/react-identity'
+import { Link, RoutingProvider, useCurrentRequest, useRedirect } from '@contember/react-routing'
+import { Pages, useIdentity } from '@contember/interface'
+import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from './lib/components/ui/card'
+import { AnchorButton, Button } from './lib/components/ui/button'
+import { PasswordResetRequestFormFields } from './lib/components/tenant/passwordResetRequestForm'
+import { MailIcon } from 'lucide-react'
+import { PasswordResetFormFields } from './lib/components/tenant/passwordResetForm'
+import { ToastContent, Toaster, useShowToast } from './lib/components/ui/toast'
+import { Loader } from './lib/components/ui/loader'
+import { Overlay } from './lib/components/ui/overlay'
+import { useEffect } from 'react'
+import { dict } from './lib/dict'
 
 const errorHandler = createErrorHandler((dom, react, onRecoverableError) => createRoot(dom, { onRecoverableError }).render(react))
 
 const rootEl = document.body.appendChild(document.createElement('div'))
 
+const Idps = {
+	google: 'Login with Google',
+}
+
+const hasTokenFromEnv = import.meta.env.VITE_CONTEMBER_ADMIN_SESSION_TOKEN !== '__SESSION_TOKEN__'
+const appUrl = '/app'
+
+const Login = () => {
+	const showToast = useShowToast()
+	return <>
+		<IDP
+			onInitError={error => showToast(<ToastContent>{dict.tenant.login.idpInitError} {error}</ToastContent>, { type: 'error' })}
+			onResponseError={error => showToast(<ToastContent>{dict.tenant.login.idpResponseError} {error}</ToastContent>, { type: 'error' })}
+		>
+
+			<Card className="w-96 relative">
+				<CardHeader>
+					<CardTitle className="text-2xl">{dict.tenant.login.title}</CardTitle>
+					<CardDescription>
+						{dict.tenant.login.description}
+					</CardDescription>
+				</CardHeader>
+				<CardContent>
+					{hasTokenFromEnv && <AnchorButton href={appUrl} size="lg" className="w-full" variant="destructive">
+						Continue as default user
+					</AnchorButton>}
+					<LoginForm>
+						<form className="grid gap-4">
+							<LoginFormFields />
+						</form>
+					</LoginForm>
+
+					{Object.entries(Idps).map(([idp, label]) => (
+						<IDPInitTrigger key={idp} identityProvider={idp}>
+							<Button variant="outline" className="w-full">
+								{label}
+							</Button>
+						</IDPInitTrigger>
+					))}
+				</CardContent>
+				<IDPState state={['processing_init', 'processing_response', 'success']}>
+					<Loader />
+				</IDPState>
+			</Card>
+		</IDP>
+	</>
+}
+
+const LoggedIn = () => {
+	const identity = useIdentity()
+	useEffect(() => {
+		setTimeout(() => {
+			window.location.href = appUrl
+		}, 500)
+	}, [])
+
+	return (
+		<Card className="w-96 relative">
+			<CardHeader>
+				<CardTitle className="text-2xl">Logged in </CardTitle>
+				<CardDescription>
+					as {identity?.person?.email ?? 'unknown'}
+				</CardDescription>
+			</CardHeader>
+			<Loader position="static" />
+		</Card>
+	)
+
+}
+
+const IndexPage = () => {
+	return (
+		<IdentityProvider>
+			<IdentityState state={['none', 'cleared']}>
+				<Login />
+			</IdentityState>
+			<IdentityState state="success">
+				<LoggedIn />
+			</IdentityState>
+			<IdentityState state="loading">
+				<Loader />
+			</IdentityState>
+			<IdentityState state="failed">
+				<Overlay>
+					<div className="bg-gray-100 flex flex-col gap-4 items-center justify-center p-16 rounded-lg shadow-lg border">
+						<p className="text-lg">
+							Failed to load identity.
+						</p>
+						<LogoutTrigger>
+							<Button className="w-full" variant="outline">Logout</Button>
+						</LogoutTrigger>
+					</div>
+				</Overlay>
+			</IdentityState>
+		</IdentityProvider>
+	)
+}
+
+const PasswordResetRequestPage = () => {
+	const redirect = useRedirect()
+	return (
+		<Card className="w-96">
+			<CardHeader>
+				<CardTitle className="text-2xl">{dict.tenant.passwordResetRequest.title}</CardTitle>
+				<CardDescription>
+					{dict.tenant.passwordResetRequest.description}
+				</CardDescription>
+			</CardHeader>
+			<CardContent>
+				<PasswordResetRequestForm onSuccess={() => redirect('resetRequestSuccess')}>
+					<form>
+						<PasswordResetRequestFormFields />
+					</form>
+				</PasswordResetRequestForm>
+			</CardContent>
+			<CardFooter>
+				<Link to="index">
+					<AnchorButton variant="link" className="ml-auto">
+						{dict.tenant.login.backToLogin}
+					</AnchorButton>
+				</Link>
+			</CardFooter>
+		</Card>
+	)
+}
+
+const PasswordResetPage = () => {
+	const request = useCurrentRequest()
+	const redirect = useRedirect()
+	const showToast = useShowToast()
+	const token = request?.parameters.token as string | undefined
+	return (
+		<Card className="w-96">
+			<CardHeader>
+				<CardTitle className="text-2xl">{dict.tenant.passwordReset.title}</CardTitle>
+				<CardDescription>
+					{dict.tenant.passwordReset.description}
+				</CardDescription>
+			</CardHeader>
+			<CardContent>
+				<PasswordResetForm onSuccess={() => {
+					showToast(<ToastContent>
+						Password has been reset
+					</ToastContent>, { type: 'success' })
+					redirect('index')
+				}} token={token}>
+					<form>
+						<PasswordResetFormFields hasToken={!!token} />
+					</form>
+				</PasswordResetForm>
+			</CardContent>
+			<CardFooter>
+				<Link to="index">
+					<AnchorButton variant="link" className="ml-auto">
+						{dict.tenant.login.backToLogin}
+					</AnchorButton>
+				</Link>
+			</CardFooter>
+		</Card>
+	)
+}
+
+const PasswordResetRequestSuccessPage = () => (
+	<Card className="w-96">
+		<CardHeader>
+			<CardTitle className="text-2xl">{dict.tenant.passwordResetRequest.title}</CardTitle>
+			<CardDescription>
+				{dict.tenant.passwordResetRequest.description}
+			</CardDescription>
+		</CardHeader>
+		<CardContent>
+			<div className="flex flex-col items-center justify-center gap-4">
+				<MailIcon className="text-gray-300 w-16 h-16" />
+				<div className="text-center">
+					An email with password reset instructions has been sent to your email address.
+				</div>
+				<div className="text-center text-gray-500">
+					<Link to="passwordReset"><a className="underline">{dict.tenant.passwordResetRequest.entryCode}</a></Link>
+				</div>
+			</div>
+		</CardContent>
+		<CardFooter>
+			<Link to="index">
+				<AnchorButton variant="link" className="ml-auto">
+					{dict.tenant.login.backToLogin}
+				</AnchorButton>
+			</Link>
+		</CardFooter>
+	</Card>
+)
+
+const Layout = ({ children }: { children?: React.ReactNode }) => (
+	<div className="grid md:grid-cols-2 min-h-screen ">
+		<div className="bg-gray-100 p-4 flex items-center justify-center">
+			{children}
+		</div>
+		<div className="bg-gray-700 text-white p-4 flex items-center justify-center">
+			<div className="w-full max-w-md">
+				<div className="text-center text-2xl">Welcome to your app</div>
+				<p className="mt-8 text-center text-gray-300">Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec auctor, sem eget ultricies ultricies, sapien urna tristique eros, ac tincidunt felis lacus nec nunc.</p>
+			</div>
+		</div>
+	</div>
+)
+
+
 errorHandler(onRecoverableError => createRoot(rootEl, { onRecoverableError }).render(<>
-	<SlotsProvider>
-		<ApplicationEntrypoint
-			{...getConfig()}
-			children={
-				<>
-					<Toaster>
-						<Pages
-							layout={Layout}
-							children={import.meta.glob<PageModule>(
-								'./app/pages/**/*.tsx',
-								{ eager: true },
-							)}
-						/>
-						<OutdatedApplicationDialog />
-						{import.meta.env.DEV && <DevBar>
-							<DevPanel heading="Login" icon={<LogInIcon />}><LoginWithEmail /></DevPanel>
-						</DevBar>}
-					</Toaster>
-				</>
-			}
-		/>
-	</SlotsProvider>
+	<ContemberClient
+		apiBaseUrl={import.meta.env.VITE_CONTEMBER_ADMIN_API_BASE_URL}
+		loginToken={import.meta.env.VITE_CONTEMBER_ADMIN_LOGIN_TOKEN}
+	>
+		<RoutingProvider pageInQuery>
+			<Toaster>
+				<Pages
+					layout={Layout}
+					children={{
+						index: IndexPage,
+						resetRequest: PasswordResetRequestPage,
+						resetRequestSuccess: PasswordResetRequestSuccessPage,
+						passwordReset: PasswordResetPage,
+					}}
+				/>
+			</Toaster>
+		</RoutingProvider>
+
+	</ContemberClient>
 </>))
+
diff --git a/packages/playground/admin/lib/components/dev/login-panel.tsx b/packages/playground/admin/lib/components/dev/login-panel.tsx
index 14050d8b15..b94a8ffe1e 100644
--- a/packages/playground/admin/lib/components/dev/login-panel.tsx
+++ b/packages/playground/admin/lib/components/dev/login-panel.tsx
@@ -1,50 +1,56 @@
-import { SyntheticEvent, useCallback, useState } from 'react'
-import { ToastContent, useShowToast } from '../ui/toast'
-import { StandaloneFormContainer } from '../form'
-import { Input } from '../ui/input'
 import { Button } from '../ui/button'
 import { useSessionTokenWithMeta, useSetSessionToken } from '@contember/react-client'
-import * as TenantApi from '@contember/graphql-client-tenant'
-import { useTenantApi } from '@contember/react-client-tenant'
+import { CreateSessionTokenForm, useCreateSessionTokenForm } from '@contember/react-client-tenant'
+import { Loader } from '../ui/loader'
+import { TenantFormError, TenantFormField } from '../tenant/common'
 
 export const LoginWithEmail = () => {
-	const [email, setEmail] = useState('')
 	const sessionToken = useSessionTokenWithMeta()
-	const addToast = useShowToast()
-	const [isSubmitting, setSubmitting] = useState(false)
 	const setSessionToken = useSetSessionToken()
-	const api = useTenantApi()
-
-	const submit = useCallback(async (e: SyntheticEvent) => {
-		e.preventDefault()
-
-		setSubmitting(true)
-		const response = await api(TenantApi.mutation$.createSessionToken(TenantApi.createSessionTokenResponse$$.error(TenantApi.createSessionTokenError$$).result(TenantApi.createSessionTokenResult$$)), {
-			variables: {
-				email,
-			},
-			apiToken: sessionToken.propsToken,
-		})
-		setSubmitting(false)
-
-		if (!response.createSessionToken?.ok) {
-			switch (response.createSessionToken?.error?.code) {
-				case 'UNKNOWN_EMAIL':
-					return addToast(<ToastContent title="Person with given email not found." />, { type: 'error' })
-			}
-		} else {
-			setSessionToken(response.createSessionToken.result!.token)
-		}
-	}, [addToast, api, email, sessionToken.propsToken, setSessionToken])
 
 	return <>
-		<form onSubmit={submit}>
-			<div>
-				<StandaloneFormContainer label={'E-mail'}>
-					<Input value={email} onChange={e => setEmail(e.target.value)} />
-				</StandaloneFormContainer>
-				<Button type="submit" disabled={isSubmitting}>Login</Button>
-			</div>
-		</form>
+		<CreateSessionTokenForm
+			expiration={3600 * 24 * 7}
+			apiToken={sessionToken.propsToken}
+			onSuccess={it => {
+				setSessionToken(it.result.token)
+			}}>
+			<form>
+				<CreateSessionTokenFormFields />
+			</form>
+		</CreateSessionTokenForm>
 	</>
 }
+
+
+const CreateSessionTokenFormFields = () => {
+	const form = useCreateSessionTokenForm()
+
+	const messages = {
+		FIELD_REQUIRED: 'This field is required',
+		UNKNOWN_ERROR: 'An unknown error occurred',
+		PERSON_DISABLED: 'Person is disabled',
+		UNKNOWN_EMAIL: 'Person with given email not found',
+		UNKNOWN_PERSON_ID: 'Person with given ID not found',
+	}
+	return (
+		<div className="relative flex flex-col gap-2">
+			{form.state === 'submitting' ? <Loader position="absolute" /> : null}
+
+			<TenantFormError
+				form={form} messages={messages}
+			/>
+
+			<TenantFormField
+				form={form} messages={messages} field="email"
+				type="text" required autoFocus
+			>
+				E-mail
+			</TenantFormField>
+
+			<Button type="submit" className="w-full" disabled={form.state === 'submitting'}>
+				Login
+			</Button>
+		</div>
+	)
+}
diff --git a/packages/playground/admin/lib/components/form/ui.tsx b/packages/playground/admin/lib/components/form/ui.tsx
index ef720857e9..820eff3981 100644
--- a/packages/playground/admin/lib/components/form/ui.tsx
+++ b/packages/playground/admin/lib/components/form/ui.tsx
@@ -20,7 +20,7 @@ export const FormLabelWrapperUI = uic('div', {
 	displayName: 'FormLabelWrapper',
 })
 export const FormLabelUI = uic(Label, {
-	baseClass: 'data-[invalid]:text-destructive text-left',
+	baseClass: 'text-left',
 	displayName: 'FormLabel',
 })
 export const FormContainerUI = uic('div', {
diff --git a/packages/playground/admin/lib/components/tenant/apiKeyList.tsx b/packages/playground/admin/lib/components/tenant/apiKeyList.tsx
new file mode 100644
index 0000000000..ae000a2f36
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/apiKeyList.tsx
@@ -0,0 +1,25 @@
+import { ProjectMembersFilter } from '@contember/graphql-client-tenant'
+import * as React from 'react'
+import { TableCell } from '../ui/table'
+import { dict } from '../../dict'
+import { MemberList, MemberListController } from './memberList'
+
+const filter: ProjectMembersFilter = {
+	memberType: 'API_KEY',
+}
+
+export const ApiKeyList = (props: { controller?: { current?: MemberListController } }) => (
+	<MemberList
+		{...props}
+		filter={filter}
+		labels={{
+			deleteConfirmation: dict.tenant.apiKeyList.deleteConfirmation,
+			deleted: dict.tenant.apiKeyList.deleted,
+			deleteFailed: dict.tenant.apiKeyList.deleteFailed,
+		}}
+		tableHeaders={[dict.tenant.apiKeyList.description]}
+		tableColumns={it => <>
+			<TableCell key="description">{it.identity.description ?? dict.tenant.apiKeyList.unnamed}</TableCell>
+		</>}
+	/>
+)
diff --git a/packages/playground/admin/lib/components/tenant/changeMyPasswordForm.tsx b/packages/playground/admin/lib/components/tenant/changeMyPasswordForm.tsx
new file mode 100644
index 0000000000..2fd06f05bb
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/changeMyPasswordForm.tsx
@@ -0,0 +1,40 @@
+import { ChangeMyPasswordFormErrorCode, useChangeMyPasswordForm } from '@contember/react-identity'
+import { Button } from '../ui/button'
+import { Loader } from '../ui/loader'
+import { TenantFormError, TenantFormField } from './common'
+import { dict } from '../../dict'
+
+
+export const ChangeMyPasswordFormFields = () => {
+	const form = useChangeMyPasswordForm()
+	return (
+		<div className="relative flex flex-col gap-2">
+			{form.state === 'submitting' ? <Loader position="absolute" /> : null}
+			<TenantFormError
+				form={form} messages={dict.tenant.changePassword.errorMessages}
+			/>
+			<TenantFormField
+				form={form} messages={dict.tenant.changePassword.errorMessages} field="currentPassword"
+				type="password" required autoFocus autoComplete="current-password"
+			>
+				{dict.tenant.changePassword.currentPassword}
+			</TenantFormField>
+			<TenantFormField
+				form={form} messages={dict.tenant.changePassword.errorMessages} field="newPassword"
+				type="password" required autoComplete="new-password"
+			>
+				{dict.tenant.changePassword.newPassword}
+			</TenantFormField>
+			<TenantFormField
+				form={form} messages={dict.tenant.changePassword.errorMessages} field="passwordConfirmation"
+				type="password" required autoComplete="new-password"
+			>
+				{dict.tenant.changePassword.confirmPassword}
+			</TenantFormField>
+
+			<Button type="submit" className="w-full" disabled={form.state === 'submitting'}>
+				{dict.tenant.changePassword.submit}
+			</Button>
+		</div>
+	)
+}
diff --git a/packages/playground/admin/lib/components/tenant/common.tsx b/packages/playground/admin/lib/components/tenant/common.tsx
new file mode 100644
index 0000000000..9790717247
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/common.tsx
@@ -0,0 +1,94 @@
+import { FormContextValue } from '@contember/react-identity'
+import { FormErrorUI } from '../form'
+import { Input } from '../ui/input'
+import { HTMLInputTypeAttribute, useState } from 'react'
+import { dataAttribute } from '@contember/utilities'
+import { Label } from '../ui/label'
+
+export interface TenantFormErrorsProps<CtxValue extends FormContextValue<any, any, any>> {
+	form: CtxValue
+	field?: keyof CtxValue['values']
+	messages: Record<CtxValue extends FormContextValue<any, infer E> ? E : never, string>
+}
+
+export const TenantFormError = <CtxValue extends FormContextValue<any, any, any>>({ form, field, messages }: TenantFormErrorsProps<CtxValue>) => {
+	return (
+		<div>
+			{form.errors
+				.filter(error => error.field === field)
+				.filter(it => !(it.code in messages && ((messages as any)[it.code] === undefined)))
+				.map(error => [error.code, { error: (messages as any)[error.code] || 'Unknown error', developerMessage: error.developerMessage }])
+				.map(([code, error]) => {
+					return (<TenantFormSingleError key={code} {...error} />)
+				})}
+		</div>
+	)
+}
+
+const TenantFormSingleError = ({ error, developerMessage }: { error: string, developerMessage?: string }) => {
+	const [showDeveloperMessage, setShowDeveloperMessage] = useState(false)
+	return <>
+		<FormErrorUI>{error}</FormErrorUI>
+		{/*{developerMessage && <div>*/}
+		{/*	{showDeveloperMessage*/}
+		{/*		? <div className="mt-1 text-xs font-light font-mono bg-gray-50 shadow-inner p-2 rounded border">{developerMessage}</div>*/}
+		{/*		: <button className="text-xs underline" onClick={() => setShowDeveloperMessage(!showDeveloperMessage)}>Show details</button>}*/}
+		{/*</div>}*/}
+	</>
+}
+
+export type TenantFormInputProps<CtxValue extends FormContextValue<any, any, any>> =
+	& {
+		form: CtxValue
+		type: HTMLInputTypeAttribute
+		field: keyof CtxValue['values'] & string
+	}
+	& Omit<Partial<React.InputHTMLAttributes<HTMLInputElement>>, 'form' | 'field'>
+
+export const TenantFormInput = <CtxValue extends FormContextValue<any, any, any>>({ form, field, ...props }: TenantFormInputProps<CtxValue>) => {
+	return (
+		<Input
+			id={field}
+			onChange={e => form.setValue(field, e.target.value)}
+			value={form.values[field]}
+			data-invalid={dataAttribute(form.errors.some(it => it.field === field))}
+			{...props}
+		/>
+	)
+}
+
+export type TenantFormLabelProps<CtxValue extends FormContextValue<any, any, any>> =
+	& {
+		form: CtxValue
+		field: keyof CtxValue['values'] & string
+	}
+	& Omit<Partial<React.LabelHTMLAttributes<HTMLLabelElement>>, 'form' | 'htmlFor'>
+
+export const TenantFormLabel = <CtxValue extends FormContextValue<any, any, any>>({ form, field, ...props }: TenantFormLabelProps<CtxValue>) => {
+	return (
+		<Label
+			htmlFor={field}
+			data-invalid={dataAttribute(form.errors.some(it => it.field === field))}
+			{...props}
+		/>
+	)
+}
+
+export type TenantFormFieldProps<CtxValue extends FormContextValue<any, any, any>> =
+	& {
+		form: CtxValue
+		field: keyof CtxValue['values'] & string
+		type: HTMLInputTypeAttribute
+		messages: Record<CtxValue extends FormContextValue<any, infer E> ? E : never, string>
+	}
+	& Omit<Partial<React.InputHTMLAttributes<HTMLInputElement>>, 'form' | 'field'>
+
+export const TenantFormField = <CtxValue extends FormContextValue<any, any, any>>({ form, field, type, messages, children, ...props }: TenantFormFieldProps<CtxValue>) => {
+	return (
+		<div className="flex flex-col gap-2">
+			<TenantFormLabel form={form} field={field}>{children}</TenantFormLabel>
+			<TenantFormInput form={form} field={field} type={type} {...props} />
+			<TenantFormError form={form} field={field} messages={messages} />
+		</div>
+	)
+}
diff --git a/packages/playground/admin/lib/components/tenant/createApiKeyForm.tsx b/packages/playground/admin/lib/components/tenant/createApiKeyForm.tsx
new file mode 100644
index 0000000000..114ee40c01
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/createApiKeyForm.tsx
@@ -0,0 +1,39 @@
+import { CreateApiKeyFormErrorCode, useCreateApiKeyForm } from '@contember/react-identity'
+import { Button } from '../ui/button'
+import { Loader } from '../ui/loader'
+import { TenantFormError, TenantFormField, TenantFormLabel } from './common'
+import { MembershipsControl, useIntrospectionRolesConfig } from './membershipsControl'
+import { dict } from '../../dict'
+
+
+export const CreateApiKeyFormFields = ({ projectSlug }: {projectSlug: string}) => {
+	const form = useCreateApiKeyForm()
+	return (
+		<div className="relative flex flex-col gap-2">
+			{form.state === 'submitting' ? <Loader position="absolute" /> : null}
+
+			<TenantFormError
+				form={form} messages={dict.tenant.createApiKey.errorMessages}
+			/>
+
+			<TenantFormField
+				form={form} messages={dict.tenant.createApiKey.errorMessages} field="description"
+				type="text" required autoFocus
+			>
+				{dict.tenant.createApiKey.description}
+			</TenantFormField>
+
+			<TenantFormLabel form={form} field="memberships">{dict.tenant.createApiKey.roles}</TenantFormLabel>
+			<MembershipsControl
+				memberships={form.values.memberships}
+				setMemberships={it => form.setValue('memberships', it)}
+				roles={useIntrospectionRolesConfig(projectSlug)}
+			/>
+			<TenantFormError form={form} messages={dict.tenant.createApiKey.errorMessages} field="memberships" />
+
+			<Button type="submit" className="w-full" disabled={form.state === 'submitting'}>
+				{dict.tenant.createApiKey.submit}
+			</Button>
+		</div>
+	)
+}
diff --git a/packages/playground/admin/lib/components/tenant/inviteForm.tsx b/packages/playground/admin/lib/components/tenant/inviteForm.tsx
new file mode 100644
index 0000000000..8f205fdff2
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/inviteForm.tsx
@@ -0,0 +1,46 @@
+import { InviteFormErrorCode, useInviteForm } from '@contember/react-identity'
+import { Button } from '../ui/button'
+import { Loader } from '../ui/loader'
+import { TenantFormError, TenantFormField, TenantFormLabel } from './common'
+import { MembershipsControl, useIntrospectionRolesConfig } from './membershipsControl'
+import { dict } from '../../dict'
+
+
+export const InviteFormFields = ({ projectSlug }: {projectSlug: string}) => {
+	const form = useInviteForm()
+	return (
+		<div className="relative flex flex-col gap-2">
+			{form.state === 'submitting' ? <Loader position="absolute" /> : null}
+
+			<TenantFormError
+				form={form} messages={dict.tenant.invite.errorMessages}
+			/>
+
+			<TenantFormField
+				form={form} messages={dict.tenant.invite.errorMessages} field="email"
+				type="email" required autoFocus
+			>
+				{dict.tenant.invite.email}
+			</TenantFormField>
+
+			<TenantFormField
+				form={form} messages={dict.tenant.invite.errorMessages} field="name"
+				type="text"
+			>
+				{dict.tenant.invite.name}
+			</TenantFormField>
+
+			<TenantFormLabel form={form} field="memberships">{dict.tenant.invite.roles}</TenantFormLabel>
+			<TenantFormError form={form} messages={dict.tenant.invite.errorMessages} field="memberships" />
+			<MembershipsControl
+				memberships={form.values.memberships}
+				setMemberships={it => form.setValue('memberships', it)}
+				roles={useIntrospectionRolesConfig(projectSlug)}
+			/>
+
+			<Button type="submit" className="w-full" disabled={form.state === 'submitting'}>
+				{dict.tenant.invite.submit}
+			</Button>
+		</div>
+	)
+}
diff --git a/packages/playground/admin/lib/components/tenant/loginForm.tsx b/packages/playground/admin/lib/components/tenant/loginForm.tsx
new file mode 100644
index 0000000000..b1b2764916
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/loginForm.tsx
@@ -0,0 +1,52 @@
+import { LoginFormErrorCode, useLoginForm } from '@contember/react-identity'
+import { Button } from '../ui/button'
+import { Loader } from '../ui/loader'
+import { TenantFormError, TenantFormField } from './common'
+import { dict } from '../../dict'
+import { Link } from '@contember/interface'
+
+export const LoginFormFields = () => {
+	const form = useLoginForm()
+	const fieldErrors = form.errors.map(it => it.field)
+	return (
+		<div className="relative flex flex-col gap-4">
+			{form.state === 'success' || form.state === 'submitting' ? <Loader position="absolute" /> : null}
+
+			<TenantFormError
+				form={form} messages={dict.tenant.login.errorMessages}
+			/>
+
+			<TenantFormField
+				form={form} messages={dict.tenant.login.errorMessages} field="email"
+				type="email" required autoFocus={form.state === 'initial'} readOnly={form.state === 'otp-required'} placeholder="me@example.com" autoComplete="email"
+			>
+				{dict.tenant.login.email}
+			</TenantFormField>
+
+			<TenantFormField
+				form={form} messages={dict.tenant.login.errorMessages} field="password" autoComplete="current-password"
+				type="password" required readOnly={form.state === 'otp-required'}
+			>
+				{dict.tenant.login.password}
+				<Link to="resetRequest">
+					<a className="float-end underline text-gray-600 text-sm font-normal">
+						{dict.tenant.login.forgotPassword}
+					</a>
+				</Link>
+			</TenantFormField>
+
+			{(form.state === 'otp-required' || fieldErrors.includes('otpToken')) && (
+				<TenantFormField
+					form={form} messages={dict.tenant.login.errorMessages} field="otpToken" autoComplete="one-time-code"
+					type="text" required autoFocus maxLength={6}
+				>
+					{dict.tenant.login.otpToken}
+				</TenantFormField>
+			)}
+
+			<Button type="submit" className="w-full" disabled={form.state === 'submitting'}>
+				{dict.tenant.login.login}
+			</Button>
+		</div>
+	)
+}
diff --git a/packages/playground/admin/lib/components/tenant/memberDeleteDialog.tsx b/packages/playground/admin/lib/components/tenant/memberDeleteDialog.tsx
new file mode 100644
index 0000000000..3231b0fdcd
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/memberDeleteDialog.tsx
@@ -0,0 +1,38 @@
+import { AlertDialog, AlertDialogAction, AlertDialogCancel, AlertDialogContent, AlertDialogFooter, AlertDialogHeader, AlertDialogTitle, AlertDialogTrigger } from '../ui/alert-dialog'
+import { Button } from '../ui/button'
+import { TrashIcon } from 'lucide-react'
+import { dict } from '../../dict'
+import * as React from 'react'
+import { ReactNode } from 'react'
+import { RemoveProjectMemberTrigger } from '@contember/interface'
+
+export interface MemberDeleteProps {
+	title: ReactNode
+	identityId: string
+	projectSlug: string
+	onSuccess: () => void
+	onError: (e: unknown) => void
+}
+
+export const MemberDeleteDialog = ({ onError, title, identityId, onSuccess, projectSlug }: MemberDeleteProps) => {
+	return (
+		<AlertDialog>
+			<AlertDialogTrigger asChild>
+				<Button variant="destructive"><TrashIcon className="w-3 h-3" /></Button>
+			</AlertDialogTrigger>
+			<AlertDialogContent>
+				<AlertDialogHeader>
+					<AlertDialogTitle>{title}</AlertDialogTitle>
+				</AlertDialogHeader>
+				<AlertDialogFooter>
+					<AlertDialogCancel>{dict.tenant.memberDelete.cancel}</AlertDialogCancel>
+					<RemoveProjectMemberTrigger projectSlug={projectSlug} identityId={identityId} onSuccess={onSuccess} onError={onError}>
+						<AlertDialogAction asChild>
+							<Button variant={'destructive'}>{dict.tenant.memberDelete.confirm}</Button>
+						</AlertDialogAction>
+					</RemoveProjectMemberTrigger>
+				</AlertDialogFooter>
+			</AlertDialogContent>
+		</AlertDialog>
+	)
+}
diff --git a/packages/playground/admin/lib/components/tenant/memberList.tsx b/packages/playground/admin/lib/components/tenant/memberList.tsx
new file mode 100644
index 0000000000..cc61c75ada
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/memberList.tsx
@@ -0,0 +1,147 @@
+import { ProjectMembersFilter } from '@contember/graphql-client-tenant'
+import * as React from 'react'
+import { ReactNode, useState } from 'react'
+import { Loader } from '../ui/loader'
+import { Table, TableCell, TableHead, TableHeader, TableRow } from '../ui/table'
+import { Button } from '../ui/button'
+import { ChevronLeftIcon, ChevronRightIcon, PencilIcon, RefreshCwIcon } from 'lucide-react'
+import { ProjectMembersQueryResult, useProjectMembersQuery, useTenantQueryLoader } from '@contember/react-client-tenant'
+import { useProjectSlug } from '@contember/react-client'
+import { UpdateProjectMemberForm } from '@contember/interface'
+import { ToastContent, useShowToast } from '../ui/toast'
+import { dict } from '../../dict'
+import { MemberDeleteDialog } from './memberDeleteDialog'
+import { Dialog, DialogContent, DialogTrigger } from '../ui/dialog'
+import { UpdateProjectMemberFormFields } from './updateProjectMemberForm'
+
+const perPage = 20
+
+export interface MemberListProps {
+	filter: ProjectMembersFilter
+	labels: {
+		deleteConfirmation: string
+		deleted: string
+		deleteFailed: string
+	}
+	tableColumns: (it: ProjectMembersQueryResult[number]) => ReactNode
+	tableHeaders: string[]
+	controller?: { current?: MemberListController }
+}
+
+export interface MemberListController {
+	refresh: () => void
+}
+
+export const MemberList = ({ filter, labels, tableColumns, controller, tableHeaders }: MemberListProps) => {
+	const projectSlug = useProjectSlug()!
+	const [page, setPage] = useState(0)
+
+	const [query, { refresh }] = useTenantQueryLoader(useProjectMembersQuery(), {
+		projectSlug: projectSlug,
+		filter: filter,
+		offset: page * perPage,
+		limit: perPage + 1,
+	})
+	if (controller) {
+		controller.current = { refresh }
+	}
+	const showToast = useShowToast()
+
+	const onDeleteMember = () => {
+		refresh()
+		showToast(<ToastContent>{labels.deleted}</ToastContent>, { type: 'success' })
+	}
+	const onDeleteError = () => {
+		showToast(<ToastContent>{labels.deleteFailed}</ToastContent>, { type: 'error' })
+	}
+
+	switch (query.state) {
+		case 'error':
+			return <div className="text-destructive italic">{dict.tenant.memberList.failedToLoadData}</div>
+		case 'loading':
+		case 'refreshing':
+		case 'success':
+			return (
+				<div className="relative">
+					{query.state !== 'success' && <Loader position="absolute" />}
+					<Table>
+						<TableHeader>
+							<TableRow>
+								{tableHeaders.map(it => <TableHead key={it}>{it}</TableHead>)}
+								<TableHead>{dict.tenant.memberList.roles}</TableHead>
+								<TableHead className="w-32">
+									<div className="flex gap-2 items-center">
+										<span>
+											{dict.tenant.memberList.action}
+										</span>
+										<Button variant="outline" onClick={refresh} className="ml-auto" size="sm"><RefreshCwIcon className="w-3 h-3" /></Button>
+									</div>
+								</TableHead>
+							</TableRow>
+						</TableHeader>
+						{'data' in query && query.data.length === 0 &&
+							<TableRow>
+								<TableCell colSpan={tableHeaders.length + 2}>
+									{dict.tenant.memberList.noResults}
+								</TableCell>
+							</TableRow>}
+						{'data' in query && query.data.slice(0, perPage).map(it => (
+							<TableRow key={it.identity.id}>
+								{tableColumns(it)}
+								<TableCell key="role">{it.memberships.map((m: any) => m.role).join(', ')}</TableCell>
+								<TableCell className="space-x-2 whitespace-nowrap">
+									<MemberDeleteDialog
+										identityId={it.identity.id}
+										projectSlug={projectSlug}
+										onSuccess={onDeleteMember}
+										onError={onDeleteError}
+										title={labels.deleteConfirmation}
+									/>
+									<EditMembershipDialog projectSlug={projectSlug} identityId={it.identity.id} onSuccess={refresh} />
+
+								</TableCell>
+							</TableRow>
+						))}
+					</Table>
+					<div className="flex gap-2 mt-4 justify-between">
+						<Button variant="outline" disabled={page === 0} onClick={() => setPage(page - 1)}>
+							<ChevronLeftIcon className="w-4 h-4" />
+							<span className="sr-only">{dict.tenant.memberList.previous}</span>
+						</Button>
+						<Button variant="outline" disabled={'data' in query && query.data.length <= perPage} onClick={() => setPage(page + 1)}>
+							<ChevronRightIcon className="w-4 h-4" />
+							<span className="sr-only">{dict.tenant.memberList.next}</span>
+						</Button>
+					</div>
+				</div>
+			)
+	}
+}
+
+const EditMembershipDialog = ({ projectSlug, identityId, onSuccess }: { projectSlug: string, identityId: string, onSuccess: () => void }) => {
+
+	const showToast = useShowToast()
+	const [open, setOpen] = useState(false)
+	return (
+		<Dialog open={open} onOpenChange={setOpen}>
+			<DialogTrigger asChild>
+				<Button variant="outline"><PencilIcon className="w-3 h-3" /></Button>
+			</DialogTrigger>
+			<DialogContent>
+				<UpdateProjectMemberForm
+					projectSlug={projectSlug}
+					identityId={identityId}
+					onSuccess={args => {
+						showToast(<ToastContent>{dict.tenant.updateProjectMember.updateSuccess}</ToastContent>)
+						setOpen(false)
+						onSuccess()
+					}}
+				>
+					<form className="grid gap-4">
+						<UpdateProjectMemberFormFields projectSlug={projectSlug} />
+					</form>
+				</UpdateProjectMemberForm>
+			</DialogContent>
+		</Dialog>
+	)
+}
diff --git a/packages/playground/admin/lib/components/tenant/membershipsControl.tsx b/packages/playground/admin/lib/components/tenant/membershipsControl.tsx
new file mode 100644
index 0000000000..51ffd15edc
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/membershipsControl.tsx
@@ -0,0 +1,128 @@
+import { MembershipInput } from '@contember/graphql-client-tenant'
+import { Button } from '../ui/button'
+import { PlusIcon, TrashIcon } from 'lucide-react'
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger } from '../ui/dropdown'
+import { Fragment, ReactNode, useMemo } from 'react'
+import { useProjectRolesDefinitionQuery, useTenantQueryLoader } from '@contember/react-client-tenant'
+import { Textarea } from '../ui/textarea'
+
+export type VariableRendererProps = { value: readonly string[]; onChange: (newValues: readonly string[]) => void }
+export type RolesConfig = {
+	[K in string]: {
+		label: ReactNode
+		variables: {
+			[K in string]: {
+				label: ReactNode
+				render: React.ComponentType<VariableRendererProps>
+			}
+		}
+	}
+}
+
+export interface MembershipsControlProps {
+	memberships: readonly MembershipInput[]
+	setMemberships: (memberships: MembershipInput[]) => void
+	roles?: RolesConfig
+}
+
+export const MembershipsControl = ({ setMemberships, memberships, roles }: MembershipsControlProps) => {
+	const remainingRoles = roles ? Object.keys(roles).filter(role => !memberships.some(it => it.role === role)) : []
+
+	return (
+		<div className="flex flex-col gap-4">
+			{memberships.map(membership => {
+				const role = roles?.[membership.role]
+				return (
+					<div key={membership.role} className="border rounded p-4">
+						<div className="flex justify-between">
+							<h2 className="font-semibold">{role?.label ?? membership.role}</h2>
+							<Button onClick={() => setMemberships(memberships.filter(it => it.role !== membership.role))} variant="destructive" type="button">
+								<TrashIcon className="w-3 h-3" />
+							</Button>
+						</div>
+						<div>
+							{Object.entries(role?.variables ?? {}).map(([variableName, variableConfig]) => {
+								const value = membership.variables.find(it => it.name === variableName)?.values ?? []
+								const VariableComponent = variableConfig.render
+								return (
+									<Fragment key={variableName}>
+										<h3>{variableConfig.label}</h3>
+										<div>
+											<VariableComponent
+												key={variableName}
+												value={value}
+												onChange={newValues => {
+													setMemberships(memberships.map(it =>
+														it.role !== membership.role ? it : {
+															...it,
+															variables: [
+																...it.variables.filter(it => it.name !== variableName),
+																{ name: variableName, values: newValues },
+															],
+														}),
+													)
+												}} />
+										</div>
+									</Fragment>
+								)
+							})}
+							{membership.variables.map(variable => {
+								if (role?.variables[variable.name]) {
+									return null
+								}
+								return (
+									<Fragment key={variable.name}>
+										<h3>{variable.name}</h3>
+										<div>{variable.values.map(it => <div key={it}>{it}</div>)}</div>
+									</Fragment>
+								)
+							})}
+						</div>
+					</div>
+				)
+			})}
+			<div>
+				{remainingRoles.length ? <DropdownMenu>
+					<DropdownMenuTrigger>
+						<Button variant="outline"><PlusIcon className="w-3 h-3" /></Button>
+					</DropdownMenuTrigger>
+					<DropdownMenuContent>
+						{remainingRoles.map(role => <DropdownMenuItem key={role} onClick={() => setMemberships([...memberships, { role: role, variables: [] }])}>{roles?.[role].label}</DropdownMenuItem>)}
+					</DropdownMenuContent>
+				</DropdownMenu> : null}
+			</div>
+		</div>
+	)
+}
+
+export const useIntrospectionRolesConfig = (projectSlug: string): RolesConfig | undefined => {
+	const [result] = useTenantQueryLoader(useProjectRolesDefinitionQuery(), { slug: projectSlug })
+	return useMemo(() => {
+		if (result.state !== 'success') {
+			return undefined
+		}
+		const roles = result.data
+		const rolesConfig: RolesConfig = {}
+		for (const role of roles) {
+			const variables: RolesConfig[string]['variables'] = {}
+			for (const variable of role.variables) {
+				if (variable.__typename === 'RolePredefinedVariableDefinition') {
+					continue
+				}
+				variables[variable.name] = {
+					label: variable.name,
+					render: VariablesEditor,
+				}
+			}
+			rolesConfig[role.name] = {
+				label: role.name,
+				variables: variables,
+			}
+		}
+		return rolesConfig
+	}, [result])
+}
+
+const VariablesEditor = ({ value, onChange }: VariableRendererProps) => {
+	return <Textarea value={value.join('\n')} onChange={e => onChange(e.target.value.split('\n').filter(Boolean))} />
+}
diff --git a/packages/playground/admin/lib/components/tenant/otpSetup.tsx b/packages/playground/admin/lib/components/tenant/otpSetup.tsx
new file mode 100644
index 0000000000..788a90a57c
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/otpSetup.tsx
@@ -0,0 +1,146 @@
+import { useMemo, useState } from 'react'
+import qrcode from 'qrcode-generator'
+import { DisableOtpTrigger, OtpConfirmForm, OtpPrepareForm, useIdentity, useOtpConfirmForm, useOtpPrepareForm } from '@contember/interface'
+import { Loader } from '../ui/loader'
+import { Button } from '../ui/button'
+import { AlertDialog, AlertDialogAction, AlertDialogCancel, AlertDialogContent, AlertDialogDescription, AlertDialogFooter, AlertDialogHeader, AlertDialogTitle, AlertDialogTrigger } from '../ui/alert-dialog'
+import { TenantFormError, TenantFormField } from './common'
+import { ToastContent, useShowToast } from '../ui/toast'
+import { dict } from '../../dict'
+
+export const OtpSetup = () => {
+	const identity = useIdentity()
+	const showToast = useShowToast()
+	const [initializingOtp, setInitializingOtp] = useState(false)
+	const [otpUri, setOtpUri] = useState<string>()
+
+	const person = identity?.person
+
+	if (!person) {
+		return null
+	}
+
+	if (initializingOtp) {
+		return (
+			<OtpPrepareForm
+				onSuccess={({ result: { otpUri } }) => {
+					setInitializingOtp(false)
+					setOtpUri(otpUri)
+				}}
+			>
+				<form>
+					{person.otpEnabled && <>
+						<div className="border-destructive border p-4 mb-4 rounded">
+							{dict.tenant.otpSetup.alreadyHaveOtp}
+						</div>
+					</>}
+					<OtpPrepareFormFields />
+				</form>
+			</OtpPrepareForm>
+		)
+	}
+	if (otpUri) {
+		return <>
+			<p>
+				{dict.tenant.otpSetup.nowScanQrCode}
+			</p>
+			<QrCode data={otpUri} />
+			<p>
+				{dict.tenant.otpSetup.writeDownCode}
+			</p>
+			<OtpConfirmForm onSuccess={() => {
+				showToast(<ToastContent>{dict.tenant.otpSetup.enabledSuccess}</ToastContent>, { type: 'success' })
+			}}>
+				<form>
+					<OtpConfirmFormFields />
+				</form>
+			</OtpConfirmForm>
+		</>
+	}
+
+	if (person.otpEnabled) {
+		return <>
+			<p>
+				{dict.tenant.otpSetup.twoFactorEnabled}
+			</p>
+			<AlertDialog>
+				<AlertDialogTrigger asChild>
+					<Button variant="destructive">{dict.tenant.otpSetup.disableTwoFactor}</Button>
+				</AlertDialogTrigger>
+				<AlertDialogContent>
+					<AlertDialogHeader>
+						<AlertDialogTitle>{dict.tenant.otpSetup.disableTwoFactor}</AlertDialogTitle>
+						<AlertDialogDescription>{dict.tenant.otpSetup.disableTwoFactorConfirm}</AlertDialogDescription>
+					</AlertDialogHeader>
+					<AlertDialogFooter>
+						<AlertDialogCancel>
+							{dict.tenant.otpSetup.cancel}
+						</AlertDialogCancel>
+						<DisableOtpTrigger onSuccess={() => {
+							showToast(<ToastContent>{dict.tenant.otpSetup.disabledSuccess}</ToastContent>, { type: 'success' })
+						}}>
+							<AlertDialogAction variant="destructive">
+								{dict.tenant.otpSetup.disable}
+							</AlertDialogAction>
+						</DisableOtpTrigger>
+					</AlertDialogFooter>
+				</AlertDialogContent>
+			</AlertDialog>
+			<p>{dict.tenant.otpSetup.alreadyHaveOtp}</p>
+			<Button onClick={() => setInitializingOtp(true)}>{dict.tenant.otpSetup.setupAgain}</Button>
+		</>
+	}
+	return <>
+		<p>
+			{dict.tenant.otpSetup.description}
+		</p>
+		<Button onClick={() => setInitializingOtp(true)}>{dict.tenant.otpSetup.setupTwoFactor}</Button>
+	</>
+}
+
+const QrCode = ({ data }: { data: string }) => {
+	const code = useMemo(() => {
+		const qr = qrcode(0, 'L')
+		qr.addData(data)
+		qr.make()
+		return qr.createDataURL(4)
+	}, [data])
+	return <img src={code} />
+}
+
+export const OtpConfirmFormFields = () => {
+	const form = useOtpConfirmForm()
+	return (
+		<div className="relative flex flex-col gap-2">
+			{form.state === 'success' || form.state === 'submitting' ? <Loader position="absolute" /> : null}
+			<TenantFormError form={form} messages={dict.tenant.otpSetup.otpConfirmFormErrorMessages} />
+			<TenantFormField
+				form={form} messages={dict.tenant.otpSetup.otpConfirmFormErrorMessages} field="otpToken"
+				type="text" required
+			>
+				{dict.tenant.otpSetup.otpToken}
+			</TenantFormField>
+			<Button type="submit" className="w-full" disabled={form.state === 'submitting'}>
+				{dict.tenant.otpSetup.confirm}
+			</Button>
+		</div>
+	)
+}
+export const OtpPrepareFormFields = () => {
+	const form = useOtpPrepareForm()
+	return (
+		<div className="relative flex flex-col gap-2">
+			{form.state === 'success' || form.state === 'submitting' ? <Loader position="absolute" /> : null}
+			<TenantFormError form={form} messages={dict.tenant.otpSetup.otpPrepareFormErrorMessages} />
+			<TenantFormField
+				form={form} messages={dict.tenant.otpSetup.otpPrepareFormErrorMessages} field="label"
+				type="text"
+			>
+				{dict.tenant.otpSetup.label}
+			</TenantFormField>
+			<Button type="submit" className="w-full" disabled={form.state === 'submitting'}>
+				{dict.tenant.otpSetup.prepareContinue}
+			</Button>
+		</div>
+	)
+}
diff --git a/packages/playground/admin/lib/components/tenant/passwordResetForm.tsx b/packages/playground/admin/lib/components/tenant/passwordResetForm.tsx
new file mode 100644
index 0000000000..ffd82cf9e3
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/passwordResetForm.tsx
@@ -0,0 +1,44 @@
+import { usePasswordResetForm } from '@contember/react-identity'
+import { Button } from '../ui/button'
+import { Loader } from '../ui/loader'
+import { TenantFormError, TenantFormField } from './common'
+import { dict } from '../../dict'
+
+
+export const PasswordResetFormFields = ({ hasToken }: { hasToken?: boolean }) => {
+	const form = usePasswordResetForm()
+	return (
+		<div className="relative flex flex-col gap-2">
+			{form.state === 'success' || form.state === 'submitting' ? <Loader position="absolute" /> : null}
+
+			<TenantFormError
+				form={form} messages={dict.tenant.passwordReset.errorMessages}
+			/>
+
+			<TenantFormField
+				form={form} messages={dict.tenant.passwordReset.errorMessages} field="token"
+				type="text" required readOnly={hasToken} autoComplete="off"
+			>
+				{dict.tenant.passwordReset.token}
+			</TenantFormField>
+
+			<TenantFormField
+				form={form} messages={dict.tenant.passwordReset.errorMessages} field="password"
+				type="password" required autoFocus autoComplete="new-password"
+			>
+				{dict.tenant.passwordReset.password}
+			</TenantFormField>
+
+			<TenantFormField
+				form={form} messages={dict.tenant.passwordReset.errorMessages} field="passwordConfirmation"
+				type="password" required autoComplete="new-password"
+			>
+				{dict.tenant.passwordReset.passwordConfirmation}
+			</TenantFormField>
+
+			<Button type="submit" className="w-full" disabled={form.state === 'submitting'}>
+				{dict.tenant.passwordReset.submit}
+			</Button>
+		</div>
+	)
+}
diff --git a/packages/playground/admin/lib/components/tenant/passwordResetRequestForm.tsx b/packages/playground/admin/lib/components/tenant/passwordResetRequestForm.tsx
new file mode 100644
index 0000000000..dda598ba76
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/passwordResetRequestForm.tsx
@@ -0,0 +1,31 @@
+import { usePasswordResetRequestForm } from '@contember/react-identity'
+import { Button } from '../ui/button'
+import { Loader } from '../ui/loader'
+import { TenantFormError, TenantFormField } from './common'
+import { dict } from '../../dict'
+
+
+export const PasswordResetRequestFormFields = () => {
+	const form = usePasswordResetRequestForm()
+	return (
+		<div className="relative flex flex-col gap-2">
+			{form.state === 'success' || form.state === 'submitting' ? <Loader position="absolute" /> : null}
+
+			<TenantFormError
+				form={form} messages={dict.tenant.passwordResetRequest.errorMessages}
+			/>
+
+			<TenantFormField
+				form={form} messages={dict.tenant.passwordResetRequest.errorMessages} field="email"
+				type="email" required autoFocus autoComplete="email"
+			>
+				{dict.tenant.passwordResetRequest.email}
+			</TenantFormField>
+
+			<Button type="submit" className="w-full" disabled={form.state === 'submitting'}>
+				{dict.tenant.passwordReset.submit}
+			</Button>
+		</div>
+	)
+}
+
diff --git a/packages/playground/admin/lib/components/tenant/personList.tsx b/packages/playground/admin/lib/components/tenant/personList.tsx
new file mode 100644
index 0000000000..02d88199bd
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/personList.tsx
@@ -0,0 +1,25 @@
+import { ProjectMembersFilter } from '@contember/graphql-client-tenant'
+import * as React from 'react'
+import { TableCell } from '../ui/table'
+import { dict } from '../../dict'
+import { MemberList, MemberListController } from './memberList'
+
+const filter: ProjectMembersFilter = {
+	memberType: 'PERSON',
+}
+export const PersonList = (props: { controller?: { current?: MemberListController } }) => (
+	<MemberList
+		{...props}
+		filter={filter}
+		labels={{
+			deleteConfirmation: dict.tenant.personList.deleteConfirmation,
+			deleted: dict.tenant.personList.deleted,
+			deleteFailed: dict.tenant.personList.deleteFailed,
+		}}
+		tableHeaders={[dict.tenant.personList.email, dict.tenant.personList.name]}
+		tableColumns={it => <>
+			<TableCell key="email">{it.identity.person?.email ?? dict.tenant.personList.noEmail}</TableCell>
+			<TableCell key="name">{it.identity.person?.name ?? dict.tenant.personList.noName}</TableCell>
+		</>}
+	/>
+)
diff --git a/packages/playground/admin/lib/components/tenant/updateProjectMemberForm.tsx b/packages/playground/admin/lib/components/tenant/updateProjectMemberForm.tsx
new file mode 100644
index 0000000000..30c0d10edb
--- /dev/null
+++ b/packages/playground/admin/lib/components/tenant/updateProjectMemberForm.tsx
@@ -0,0 +1,32 @@
+import { useUpdateProjectMemberForm } from '@contember/react-identity'
+import { Button } from '../ui/button'
+import { Loader } from '../ui/loader'
+import { TenantFormError, TenantFormLabel } from './common'
+import { MembershipsControl, useIntrospectionRolesConfig } from './membershipsControl'
+import { dict } from '../../dict'
+
+
+export const UpdateProjectMemberFormFields = ({ projectSlug }: {projectSlug: string}) => {
+	const form = useUpdateProjectMemberForm()
+	return (
+		<div className="relative flex flex-col gap-2">
+			{form.state === 'submitting' || form.state === 'loading' ? <Loader position="absolute" /> : null}
+
+			<TenantFormError
+				form={form} messages={dict.tenant.updateProjectMember.errorMessages}
+			/>
+
+			<TenantFormLabel form={form} field="memberships">{dict.tenant.updateProjectMember.roles}</TenantFormLabel>
+			<TenantFormError form={form} messages={dict.tenant.updateProjectMember.errorMessages} field="memberships" />
+			<MembershipsControl
+				memberships={form.values?.memberships ?? []}
+				setMemberships={it => form.setValue('memberships', it)}
+				roles={useIntrospectionRolesConfig(projectSlug)}
+			/>
+
+			<Button type="submit" className="w-full" disabled={form.state === 'submitting'}>
+				{dict.tenant.updateProjectMember.submit}
+			</Button>
+		</div>
+	)
+}
diff --git a/packages/playground/admin/lib/components/ui/input.tsx b/packages/playground/admin/lib/components/ui/input.tsx
index 39b1306e71..5e65b7f670 100644
--- a/packages/playground/admin/lib/components/ui/input.tsx
+++ b/packages/playground/admin/lib/components/ui/input.tsx
@@ -1,15 +1,16 @@
 import { uic, uiconfig } from '../../../lib/utils/uic'
 
 export const inputConfig = uiconfig({
-	baseClass: 'flex w-full border bg-background file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground focus-visible:outline-none  disabled:cursor-not-allowed disabled:opacity-50 data-[invalid]:border-destructive data-[invalid]:ring-destructive',
+	baseClass: 'flex w-full border bg-background file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground focus-visible:outline-none  disabled:cursor-not-allowed disabled:opacity-50 data-[invalid]:border-destructive data-[invalid]:ring-destructive read-only:bg-gray-100',
 	variants: {
 		variant: {
-			default: 'border border-input ring-offset-background focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2',
+			default: 'border border-input ring-offset-background focus-visible:ring-2 focus-visible:ring-ring',
 			ghost: 'border-none focus-visible:ring-transparent',
 		},
 		inputSize: {
 			default: 'h-10 rounded-md p-2 text-sm',
 			sm: 'h-8 rounded p-1 text-sm',
+			lg: 'h-12 rounded-lg p-3 text-lg',
 		},
 	},
 	defaultVariants: {
diff --git a/packages/playground/admin/lib/components/ui/label.tsx b/packages/playground/admin/lib/components/ui/label.tsx
index a0d2fa810c..ae459715ea 100644
--- a/packages/playground/admin/lib/components/ui/label.tsx
+++ b/packages/playground/admin/lib/components/ui/label.tsx
@@ -2,6 +2,6 @@ import * as LabelPrimitive from '@radix-ui/react-label'
 import { uic } from '../../../lib/utils/uic'
 
 export const Label = uic(LabelPrimitive.Root, {
-	baseClass: 'text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70',
+	baseClass: 'text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70 data-[invalid]:text-destructive',
 	displayName: 'Label',
 })
diff --git a/packages/playground/admin/lib/components/ui/loader.tsx b/packages/playground/admin/lib/components/ui/loader.tsx
index 6736956c66..29a7945f44 100644
--- a/packages/playground/admin/lib/components/ui/loader.tsx
+++ b/packages/playground/admin/lib/components/ui/loader.tsx
@@ -1,12 +1,10 @@
 import * as React from 'react'
-import { cn } from '../../../lib/utils/cn'
 import { uic } from '../../../lib/utils/uic'
 import { Loader2Icon } from 'lucide-react'
+import { Overlay, OverlayProps } from './overlay'
 
-export interface LoaderProps {
-	position?: 'fixed' | 'absolute' | 'static'
+export interface LoaderProps extends Omit<OverlayProps, 'children'> {
 	size?: 'sm' | 'md' | 'lg'
-	className?: string
 }
 
 export const LoaderIcon = uic(Loader2Icon, {
@@ -23,26 +21,10 @@ export const LoaderIcon = uic(Loader2Icon, {
 	},
 })
 
-export const Loader = ({ position = 'fixed', size, className }: LoaderProps) => {
-	const [show, setShow] = React.useState(false)
-	React.useEffect(() => {
-		requestAnimationFrame(() => {
-			setShow(true)
-		})
-	}, [])
-
+export const Loader = ({  size, ...props }: LoaderProps) => {
 	return (
-		<div className={cn(
-			'z-50 bg-white bg-opacity-50 backdrop-blur-sm transition-all duration-300 delay-200',
-			show ? 'opacity-100' : 'opacity-0',
-			position === 'fixed' && 'w-full h-full fixed top-0 left-0',
-			position === 'absolute' && 'w-full h-full absolute top-0 left-0',
-			position === 'static' && '',
-			className,
-		)}>
-			<div className="flex justify-center items-center h-full w-full">
-				<LoaderIcon size={size} />
-			</div>
-		</div>
+		<Overlay {...props}>
+			<LoaderIcon size={size} />
+		</Overlay>
 	)
 }
diff --git a/packages/playground/admin/lib/components/ui/overlay.tsx b/packages/playground/admin/lib/components/ui/overlay.tsx
new file mode 100644
index 0000000000..65511ce562
--- /dev/null
+++ b/packages/playground/admin/lib/components/ui/overlay.tsx
@@ -0,0 +1,33 @@
+import * as React from 'react'
+import { cn } from '../../../lib/utils/cn'
+
+export interface OverlayProps {
+	position?: 'fixed' | 'absolute' | 'static'
+	className?: string
+	children?: React.ReactNode
+	showImmediately?: boolean
+}
+
+export const Overlay = ({ position = 'fixed',  className, children, showImmediately }: OverlayProps) => {
+	const [show, setShow] = React.useState(showImmediately ?? false)
+	React.useEffect(() => {
+		requestAnimationFrame(() => {
+			setShow(true)
+		})
+	}, [])
+
+	return (
+		<div className={cn(
+			'z-50 bg-white bg-opacity-50 backdrop-blur-sm transition-all duration-300 delay-200',
+			show ? 'opacity-100' : 'opacity-0',
+			position === 'fixed' && 'w-full h-full fixed top-0 left-0',
+			position === 'absolute' && 'w-full h-full absolute top-0 left-0',
+			position === 'static' && '',
+			className,
+		)}>
+			<div className="flex justify-center items-center h-full w-full">
+				{children}
+			</div>
+		</div>
+	)
+}
diff --git a/packages/playground/admin/lib/dict.ts b/packages/playground/admin/lib/dict.ts
index a72d3b9ba4..82f7e21f35 100644
--- a/packages/playground/admin/lib/dict.ts
+++ b/packages/playground/admin/lib/dict.ts
@@ -1,6 +1,8 @@
 import { TextFilterArtifactsMatchMode } from '@contember/react-dataview'
 import { InviteErrorCodes } from './hooks/useInvite'
 import { UploaderErrorType } from '@contember/react-uploader'
+import { ChangeMyPasswordFormErrorCode, CreateApiKeyFormErrorCode } from '@contember/interface'
+import { InviteFormErrorCode, LoginFormErrorCode, OtpPrepareFormErrorCode, OtpConfirmFormErrorCode, PasswordResetFormErrorCode, PasswordResetRequestFormErrorCode, UpdateProjectMemberFormErrorCode } from '@contember/react-identity'
 
 export const dict = {
 	deleteEntityDialog: {
@@ -118,6 +120,193 @@ export const dict = {
 		warning: 'Any unsaved data will be lost. Please save your work before refreshing.',
 		snooze: 'Snooze',
 		refreshNow: 'Refresh now',
+	},
+	tenant: {
+		memberList: {
+			failedToLoadData: 'Failed to load data',
+			noResults: 'No results',
+			previous: 'Previous',
+			next: 'Next',
+			roles: 'Roles',
+			action: 'Action',
+		},
+		apiKeyList: {
+			deleted: 'API key deleted',
+			deleteFailed: 'Failed to delete API key',
+			unnamed: 'Unnamed API key',
+			noResults: 'No API keys',
+			description: 'Description',
+			role: 'Role',
+			action: 'Action',
+			deleteConfirmation: 'Are you sure you want to delete this API key?',
+			deleteCancelAction: 'Cancel',
+			deleteConfirmAction: 'Delete',
+		},
+		createApiKey: {
+			description: 'Description',
+			roles: 'Roles',
+			submit: 'Create API key',
+			errorMessages: {
+				'FIELD_REQUIRED': 'This field is required',
+				'UNKNOWN_ERROR': 'Something went wrong. Please try again later',
+				'INVALID_MEMBERSHIP': 'Invalid membership',
+				'PROJECT_NOT_FOUND': 'Project not found',
+				'ROLE_NOT_FOUND': 'Role not found',
+				'VARIABLE_EMPTY': 'Variable empty',
+				'VARIABLE_NOT_FOUND': 'Variable not found',
+			} satisfies Record<CreateApiKeyFormErrorCode, string>,
+		},
+		invite: {
+			email: 'Email',
+			name: 'Name',
+			roles: 'Roles',
+			submit: 'Invite',
+			errorMessages: {
+				'FIELD_REQUIRED': 'This field is required',
+				'UNKNOWN_ERROR': 'Something went wrong. Please try again later',
+				'ALREADY_MEMBER': 'This person is already a member',
+				'INVALID_EMAIL_FORMAT': 'Invalid email format',
+				'INVALID_MEMBERSHIP': 'Invalid membership',
+				'PROJECT_NOT_FOUND': 'Project not found',
+				'ROLE_NOT_FOUND': 'Role not found',
+				'VARIABLE_EMPTY': 'Variable empty',
+				'VARIABLE_NOT_FOUND': 'Variable not found',
+			} satisfies Record<InviteFormErrorCode, string>,
+		},
+		changePassword: {
+			currentPassword: 'Current password',
+			newPassword: 'New password',
+			confirmPassword: 'Confirm password',
+			submit: 'Change password',
+			errorMessages: {
+				'FIELD_REQUIRED': 'This field is required',
+				'INVALID_VALUE': 'Invalid value',
+				'UNKNOWN_ERROR': 'Something went wrong. Please try again later',
+				'PASSWORD_MISMATCH': 'Passwords do not match',
+				'TOO_WEAK': 'Password is too weak',
+				'NO_PASSWORD_SET': 'Your account has no password set',
+				'INVALID_PASSWORD': 'Invalid password',
+				'NOT_A_PERSON': 'Invalid user',
+			} satisfies Record<ChangeMyPasswordFormErrorCode, string>,
+		},
+		login: {
+			email: 'Email',
+			password: 'Password',
+			otpToken: 'OTP token',
+			forgotPassword: 'Forgot password?',
+			login: 'Login',
+			errorMessages: {
+				'FIELD_REQUIRED': 'This field is required',
+				'INVALID_VALUE': 'Invalid value',
+				'UNKNOWN_ERROR': 'Something went wrong. Please try again later',
+				'INVALID_PASSWORD': 'Invalid password',
+				'INVALID_OTP_TOKEN': 'Invalid OTP token',
+				'NO_PASSWORD_SET': 'No password set',
+				'PERSON_DISABLED': 'Person disabled',
+				'UNKNOWN_EMAIL': 'Unknown email',
+				'OTP_REQUIRED': undefined,
+			} satisfies Record<LoginFormErrorCode, string | undefined>,
+			idpInitError: 'Failed to initialize IdP login:',
+			idpResponseError: 'Failed to process IdP response:',
+			title: 'Login',
+			description: 'Enter your email below to login to your account',
+			backToLogin: 'Back to login',
+		},
+		personList: {
+			email: 'Email',
+			name: 'Name',
+			deleted: 'Member deleted',
+			deleteFailed: 'Failed to delete member',
+			noEmail: 'User has no email',
+			noName: 'User has no name',
+			role: 'Role',
+			action: 'Action',
+			noResults: 'No members',
+			deleteConfirmation: 'Are you sure you want to delete this member?',
+			deleteCancelAction: 'Cancel',
+			deleteConfirmAction: 'Delete',
+		},
+		memberDelete: {
+			cancel: 'Cancel',
+			confirm: 'Confirm',
+		},
+		otpSetup: {
+			prepareContinue: 'Continue',
+			otpConfirmFormErrorMessages: {
+				UNKNOWN_ERROR: 'Something went wrong. Please try again later',
+				INVALID_OTP_TOKEN: 'Invalid OTP token',
+				FIELD_REQUIRED: 'This field is required',
+				NOT_PREPARED: 'OTP setup was not initialized',
+			} satisfies Record<OtpConfirmFormErrorCode, string>,
+			otpPrepareFormErrorMessages: {
+				UNKNOWN_ERROR: 'Something went wrong. Please try again later',
+			} satisfies Record<OtpPrepareFormErrorCode, string>,
+			alreadyHaveOtp: 'You already have two-factor authentication active. By clicking "Continue", the old one will no longer work.',
+			nowScanQrCode: 'Now scan the following QR code in your application:',
+			writeDownCode: 'After registering to your application, write down a code from the application.',
+			twoFactorEnabled: 'Two factor authentication is ENABLED.',
+			disableTwoFactor: 'Disable two-factor authentication',
+			disableTwoFactorConfirm: 'Are you sure you want to disable two-factor authentication?',
+			cancel: 'Cancel',
+			disable: 'Disable',
+			disabledSuccess: 'Two-factor authentication was disabled.',
+			setupAgain: 'Setup again',
+			description: '2-Step Verification provides stronger security for your account by requiring a second step of verification when you sign in. In addition to your password, you’ll also need a code generated by an application on your phone.',
+			setupTwoFactor: 'Setup two-factor authentication',
+			enabledSuccess: 'Two-factor authentication was enabled.',
+			otpToken: 'OTP token',
+			label: 'Label',
+			confirm: 'Confirm',
+		},
 
+		passwordReset: {
+			token: 'Reset code',
+			password: 'Password',
+			passwordConfirmation: 'Confirm password',
+			submit: 'Reset password',
+			errorMessages: {
+				'FIELD_REQUIRED': 'This field is required',
+				'INVALID_VALUE': 'Invalid value',
+				'UNKNOWN_ERROR': 'Something went wrong. Please try again later',
+				'PASSWORD_MISMATCH': 'Passwords do not match',
+				'PASSWORD_TOO_WEAK': 'Password is too weak',
+				'TOKEN_EXPIRED': 'Token expired',
+				'TOKEN_NOT_FOUND': 'Token not found',
+				'TOKEN_USED': 'Token already used',
+			} satisfies Record<PasswordResetFormErrorCode, string>,
+			title: 'Reset password',
+			description: 'Enter new password below',
+			success: 'Password has been reset',
+		},
+		passwordResetRequest: {
+			email: 'Email',
+			submit: 'Request reset code',
+			errorMessages: {
+				'FIELD_REQUIRED': 'This field is required',
+				'INVALID_VALUE': 'Invalid value',
+				'UNKNOWN_ERROR': 'Something went wrong. Please try again later',
+				'PERSON_NOT_FOUND': 'Unknown email',
+			} satisfies Record<PasswordResetRequestFormErrorCode, string>,
+			title: 'Reset password',
+			description: 'Enter your email below to reset your password',
+			success: 'Password reset link has been sent',
+			checkMail: 'Please check your mailbox for instructions on how to reset your password.',
+			entryCode: 'Or enter the reset code directly.',
+		},
+		updateProjectMember: {
+			updateSuccess: 'Roles updated',
+			roles: 'Roles',
+			submit: 'Update role',
+			errorMessages: {
+				'FIELD_REQUIRED': 'This field is required',
+				'UNKNOWN_ERROR': 'Something went wrong. Please try again later',
+				'INVALID_MEMBERSHIP': 'Invalid membership',
+				'PROJECT_NOT_FOUND': 'Project not found',
+				'ROLE_NOT_FOUND': 'Role not found',
+				'VARIABLE_EMPTY': 'Variable empty',
+				'VARIABLE_NOT_FOUND': 'Variable not found',
+				'NOT_MEMBER': 'Not a member',
+			} satisfies Record<UpdateProjectMemberFormErrorCode, string>,
+		},
 	},
 }
diff --git a/packages/playground/admin/vite.config.ts b/packages/playground/admin/vite.config.ts
new file mode 100644
index 0000000000..c80a36f51c
--- /dev/null
+++ b/packages/playground/admin/vite.config.ts
@@ -0,0 +1,41 @@
+import react from '@vitejs/plugin-react'
+import { defineConfig } from 'vite'
+// eslint-disable-next-line @typescript-eslint/ban-ts-comment
+// @ts-ignore
+import { resolveConfig } from '../../../build/createViteConfig.js'
+import { resolve } from 'node:path'
+
+export default defineConfig(() => {
+	const dsn = process.argv.find(it => it.includes('://'))
+	const projectName = dsn ? new URL(dsn).username : null
+	return ({
+		define: projectName ? {
+			'import.meta.env.VITE_CONTEMBER_ADMIN_PROJECT_NAME': JSON.stringify(projectName),
+		} : {},
+		base: '/',
+		plugins: [
+			react(),
+			{
+				name: 'rewrite-middleware',
+				configureServer(serve) {
+					serve.middlewares.use((req, res, next) => {
+						if (req.url === '/app' || req.url?.startsWith('/app/') && !req.url?.match(/\.\w+($|\?)/)) {
+							req.url = '/app/'
+						}
+						next()
+					})
+				},
+			},
+		],
+		resolve: resolveConfig,
+		build: {
+			rollupOptions: {
+				input: {
+					root: resolve(__dirname, './index.html'),
+					app: resolve(__dirname, './app/index.html'),
+				},
+			},
+		},
+
+	})
+})
diff --git a/packages/playground/api/client/entities.ts b/packages/playground/api/client/entities.ts
index d91b6824f5..1abfa4126b 100644
--- a/packages/playground/api/client/entities.ts
+++ b/packages/playground/api/client/entities.ts
@@ -1,5 +1,6 @@
 import type { BlockType } from './enums'
 import type { BoardTaskStatus } from './enums'
+import type { EditorReferenceType } from './enums'
 import type { GridArticleState } from './enums'
 import type { InputUnique } from './enums'
 import type { SelectUnique } from './enums'
@@ -8,6 +9,7 @@ import type { UploadOne } from './enums'
 import type { BlockImagePosition } from './enums'
 import type { BlockListUnique } from './enums'
 import type { DimensionsItemUnique } from './enums'
+import type { EditorContentUnique } from './enums'
 import type { InputRootEnumValue } from './enums'
 
 export type JSONPrimitive = string | number | boolean | null
@@ -15,6 +17,22 @@ export type JSONValue = JSONPrimitive | JSONObject | JSONArray
 export type JSONObject = { readonly [K in string]?: JSONValue }
 export type JSONArray = readonly JSONValue[]
 
+export type AclBranch <OverRelation extends string | never = never> = {
+	name: 'AclBranch'
+	unique:
+		| Omit<{ id: string}, OverRelation>
+		| Omit<{ code: string}, OverRelation>
+	columns: {
+		id: string
+		code: string
+	}
+	hasOne: {
+	}
+	hasMany: {
+	}
+	hasManyBy: {
+	}
+}
 export type Block <OverRelation extends string | never = never> = {
 	name: 'Block'
 	unique:
@@ -183,6 +201,73 @@ export type DimensionsLocale <OverRelation extends string | never = never> = {
 	hasManyBy: {
 	}
 }
+export type EditorContent <OverRelation extends string | never = never> = {
+	name: 'EditorContent'
+	unique:
+		| Omit<{ id: string}, OverRelation>
+		| Omit<{ unique: EditorContentUnique}, OverRelation>
+		| Omit<{ references: EditorReference['unique']}, OverRelation>
+	columns: {
+		id: string
+		unique: EditorContentUnique
+		data: JSONValue
+	}
+	hasOne: {
+	}
+	hasMany: {
+		references: EditorReference<'content'>
+	}
+	hasManyBy: {
+	}
+}
+export type EditorImage <OverRelation extends string | never = never> = {
+	name: 'EditorImage'
+	unique:
+		| Omit<{ id: string}, OverRelation>
+	columns: {
+		id: string
+		url: string
+	}
+	hasOne: {
+	}
+	hasMany: {
+	}
+	hasManyBy: {
+	}
+}
+export type EditorLink <OverRelation extends string | never = never> = {
+	name: 'EditorLink'
+	unique:
+		| Omit<{ id: string}, OverRelation>
+	columns: {
+		id: string
+		url: string
+	}
+	hasOne: {
+	}
+	hasMany: {
+	}
+	hasManyBy: {
+	}
+}
+export type EditorReference <OverRelation extends string | never = never> = {
+	name: 'EditorReference'
+	unique:
+		| Omit<{ id: string}, OverRelation>
+	columns: {
+		id: string
+		type: EditorReferenceType
+	}
+	hasOne: {
+		content: EditorContent
+		image: EditorImage
+		link: EditorLink
+	}
+	hasMany: {
+	}
+	hasManyBy: {
+	}
+}
 export type GridArticle <OverRelation extends string | never = never> = {
 	name: 'GridArticle'
 	unique:
@@ -659,6 +744,7 @@ export type UploadVideo <OverRelation extends string | never = never> = {
 }
 
 export type ContemberClientEntities = {
+	AclBranch: AclBranch
 	Block: Block
 	BlockImage: BlockImage
 	BlockList: BlockList
@@ -668,6 +754,10 @@ export type ContemberClientEntities = {
 	DimensionsItem: DimensionsItem
 	DimensionsItemLocale: DimensionsItemLocale
 	DimensionsLocale: DimensionsLocale
+	EditorContent: EditorContent
+	EditorImage: EditorImage
+	EditorLink: EditorLink
+	EditorReference: EditorReference
 	GridArticle: GridArticle
 	GridArticleComment: GridArticleComment
 	GridAuthor: GridAuthor
diff --git a/packages/playground/api/client/enums.ts b/packages/playground/api/client/enums.ts
index f7eda6c141..5259b7859b 100644
--- a/packages/playground/api/client/enums.ts
+++ b/packages/playground/api/client/enums.ts
@@ -8,6 +8,9 @@ export type BoardTaskStatus =
 	 | "todo"
 	 | "inProgress"
 	 | "done"
+export type EditorReferenceType = 
+	 | "image"
+	 | "link"
 export type GridArticleState = 
 	 | "published"
 	 | "draft"
@@ -30,6 +33,8 @@ export type BlockListUnique =
 	 | "unique"
 export type DimensionsItemUnique = 
 	 | "unique"
+export type EditorContentUnique = 
+	 | "unique"
 export type InputRootEnumValue = 
 	 | "a"
 	 | "b"
diff --git a/packages/playground/api/client/names.ts b/packages/playground/api/client/names.ts
index 5f43649568..4973e56635 100644
--- a/packages/playground/api/client/names.ts
+++ b/packages/playground/api/client/names.ts
@@ -1,6 +1,21 @@
 import { SchemaNames } from '@contember/client-content'
 export const ContemberClientNames: SchemaNames = {
   "entities": {
+    "AclBranch": {
+      "name": "AclBranch",
+      "fields": {
+        "id": {
+          "type": "column"
+        },
+        "code": {
+          "type": "column"
+        }
+      },
+      "scalars": [
+        "id",
+        "code"
+      ]
+    },
     "Block": {
       "name": "Block",
       "fields": {
@@ -224,6 +239,86 @@ export const ContemberClientNames: SchemaNames = {
         "label"
       ]
     },
+    "EditorContent": {
+      "name": "EditorContent",
+      "fields": {
+        "id": {
+          "type": "column"
+        },
+        "unique": {
+          "type": "column"
+        },
+        "data": {
+          "type": "column"
+        },
+        "references": {
+          "type": "many",
+          "entity": "EditorReference"
+        }
+      },
+      "scalars": [
+        "id",
+        "unique",
+        "data"
+      ]
+    },
+    "EditorImage": {
+      "name": "EditorImage",
+      "fields": {
+        "id": {
+          "type": "column"
+        },
+        "url": {
+          "type": "column"
+        }
+      },
+      "scalars": [
+        "id",
+        "url"
+      ]
+    },
+    "EditorLink": {
+      "name": "EditorLink",
+      "fields": {
+        "id": {
+          "type": "column"
+        },
+        "url": {
+          "type": "column"
+        }
+      },
+      "scalars": [
+        "id",
+        "url"
+      ]
+    },
+    "EditorReference": {
+      "name": "EditorReference",
+      "fields": {
+        "id": {
+          "type": "column"
+        },
+        "content": {
+          "type": "one",
+          "entity": "EditorContent"
+        },
+        "type": {
+          "type": "column"
+        },
+        "image": {
+          "type": "one",
+          "entity": "EditorImage"
+        },
+        "link": {
+          "type": "one",
+          "entity": "EditorLink"
+        }
+      },
+      "scalars": [
+        "id",
+        "type"
+      ]
+    },
     "GridArticle": {
       "name": "GridArticle",
       "fields": {
diff --git a/packages/playground/api/migrations/2024-05-16-133645-roles.json b/packages/playground/api/migrations/2024-05-16-133645-roles.json
new file mode 100644
index 0000000000..9267020fc9
--- /dev/null
+++ b/packages/playground/api/migrations/2024-05-16-133645-roles.json
@@ -0,0 +1,126 @@
+{
+	"formatVersion": 5,
+	"modifications": [
+		{
+			"modification": "createEntity",
+			"entity": {
+				"name": "AclBranch",
+				"primary": "id",
+				"primaryColumn": "id",
+				"tableName": "acl_branch",
+				"fields": {
+					"id": {
+						"name": "id",
+						"columnName": "id",
+						"columnType": "uuid",
+						"nullable": false,
+						"type": "Uuid"
+					}
+				},
+				"unique": [],
+				"indexes": [],
+				"eventLog": {
+					"enabled": true
+				}
+			}
+		},
+		{
+			"modification": "createColumn",
+			"entityName": "AclBranch",
+			"field": {
+				"name": "code",
+				"columnName": "code",
+				"columnType": "text",
+				"nullable": false,
+				"type": "String"
+			}
+		},
+		{
+			"modification": "createUniqueConstraint",
+			"entityName": "AclBranch",
+			"unique": {
+				"fields": [
+					"code"
+				]
+			}
+		},
+		{
+			"modification": "patchAclSchema",
+			"patch": [
+				{
+					"op": "add",
+					"path": "/roles/condition",
+					"value": {
+						"stages": "*",
+						"entities": {},
+						"variables": {
+							"conditionVar": {
+								"type": "condition"
+							}
+						}
+					}
+				},
+				{
+					"op": "add",
+					"path": "/roles/entity",
+					"value": {
+						"stages": "*",
+						"entities": {},
+						"variables": {
+							"branchVar": {
+								"type": "entity",
+								"entityName": "AclBranch"
+							}
+						}
+					}
+				},
+				{
+					"op": "add",
+					"path": "/roles/noVar",
+					"value": {
+						"stages": "*",
+						"entities": {},
+						"variables": {}
+					}
+				},
+				{
+					"op": "add",
+					"path": "/roles/predefined",
+					"value": {
+						"stages": "*",
+						"entities": {},
+						"variables": {
+							"predefinedVar": {
+								"type": "predefined",
+								"value": "personID"
+							}
+						}
+					}
+				},
+				{
+					"op": "add",
+					"path": "/roles/admin/entities/AclBranch",
+					"value": {
+						"predicates": {},
+						"operations": {
+							"read": {
+								"id": true,
+								"code": true
+							},
+							"create": {
+								"id": true,
+								"code": true
+							},
+							"update": {
+								"id": true,
+								"code": true
+							},
+							"delete": true,
+							"customPrimary": true
+						}
+					}
+				}
+			]
+		}
+	]
+}
diff --git a/packages/playground/api/migrations/2024-05-16-133700-roles-data.ts b/packages/playground/api/migrations/2024-05-16-133700-roles-data.ts
new file mode 100644
index 0000000000..207b068341
--- /dev/null
+++ b/packages/playground/api/migrations/2024-05-16-133700-roles-data.ts
@@ -0,0 +1,17 @@
+import { printMutation } from './utils'
+import { queryBuilder } from '../client'
+
+export default printMutation([
+	queryBuilder.create('AclBranch', {
+		data: { code: 'cs' },
+	}),
+	queryBuilder.create('AclBranch', {
+		data: { code: 'sk' },
+	}),
+	queryBuilder.create('AclBranch', {
+		data: { code: 'de' },
+	}),
+	queryBuilder.create('AclBranch', {
+		data: { code: 'pl' },
+	}),
+])
diff --git a/packages/playground/api/model/Acl.ts b/packages/playground/api/model/Acl.ts
new file mode 100644
index 0000000000..b380f88ee9
--- /dev/null
+++ b/packages/playground/api/model/Acl.ts
@@ -0,0 +1,14 @@
+import { c } from '@contember/schema-definition'
+
+export const noVarRole = c.createRole('noVar')
+export const predefinedVariableRole = c.createRole('predefined')
+export const conditionVariableRole = c.createRole('condition')
+export const entityVariableRole = c.createRole('entity')
+
+export const personIdVar = c.createPredefinedVariable('predefinedVar', 'personID', predefinedVariableRole)
+export const branchVar = c.createEntityVariable('branchVar', 'AclBranch', entityVariableRole)
+export const conditionVar = c.createConditionVariable('conditionVar', conditionVariableRole)
+
+export class AclBranch {
+	code = c.stringColumn().notNull().unique()
+}
diff --git a/packages/playground/api/model/index.ts b/packages/playground/api/model/index.ts
index 7dbd1c1c81..cd0fc7df7a 100644
--- a/packages/playground/api/model/index.ts
+++ b/packages/playground/api/model/index.ts
@@ -1,3 +1,4 @@
+export * from './Acl'
 export * from './Blocks'
 export * from './Board'
 export * from './Dimensions'
diff --git a/packages/playground/package.json b/packages/playground/package.json
index 3b0594bbb4..e6a49c7ddc 100644
--- a/packages/playground/package.json
+++ b/packages/playground/package.json
@@ -4,10 +4,10 @@
 	"type": "module",
 	"private": true,
 	"scripts": {
-		"build": "vite build --config vite.config.ts --base /playground/",
+		"build": "vite build admin",
 		"contember": "docker-compose run contember-cli",
-		"deploy": "yarn -- contember deploy playground --admin http://admin-server:4000 --yes",
-		"start": "vite --config vite.config.ts --port ${VITE_PORT:-3000} --host 0.0.0.0",
+		"deploy": "yarn run build \"$0\" && docker-compose run --no-deps contember-cli deploy \"$@\" --root ",
+		"start": "vite dev admin --port ${VITE_PORT:-3000} --host 0.0.0.0",
 		"test": "vitest --root ./ --environment jsdom"
 	},
 	"devDependencies": {
diff --git a/packages/playground/vite.config.js b/packages/playground/vite.config.js
deleted file mode 100644
index a9bd4c5d4d..0000000000
--- a/packages/playground/vite.config.js
+++ /dev/null
@@ -1,5 +0,0 @@
-import { createViteConfig } from '../../build/createViteConfig.js'
-
-const currentDirName = new URL('.', import.meta.url).pathname.split('/').filter(Boolean).pop()
-
-export default createViteConfig(currentDirName)
diff --git a/packages/playground/vite.config.ts b/packages/playground/vite.config.ts
deleted file mode 100644
index 2b65b6ad20..0000000000
--- a/packages/playground/vite.config.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-import react from '@vitejs/plugin-react'
-import { defineConfig } from 'vite'
-import { resolveConfig } from '../../build'
-
-export default defineConfig({
-	root: 'admin',
-	plugins: [react()],
-	resolve: resolveConfig,
-})
diff --git a/packages/react-client-tenant/package.json b/packages/react-client-tenant/package.json
index 16ce48fc62..0dd886c381 100644
--- a/packages/react-client-tenant/package.json
+++ b/packages/react-client-tenant/package.json
@@ -40,7 +40,11 @@
 		"directory": "packages/react-client-tenant"
 	},
 	"dependencies": {
+		"@contember/graphql-client-tenant": "^1.3.7",
 		"@contember/react-client": "workspace:*",
+		"@contember/react-utils": "workspace:*",
+		"@radix-ui/primitive": "^1.0.1",
+		"@radix-ui/react-slot": "^1.0.2",
 		"graphql-ts-client-api": "^3.1.17"
 	},
 	"peerDependencies": {
diff --git a/packages/react-identity/src/components/IdentityProvider.tsx b/packages/react-client-tenant/src/components/IdentityProvider.tsx
similarity index 78%
rename from packages/react-identity/src/components/IdentityProvider.tsx
rename to packages/react-client-tenant/src/components/IdentityProvider.tsx
index 6a7e1f01f1..eff2eeb285 100644
--- a/packages/react-identity/src/components/IdentityProvider.tsx
+++ b/packages/react-client-tenant/src/components/IdentityProvider.tsx
@@ -1,9 +1,7 @@
 import { useSessionToken } from '@contember/react-client'
 import { ReactNode, useEffect } from 'react'
-import { EnvironmentExtensionProvider } from '@contember/react-binding'
 import { useFetchIdentity } from '../hooks'
-import { IdentityContext, IdentityMethodsContext, IdentityStateContext } from '../internal/contexts'
-import { identityEnvironmentExtension } from '../environment'
+import { IdentityContext, IdentityMethodsContext, IdentityStateContext } from '../contexts'
 
 
 export interface IdentityProviderProps {
@@ -33,9 +31,7 @@ export const IdentityProvider: React.FC<IdentityProviderProps> = ({ children })
 		<IdentityStateContext.Provider value={state}>
 			<IdentityContext.Provider value={identity}>
 				<IdentityMethodsContext.Provider value={methods}>
-					<EnvironmentExtensionProvider extension={identityEnvironmentExtension} state={identity ?? null}>
 						{children}
-					</EnvironmentExtensionProvider>
 				</IdentityMethodsContext.Provider>
 			</IdentityContext.Provider>
 		</IdentityStateContext.Provider>
diff --git a/packages/react-identity/src/components/IdentityState.tsx b/packages/react-client-tenant/src/components/IdentityState.tsx
similarity index 88%
rename from packages/react-identity/src/components/IdentityState.tsx
rename to packages/react-client-tenant/src/components/IdentityState.tsx
index ed9703f86a..9f683fbcfa 100644
--- a/packages/react-identity/src/components/IdentityState.tsx
+++ b/packages/react-client-tenant/src/components/IdentityState.tsx
@@ -1,6 +1,6 @@
 import React, { ReactNode } from 'react'
 import { IdentityStateValue } from '../types'
-import { useIdentityState } from '../internal/contexts'
+import { useIdentityState } from '../contexts'
 
 export interface IdentityStateProps {
 	state: IdentityStateValue | IdentityStateValue[]
diff --git a/packages/react-client-tenant/src/components/forms/ChangeMyPasswordForm.tsx b/packages/react-client-tenant/src/components/forms/ChangeMyPasswordForm.tsx
new file mode 100644
index 0000000000..bb7bf8bb41
--- /dev/null
+++ b/packages/react-client-tenant/src/components/forms/ChangeMyPasswordForm.tsx
@@ -0,0 +1,75 @@
+import { ReactElement } from 'react'
+import { ChangeMyPasswordErrorCode } from '@contember/graphql-client-tenant'
+import { TenantForm } from './TenantForm'
+import { FormContextValue, FormError, FormState } from '../../types'
+import { useForm } from '../../contexts'
+import { useChangeMyPasswordMutation } from '../../hooks'
+
+export type ChangeMyPasswordFormValues = {
+	currentPassword: string
+	newPassword: string
+	passwordConfirmation: string
+}
+
+export type ChangeMyPasswordFormErrorCode =
+	| ChangeMyPasswordErrorCode
+	| 'FIELD_REQUIRED'
+	| 'INVALID_VALUE'
+	| 'PASSWORD_MISMATCH'
+	| 'UNKNOWN_ERROR'
+
+export type ChangeMyPasswordFormState = FormState
+
+export type ChangeMyPasswordFormError = FormError<ChangeMyPasswordFormValues, ChangeMyPasswordFormErrorCode>
+
+export type ChangeMyPasswordFormContextValue = FormContextValue<ChangeMyPasswordFormValues, ChangeMyPasswordFormErrorCode>
+
+export interface ChangeMyPasswordFormProps {
+	children: ReactElement
+	onSuccess?: () => void
+}
+
+export const useChangeMyPasswordForm = useForm as () => ChangeMyPasswordFormContextValue
+
+export const ChangeMyPasswordForm = ({ children, onSuccess }: ChangeMyPasswordFormProps) => {
+	const changePassword = useChangeMyPasswordMutation()
+	return (
+		<TenantForm<ChangeMyPasswordFormContextValue>
+			onSuccess={onSuccess}
+			errorMapping={errorToField}
+			initialValues={{
+				currentPassword: '',
+				newPassword: '',
+				passwordConfirmation: '',
+			}}
+			validate={({ values }) => {
+				const errors: ChangeMyPasswordFormError[] = []
+				if (!values.currentPassword) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'currentPassword' })
+				}
+				if (!values.newPassword) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'newPassword' })
+				} else if (values.newPassword.length < 6) {
+					errors.push({ code: 'INVALID_VALUE', field: 'newPassword' })
+				} else if (!values.passwordConfirmation) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'passwordConfirmation' })
+				} else if (values.newPassword !== values.passwordConfirmation) {
+					errors.push({ code: 'PASSWORD_MISMATCH', field: 'passwordConfirmation' })
+				}
+				return errors
+			}}
+			execute={async ({ values }) => {
+				return await changePassword(values)
+			}}
+		>
+			{children}
+		</TenantForm>
+	)
+
+}
+const errorToField: Partial<Record<ChangeMyPasswordFormErrorCode, keyof ChangeMyPasswordFormValues | undefined>> = {
+	PASSWORD_MISMATCH: 'passwordConfirmation',
+	TOO_WEAK: 'newPassword',
+	NO_PASSWORD_SET: 'currentPassword',
+	INVALID_PASSWORD: 'currentPassword',
+}
diff --git a/packages/react-client-tenant/src/components/forms/CreateApiKeyForm.tsx b/packages/react-client-tenant/src/components/forms/CreateApiKeyForm.tsx
new file mode 100644
index 0000000000..6b97b7eedf
--- /dev/null
+++ b/packages/react-client-tenant/src/components/forms/CreateApiKeyForm.tsx
@@ -0,0 +1,72 @@
+import { ReactElement } from 'react'
+import { TenantForm } from './TenantForm'
+import { FormContextValue, FormError, FormState } from '../../types'
+import { useForm } from '../../contexts'
+import { CreateApiKeyErrorCode, MembershipInput } from '@contember/graphql-client-tenant'
+import { CreateApiKeyMutationResult, useCreateApiKeyMutation } from '../../hooks'
+
+export type CreateApiKeyFormValues = {
+	description: string
+	memberships: readonly MembershipInput[]
+}
+
+export type CreateApiKeyFormErrorCode =
+	| CreateApiKeyErrorCode
+	| 'UNKNOWN_ERROR'
+	| 'FIELD_REQUIRED'
+
+export type CreateApiKeyFormState = FormState
+
+export type CreateApiKeyFormError = FormError<CreateApiKeyFormValues, CreateApiKeyFormErrorCode>
+
+export type CreateApiKeyFormContextValue = FormContextValue<CreateApiKeyFormValues, CreateApiKeyFormErrorCode>
+
+export interface CreateApiKeyFormProps {
+	children: ReactElement
+	projectSlug: string
+	initialMemberships?: readonly MembershipInput[]
+	onSuccess?: (args: { result: CreateApiKeyMutationResult }) => void
+}
+
+export const useCreateApiKeyForm = useForm as () => CreateApiKeyFormContextValue
+
+export const CreateApiKeyForm = ({ children, onSuccess, projectSlug, initialMemberships }: CreateApiKeyFormProps) => {
+	const createApiKey = useCreateApiKeyMutation()
+	return (
+		<TenantForm<CreateApiKeyFormContextValue, CreateApiKeyMutationResult>
+			onSuccess={onSuccess}
+			initialValues={{
+				description: '',
+				memberships: initialMemberships || [],
+			}}
+			validate={({ values }) => {
+				const errors: CreateApiKeyFormError[] = []
+				if (!values.description) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'description' })
+				}
+				if (values.memberships.length === 0) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'memberships' })
+				}
+				return errors
+			}}
+			execute={async ({ values }) => {
+				return await createApiKey({
+					description: values.description,
+					projectSlug,
+					memberships: values.memberships,
+				})
+			}}
+			errorMapping={errorToField}
+		>
+			{children}
+		</TenantForm>
+	)
+}
+
+const errorToField: Record<CreateApiKeyErrorCode, keyof CreateApiKeyFormValues | undefined> = {
+	INVALID_MEMBERSHIP: 'memberships',
+	PROJECT_NOT_FOUND: undefined,
+	ROLE_NOT_FOUND: 'memberships',
+	VARIABLE_EMPTY: 'memberships',
+	VARIABLE_NOT_FOUND: 'memberships',
+}
diff --git a/packages/react-client-tenant/src/components/forms/CreateSessionTokenForm.tsx b/packages/react-client-tenant/src/components/forms/CreateSessionTokenForm.tsx
new file mode 100644
index 0000000000..b88cc38e2f
--- /dev/null
+++ b/packages/react-client-tenant/src/components/forms/CreateSessionTokenForm.tsx
@@ -0,0 +1,64 @@
+import { ReactElement } from 'react'
+import { TenantForm } from './TenantForm'
+import { FormContextValue, FormError, FormState } from '../../types'
+import { useForm } from '../../contexts'
+import { CreateSessionTokenErrorCode } from '@contember/graphql-client-tenant'
+import { CreateSessionTokenMutationResult, useCreateSessionTokenMutation } from '../../hooks'
+
+export type CreateSessionTokenFormValues = {
+	email: string
+}
+
+export type CreateSessionTokenFormErrorCode =
+	| CreateSessionTokenErrorCode
+	| 'UNKNOWN_ERROR'
+	| 'FIELD_REQUIRED'
+
+export type CreateSessionTokenFormState = FormState
+
+export type CreateSessionTokenFormError = FormError<CreateSessionTokenFormValues, CreateSessionTokenFormErrorCode>
+
+export type CreateSessionTokenFormContextValue = FormContextValue<CreateSessionTokenFormValues, CreateSessionTokenFormErrorCode>
+
+export interface CreateSessionTokenFormProps {
+	children: ReactElement
+	expiration?: number
+	apiToken?: string
+	onSuccess?: (args: { result: CreateSessionTokenMutationResult }) => void
+}
+
+export const useCreateSessionTokenForm = useForm as () => CreateSessionTokenFormContextValue
+
+export const CreateSessionTokenForm = ({ children, onSuccess, expiration, apiToken }: CreateSessionTokenFormProps) => {
+	const createSessionToken = useCreateSessionTokenMutation({ apiToken })
+	return (
+		<TenantForm<CreateSessionTokenFormContextValue, CreateSessionTokenMutationResult>
+			onSuccess={onSuccess}
+			initialValues={{
+				email: '',
+			}}
+			validate={({ values }) => {
+				const errors: CreateSessionTokenFormError[] = []
+				if (!values.email) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'email' })
+				}
+				return errors
+			}}
+			execute={async ({ values }) => {
+				return await createSessionToken({
+					email: values.email,
+					expiration,
+				})
+			}}
+			errorMapping={errorToField}
+		>
+			{children}
+		</TenantForm>
+	)
+}
+
+const errorToField: Record<CreateSessionTokenErrorCode, keyof CreateSessionTokenFormValues | undefined> = {
+	PERSON_DISABLED: 'email',
+	UNKNOWN_EMAIL: 'email',
+	UNKNOWN_PERSON_ID: 'email',
+}
diff --git a/packages/react-client-tenant/src/components/forms/InviteForm.tsx b/packages/react-client-tenant/src/components/forms/InviteForm.tsx
new file mode 100644
index 0000000000..2dd364413c
--- /dev/null
+++ b/packages/react-client-tenant/src/components/forms/InviteForm.tsx
@@ -0,0 +1,79 @@
+import { ReactElement } from 'react'
+import { TenantForm } from './TenantForm'
+import { FormContextValue, FormError, FormState } from '../../types'
+import { useForm } from '../../contexts'
+import { InviteErrorCode, InviteOptions, MembershipInput } from '@contember/graphql-client-tenant'
+import { InviteMutationResult, useInviteMutation } from '../../hooks'
+
+export type InviteFormValues = {
+	email: string
+	name: string
+	memberships: readonly MembershipInput[]
+}
+
+export type InviteFormErrorCode =
+	| InviteErrorCode
+	| 'UNKNOWN_ERROR'
+	| 'FIELD_REQUIRED'
+
+export type InviteFormState = FormState
+
+export type InviteFormError = FormError<InviteFormValues, InviteFormErrorCode>
+
+export type InviteFormContextValue = FormContextValue<InviteFormValues, InviteFormErrorCode>
+
+export interface InviteFormProps {
+	children: ReactElement
+	projectSlug: string
+	inviteOptions?: InviteOptions
+	initialMemberships?: readonly MembershipInput[]
+	onSuccess?: (args: { result: InviteMutationResult }) => void
+}
+
+export const useInviteForm = useForm as () => InviteFormContextValue
+
+export const InviteForm = ({ children, onSuccess, projectSlug, initialMemberships, inviteOptions }: InviteFormProps) => {
+	const invite = useInviteMutation()
+	return (
+		<TenantForm<InviteFormContextValue, InviteMutationResult>
+			onSuccess={onSuccess}
+			initialValues={{
+				email: '',
+				name: '',
+				memberships: initialMemberships || [],
+			}}
+			validate={({ values }) => {
+				const errors: InviteFormError[] = []
+				if (!values.email) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'email' })
+				}
+				if (values.memberships.length === 0) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'memberships' })
+				}
+				return errors
+			}}
+			execute={async ({ values }) => {
+				return await invite({
+					email: values.email,
+					name: values.name,
+					projectSlug,
+					options: inviteOptions,
+					memberships: values.memberships,
+				})
+			}}
+			errorMapping={errorToField}
+		>
+			{children}
+		</TenantForm>
+	)
+}
+
+const errorToField: Record<InviteErrorCode, keyof InviteFormValues | undefined> = {
+	ALREADY_MEMBER: 'email',
+	INVALID_EMAIL_FORMAT: 'email',
+	INVALID_MEMBERSHIP: 'memberships',
+	PROJECT_NOT_FOUND: undefined,
+	ROLE_NOT_FOUND: 'memberships',
+	VARIABLE_EMPTY: 'memberships',
+	VARIABLE_NOT_FOUND: 'memberships',
+}
diff --git a/packages/react-client-tenant/src/components/forms/LoginForm.tsx b/packages/react-client-tenant/src/components/forms/LoginForm.tsx
new file mode 100644
index 0000000000..018b0f5d8c
--- /dev/null
+++ b/packages/react-client-tenant/src/components/forms/LoginForm.tsx
@@ -0,0 +1,110 @@
+import { ReactElement, useCallback, useMemo } from 'react'
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { TenantForm } from './TenantForm'
+import { SignInErrorCode } from '@contember/graphql-client-tenant'
+import { FormContextValue, FormError, FormState } from '../../types'
+import { useForm } from '../../contexts'
+import { useSetSessionToken } from '@contember/react-client'
+import { SignInMutationResult, useSignInMutation } from '../../hooks'
+import { useRedirectToBacklinkCallback } from '../../internal/hooks/useRedirectToBacklink'
+
+
+export type LoginFormValues = {
+	email: string
+	password: string
+	otpToken: string
+}
+
+export type LoginFormErrorCode =
+	| SignInErrorCode
+	| 'FIELD_REQUIRED'
+	| 'INVALID_VALUE'
+	| 'UNKNOWN_ERROR'
+
+export type LoginFormState =
+	| FormState
+	| 'otp-required'
+
+export type LoginFormError = FormError<LoginFormValues, LoginFormErrorCode>
+
+export type LoginFormContextValue = FormContextValue<LoginFormValues, LoginFormErrorCode, LoginFormState>
+
+export interface LoginFormProps {
+	expiration?: number
+	children: ReactElement
+	onSuccess?: () => void
+}
+
+export const useLoginForm = useForm as () => LoginFormContextValue
+
+const headers = {
+	'X-Contember-Token-Path': 'data.signIn.result.token',
+}
+
+const DEFAULT_LOGIN_EXPIRATION = 14 * 24 * 3600 // 14 days
+
+export const LoginForm = ({ children, expiration = DEFAULT_LOGIN_EXPIRATION, onSuccess }: LoginFormProps) => {
+	const login = useSignInMutation({ headers })
+	const redirectToBacklink = useRedirectToBacklinkCallback()
+	const setSessionToken = useSetSessionToken()
+	return (
+		<TenantForm<LoginFormContextValue, SignInMutationResult>
+			onSuccess={args => {
+				onSuccess?.()
+				setSessionToken(args.result.token)
+				redirectToBacklink()
+			}}
+			errorMapping={errorToField}
+			initialValues={{
+				email: '',
+				password: '',
+				otpToken: '',
+			}}
+			validate={({ values, state }) => {
+				const errors: LoginFormError[] = []
+				if (!values.email) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'email' })
+				} else if (!values.email.match(/^.+@.+$/)) {
+					errors.push({ code: 'INVALID_VALUE', field: 'email' })
+				}
+
+				if (!values.password) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'password' })
+				} else if (values.password.length < 6) {
+					errors.push({ code: 'INVALID_VALUE', field: 'password' })
+				}
+				if (!values.otpToken && state === 'otp-required') {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'otpToken' })
+				} else if (values.otpToken && !values.otpToken.match(/^\d{6}$/)) {
+					errors.push({ code: 'INVALID_VALUE', field: 'otpToken' })
+				}
+				return errors
+			}}
+			execute={async ({ values }) => {
+				const result = await login({
+					email: values.email!,
+					password: values.password!,
+					otpToken: values.otpToken || undefined,
+					expiration: expiration,
+				})
+
+				if (!result.ok && result.error === 'OTP_REQUIRED') {
+					return { ...result, state: 'otp-required' }
+				}
+
+				return result
+			}}
+		>
+			{children}
+		</TenantForm>
+	)
+
+}
+const errorToField: Record<TenantApi.SignInErrorCode, keyof LoginFormValues | undefined> = {
+	'INVALID_PASSWORD': 'password',
+	'NO_PASSWORD_SET': 'password',
+	'UNKNOWN_EMAIL': 'email',
+	'PERSON_DISABLED': 'email',
+	'INVALID_OTP_TOKEN': 'otpToken',
+	'OTP_REQUIRED': undefined,
+}
diff --git a/packages/react-client-tenant/src/components/forms/OtpConfirmForm.tsx b/packages/react-client-tenant/src/components/forms/OtpConfirmForm.tsx
new file mode 100644
index 0000000000..cbf04a12cd
--- /dev/null
+++ b/packages/react-client-tenant/src/components/forms/OtpConfirmForm.tsx
@@ -0,0 +1,61 @@
+import { ReactElement } from 'react'
+import { TenantForm } from './TenantForm'
+import { FormContextValue, FormError, FormState } from '../../types'
+import { useForm, useIdentityMethods } from '../../contexts'
+import { ConfirmOtpErrorCode } from '@contember/graphql-client-tenant'
+import { useConfirmOtpMutation } from '../../hooks'
+
+export type OtpConfirmFormValues = {
+	otpToken: string
+}
+
+export type OtpConfirmFormErrorCode =
+	| ConfirmOtpErrorCode
+	| 'FIELD_REQUIRED'
+	| 'UNKNOWN_ERROR'
+
+export type OtpConfirmFormState = FormState
+
+export type OtpConfirmFormError = FormError<OtpConfirmFormValues, OtpConfirmFormErrorCode>
+
+export type OtpConfirmFormContextValue = FormContextValue<OtpConfirmFormValues, OtpConfirmFormErrorCode>
+
+export interface OtpConfirmFormProps {
+	children: ReactElement
+	onSuccess?: () => void
+}
+
+export const useOtpConfirmForm = useForm as () => OtpConfirmFormContextValue
+
+export const OtpConfirmForm = ({ children, onSuccess }: OtpConfirmFormProps) => {
+	const confirmOtp = useConfirmOtpMutation()
+	const { refreshIdentity } = useIdentityMethods()
+	return (
+		<TenantForm<OtpConfirmFormContextValue>
+			onSuccess={async args => {
+				await refreshIdentity()
+				onSuccess?.()
+			}}
+			initialValues={{
+				otpToken: '',
+			}}
+			validate={({ values }) => {
+				if (!values.otpToken) {
+					return [{ code: 'FIELD_REQUIRED', field: 'otpToken' }]
+				}
+			}}
+			execute={async ({ values }) => {
+				return await confirmOtp({
+					 otpToken: values.otpToken,
+				})
+			}}
+			errorMapping={{
+				INVALID_OTP_TOKEN: 'otpToken',
+				NOT_PREPARED: 'otpToken',
+			}}
+		>
+			{children}
+		</TenantForm>
+	)
+}
+
diff --git a/packages/react-client-tenant/src/components/forms/OtpPrepareForm.tsx b/packages/react-client-tenant/src/components/forms/OtpPrepareForm.tsx
new file mode 100644
index 0000000000..c499adf1aa
--- /dev/null
+++ b/packages/react-client-tenant/src/components/forms/OtpPrepareForm.tsx
@@ -0,0 +1,45 @@
+import { ReactElement, useCallback, useMemo } from 'react'
+import { TenantForm } from './TenantForm'
+import { FormContextValue, FormError, FormState } from '../../types'
+import { useForm } from '../../contexts'
+import { PrepareOtpMutationResult, usePrepareOtpMutation } from '../../hooks'
+
+export type OtpPrepareFormValues = {
+	label: string
+}
+
+export type OtpPrepareFormErrorCode =
+	| 'UNKNOWN_ERROR'
+
+export type OtpPrepareFormState = FormState
+
+export type OtpPrepareFormError = FormError<OtpPrepareFormValues, OtpPrepareFormErrorCode>
+
+export type OtpPrepareFormContextValue = FormContextValue<OtpPrepareFormValues, OtpPrepareFormErrorCode>
+
+export interface OtpPrepareFormProps {
+	children: ReactElement
+	onSuccess?: (args: { result: PrepareOtpMutationResult }) => void
+}
+
+export const useOtpPrepareForm = useForm as () => OtpPrepareFormContextValue
+
+export const OtpPrepareForm = ({ children, onSuccess }: OtpPrepareFormProps) => {
+	const prepareOtp = usePrepareOtpMutation()
+	return (
+		<TenantForm<OtpPrepareFormContextValue, PrepareOtpMutationResult>
+			onSuccess={onSuccess}
+			initialValues={{
+				label: window.location.hostname,
+			}}
+			execute={async ({ values }) => {
+				return await prepareOtp({
+					label: values.label,
+				})
+			}}
+		>
+			{children}
+		</TenantForm>
+	)
+}
+
diff --git a/packages/react-client-tenant/src/components/forms/PasswordResetForm.tsx b/packages/react-client-tenant/src/components/forms/PasswordResetForm.tsx
new file mode 100644
index 0000000000..c16a34ef0d
--- /dev/null
+++ b/packages/react-client-tenant/src/components/forms/PasswordResetForm.tsx
@@ -0,0 +1,80 @@
+import { ReactElement } from 'react'
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { ResetPasswordErrorCode } from '@contember/graphql-client-tenant'
+import { TenantForm } from './TenantForm'
+import { FormContextValue, FormError, FormState } from '../../types'
+import { useForm } from '../../contexts'
+import { useResetPasswordMutation } from '../../hooks'
+
+export type PasswordResetFormValues = {
+	token: string
+	password: string
+	passwordConfirmation: string
+}
+
+export type PasswordResetFormErrorCode =
+	| ResetPasswordErrorCode
+	| 'FIELD_REQUIRED'
+	| 'INVALID_VALUE'
+	| 'PASSWORD_MISMATCH'
+	| 'UNKNOWN_ERROR'
+
+export type PasswordResetFormState = FormState
+
+export type PasswordResetFormError = FormError<PasswordResetFormValues, PasswordResetFormErrorCode>
+
+export type PasswordResetFormContextValue = FormContextValue<PasswordResetFormValues, PasswordResetFormErrorCode>
+
+export interface PasswordResetFormProps {
+	children: ReactElement
+	onSuccess?: () => void
+	token?: string
+}
+
+export const usePasswordResetForm = useForm as () => PasswordResetFormContextValue
+
+export const PasswordResetForm = ({ children, onSuccess, token }: PasswordResetFormProps) => {
+	const createReset = useResetPasswordMutation()
+	return (
+		<TenantForm<PasswordResetFormContextValue>
+			onSuccess={onSuccess}
+			errorMapping={errorToField}
+			initialValues={{
+				token: token ?? '',
+				password: '',
+				passwordConfirmation: '',
+			}}
+			validate={({ values }) => {
+				const errors: PasswordResetFormError[] = []
+				if (!values.token) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'token' })
+				}
+				if (!values.password) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'password' })
+				} else if (values.password.length < 6) {
+					errors.push({ code: 'INVALID_VALUE', field: 'password' })
+				} else if (!values.passwordConfirmation) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'passwordConfirmation' })
+				} else if (values.password !== values.passwordConfirmation) {
+					errors.push({ code: 'PASSWORD_MISMATCH', field: 'passwordConfirmation' })
+				}
+				return errors
+			}}
+			execute={async ({ values }) => {
+				return await createReset({
+					password: values.password,
+					token: values.token,
+				})
+			}}
+		>
+			{children}
+		</TenantForm>
+	)
+
+}
+const errorToField: Record<TenantApi.ResetPasswordErrorCode, keyof PasswordResetFormValues | undefined> = {
+	PASSWORD_TOO_WEAK: 'password',
+	TOKEN_EXPIRED: 'token',
+	TOKEN_NOT_FOUND: 'token',
+	TOKEN_USED: 'token',
+}
diff --git a/packages/react-client-tenant/src/components/forms/PasswordResetRequestForm.tsx b/packages/react-client-tenant/src/components/forms/PasswordResetRequestForm.tsx
new file mode 100644
index 0000000000..542c6d6250
--- /dev/null
+++ b/packages/react-client-tenant/src/components/forms/PasswordResetRequestForm.tsx
@@ -0,0 +1,64 @@
+import { ReactElement, useCallback, useMemo } from 'react'
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { CreatePasswordResetRequestErrorCode } from '@contember/graphql-client-tenant'
+import { TenantForm } from './TenantForm'
+import { FormContextValue, FormError, FormState } from '../../types/forms'
+import { useForm } from '../../contexts'
+import { useCreateResetPasswordRequestMutation } from '../../hooks'
+
+export type PasswordResetRequestFormValues = {
+	email: string
+}
+
+export type PasswordResetRequestFormErrorCode =
+	| CreatePasswordResetRequestErrorCode
+	| 'FIELD_REQUIRED'
+	| 'INVALID_VALUE'
+	| 'UNKNOWN_ERROR'
+
+export type PasswordResetRequestFormState = FormState
+
+export type PasswordResetRequestFormError = FormError<PasswordResetRequestFormValues, PasswordResetRequestFormErrorCode>
+
+export type PasswordResetRequestFormContextValue = FormContextValue<PasswordResetRequestFormValues, PasswordResetRequestFormErrorCode>
+
+
+export interface PasswordResetRequestFormProps {
+	children: ReactElement
+	onSuccess?: () => void
+}
+
+export const usePasswordResetRequestForm = useForm as () => PasswordResetRequestFormContextValue
+
+export const PasswordResetRequestForm = ({ children, onSuccess }: PasswordResetRequestFormProps) => {
+
+	const createResetRequest = useCreateResetPasswordRequestMutation()
+	return (
+		<TenantForm<PasswordResetRequestFormContextValue>
+			onSuccess={onSuccess}
+			errorMapping={errorToField}
+			initialValues={useMemo(() => ({
+				email: '',
+			}), [])}
+			validate={({ values }) => {
+				if (!values.email) {
+					return [{ code: 'FIELD_REQUIRED', field: 'email' }]
+				} else if (!values.email.match(/^.+@.+$/)) {
+					return [{ code: 'INVALID_VALUE', field: 'email' }]
+				}
+				return []
+			}}
+			execute={useCallback(async ({ values }) => {
+				return await createResetRequest({
+					email: values.email,
+				})
+			}, [createResetRequest])}
+		>
+			{children}
+		</TenantForm>
+	)
+
+}
+const errorToField: Record<TenantApi.CreatePasswordResetRequestErrorCode, keyof PasswordResetRequestFormValues | undefined> = {
+	PERSON_NOT_FOUND: 'email',
+}
diff --git a/packages/react-client-tenant/src/components/forms/TenantForm.tsx b/packages/react-client-tenant/src/components/forms/TenantForm.tsx
new file mode 100644
index 0000000000..fd98ead04b
--- /dev/null
+++ b/packages/react-client-tenant/src/components/forms/TenantForm.tsx
@@ -0,0 +1,116 @@
+import { ComponentType, ReactElement, useCallback, useEffect, useState } from 'react'
+import { Slot } from '@radix-ui/react-slot'
+import { FormContextValue } from '../../types/forms'
+import { FormContext } from '../../contexts'
+import { useReferentiallyStableCallback } from '@contember/react-utils'
+
+const SlotForm = Slot as ComponentType<React.FormHTMLAttributes<HTMLFormElement>>
+
+
+type ExecuteResult<T extends FormContextValue<any, any, any>, OkResult = undefined> =
+	| ({ ok: true } & (OkResult extends undefined ? {} : { result: OkResult }))
+	| { ok: false, error?: T['errors'][number]['code'], developerMessage?: string, state?: T['state'] }
+
+export interface TenantFormProps<T extends FormContextValue<any, any, any>, OkResult = undefined> {
+	children: ReactElement
+	loading?: boolean
+	initialValues: T['values']
+	errorMapping?: Partial<Record<T['errors'][number]['code'], keyof T['values']>>
+	validate?: (args: { values: T['values'], state: T['state'] }) => T['errors'] | undefined
+	execute: (args: { values: T['values'], state: T['state'] }) => Promise<ExecuteResult<T, OkResult>>
+	onSuccess?: (args: { result: OkResult }) => void
+	onChange?: (args: { values: T['values'], state: T['state'], submit: () => Promise<void> }) => void
+}
+
+export const TenantForm = <T extends FormContextValue<any, any, any>, OkResult = undefined>({
+	children,
+	initialValues,
+	loading,
+	errorMapping,
+	validate: validateIn,
+	execute: executeIn,
+	onSuccess: onSuccessIn,
+	onChange: onChangeIn,
+}: TenantFormProps<T, OkResult>) => {
+	const [values, setValues] = useState<T['values']>(initialValues)
+
+	const [errors, setErrors] = useState<T['errors']>([])
+	const [state, setState] = useState<T['state']>(loading ? 'loading' : 'initial')
+
+	useEffect(() => {
+		if (loading) {
+			setState('loading')
+		}
+	}, [loading])
+
+	useEffect(() => {
+		if (state === 'loading' && !loading) {
+			setValues(initialValues)
+			setState('initial')
+		}
+	}, [initialValues, loading, state])
+
+	const validate = useReferentiallyStableCallback(validateIn || (() => undefined))
+	const onSuccess = useReferentiallyStableCallback(onSuccessIn || (() => undefined))
+	const execute = useReferentiallyStableCallback(executeIn)
+
+	const submit = useReferentiallyStableCallback(async (event?: React.FormEvent) => {
+		event?.preventDefault()
+		const errors = validate?.({ values, state }) ?? []
+		setErrors(errors)
+
+		if (errors.length > 0) {
+			setState('error')
+			return
+		}
+
+		setState('submitting')
+
+		try {
+			const response = await execute({ values, state })
+
+			if (!response.ok) {
+				const error = response.error
+				setState(response.state ?? 'error')
+				setErrors([{
+					code: error || 'UNKNOWN_ERROR',
+					developerMessage: response.developerMessage,
+					field: errorMapping && error && error in errorMapping ? errorMapping[error] : undefined,
+				}])
+			} else {
+				setState('success')
+				setValues(initialValues)
+				onSuccess?.({ result: 'result' in response ? response.result : undefined as OkResult })
+			}
+		} catch (e) {
+			console.error(e)
+			setState('error')
+			setErrors([{
+				code: 'UNKNOWN_ERROR',
+				developerMessage: typeof e === 'string' ? e : (e && typeof e === 'object' && 'message' in e && typeof e.message === 'string') ? e.message : undefined,
+			}])
+		}
+	})
+
+
+	const onChange = useReferentiallyStableCallback(onChangeIn || (() => undefined))
+	useEffect(() => {
+		onChange?.({ values, state, submit })
+	}, [onChange, state, submit, values])
+
+	const setValue = useCallback((field: string, value: string) => setValues(values => ({ ...values, [field]: value })), [])
+
+	return (
+		<FormContext.Provider value={{
+			values,
+			setValues,
+			state,
+			errors,
+			setValue: setValue,
+		} as unknown as T}>
+			<SlotForm onSubmit={submit}>
+				{children}
+			</SlotForm>
+		</FormContext.Provider>
+	)
+}
diff --git a/packages/react-client-tenant/src/components/forms/UpdateProjectMemberForm.tsx b/packages/react-client-tenant/src/components/forms/UpdateProjectMemberForm.tsx
new file mode 100644
index 0000000000..5899e90fe4
--- /dev/null
+++ b/packages/react-client-tenant/src/components/forms/UpdateProjectMemberForm.tsx
@@ -0,0 +1,77 @@
+import { ReactElement, useEffect, useState } from 'react'
+import { TenantForm } from './TenantForm'
+import { FormContextValue, FormError, FormState } from '../../types'
+import { useForm } from '../../contexts'
+import { UpdateProjectMemberErrorCode, MembershipInput } from '@contember/graphql-client-tenant'
+import { useProjectMembershipsQuery, useTenantQueryLoader, useUpdateProjectMemberMutation } from '../../hooks'
+
+export type UpdateProjectMemberFormValues = {
+	memberships: readonly MembershipInput[]
+}
+
+export type UpdateProjectMemberFormErrorCode =
+	| UpdateProjectMemberErrorCode
+	| 'UNKNOWN_ERROR'
+	| 'FIELD_REQUIRED'
+
+export type UpdateProjectMemberFormState = FormState
+
+export type UpdateProjectMemberFormError = FormError<UpdateProjectMemberFormValues, UpdateProjectMemberFormErrorCode>
+
+export type UpdateProjectMemberFormContextValue = FormContextValue<UpdateProjectMemberFormValues, UpdateProjectMemberFormErrorCode>
+
+export interface UpdateProjectMemberFormProps {
+	children: ReactElement
+	identityId: string
+	projectSlug: string
+	onSuccess?: (args: { }) => void
+}
+
+export const useUpdateProjectMemberForm = useForm as () => UpdateProjectMemberFormContextValue
+
+export const UpdateProjectMemberForm = ({ children, onSuccess, identityId, projectSlug }: UpdateProjectMemberFormProps) => {
+	const updateProjectMember = useUpdateProjectMemberMutation()
+	const [state] = useTenantQueryLoader(useProjectMembershipsQuery(), { projectSlug, identityId })
+	const [memberships, setMemberships] = useState<readonly MembershipInput[]>()
+
+	useEffect(() => {
+		setMemberships(state.state === 'success' ? state.data : undefined)
+	}, [state])
+
+	return (
+		<TenantForm<UpdateProjectMemberFormContextValue>
+			onSuccess={onSuccess}
+			loading={memberships === undefined}
+			initialValues={memberships ? { memberships } : { memberships: [] }}
+			onChange={({ values, submit }) => {
+				setMemberships(values?.memberships)
+			}}
+			validate={({ values }) => {
+				const errors: UpdateProjectMemberFormError[] = []
+				if (values.memberships.length === 0) {
+					errors.push({ code: 'FIELD_REQUIRED', field: 'memberships' })
+				}
+				return errors
+			}}
+			execute={async ({ values }) => {
+				return await updateProjectMember({
+					identityId,
+					projectSlug,
+					memberships: values.memberships,
+				})
+			}}
+			errorMapping={errorToField}
+		>
+			{children}
+		</TenantForm>
+	)
+}
+
+const errorToField: Record<UpdateProjectMemberErrorCode, keyof UpdateProjectMemberFormValues | undefined> = {
+	INVALID_MEMBERSHIP: 'memberships',
+	PROJECT_NOT_FOUND: undefined,
+	ROLE_NOT_FOUND: 'memberships',
+	VARIABLE_EMPTY: 'memberships',
+	VARIABLE_NOT_FOUND: 'memberships',
+	NOT_MEMBER: undefined,
+}
diff --git a/packages/react-client-tenant/src/components/forms/index.ts b/packages/react-client-tenant/src/components/forms/index.ts
new file mode 100644
index 0000000000..c75e1b5059
--- /dev/null
+++ b/packages/react-client-tenant/src/components/forms/index.ts
@@ -0,0 +1,10 @@
+export * from './CreateApiKeyForm'
+export * from './CreateSessionTokenForm'
+export * from './ChangeMyPasswordForm'
+export * from './InviteForm'
+export * from './LoginForm'
+export * from './PasswordResetForm'
+export * from './PasswordResetRequestForm'
+export * from './OtpPrepareForm'
+export * from './OtpConfirmForm'
+export * from './UpdateProjectMemberForm'
diff --git a/packages/react-client-tenant/src/components/idp/IDP.tsx b/packages/react-client-tenant/src/components/idp/IDP.tsx
new file mode 100644
index 0000000000..8b3f6231df
--- /dev/null
+++ b/packages/react-client-tenant/src/components/idp/IDP.tsx
@@ -0,0 +1,65 @@
+import { ReactNode, useEffect, useMemo, useRef, useState } from 'react'
+import { IDPMethodsContextProvider, IDPStateContextProvider } from '../../contexts'
+import { IDPInitError, IDPResponseError, IDPStateValue } from '../../types/idp'
+import { useHandleIDPResponse } from '../../internal/hooks/useHandleIDPResponse'
+import { useIDPAutoInitProvider } from '../../internal/hooks/useIDPAutoInit'
+import { useInitIDPRedirect } from '../../internal/hooks/useInitIDPRedirect'
+
+export interface IDPProps {
+	children: ReactNode
+	onLogin?: () => void
+	onInitError?: (error: IDPInitError) => void
+	onResponseError?: (error: IDPResponseError) => void
+}
+
+export const IDP = ({ children, onResponseError, onInitError, onLogin }: IDPProps) => {
+	const hasOauthResponse = useMemo(() => {
+		const params = new URLSearchParams(window.location.search)
+		return params.has('state') && (params.has('code') || params.has('id_token'))
+	}, [])
+
+	const autoInit = useIDPAutoInitProvider()
+	const [state, setState] = useState<IDPStateValue>(() => {
+		if (hasOauthResponse) {
+			return { type: 'processing_response' }
+		}
+		if (autoInit) {
+			return { type: 'processing_init' }
+		}
+		return { type: 'nothing' }
+	})
+	useHandleIDPResponse({ hasOauthResponse, setState, onLogin })
+
+	const initRedirect = useInitIDPRedirect({ setState })
+
+	const isFirstRender = useRef(true)
+	useEffect(() => {
+		if (!autoInit) {
+			return
+		}
+		if (!isFirstRender.current) {
+			return
+		}
+		isFirstRender.current = false
+		initRedirect({ provider: autoInit })
+	}, [autoInit, initRedirect])
+
+	useEffect(() => {
+		if (state.type === 'init_failed' && onInitError) {
+			onInitError(state.error)
+		}
+		if (state.type === 'response_failed' && onResponseError) {
+			onResponseError(state.error)
+		}
+	}, [onInitError, onResponseError, state])
+
+
+	return (
+		<IDPStateContextProvider.Provider value={state}>
+			<IDPMethodsContextProvider.Provider value={{ initRedirect }}>
+				{children}
+			</IDPMethodsContextProvider.Provider>
+		</IDPStateContextProvider.Provider>
+	)
+
+}
diff --git a/packages/react-client-tenant/src/components/idp/IDPInitTrigger.tsx b/packages/react-client-tenant/src/components/idp/IDPInitTrigger.tsx
new file mode 100644
index 0000000000..404969996a
--- /dev/null
+++ b/packages/react-client-tenant/src/components/idp/IDPInitTrigger.tsx
@@ -0,0 +1,17 @@
+import { Slot } from '@radix-ui/react-slot'
+import { ComponentType, ReactElement } from 'react'
+import { useIDPMethods } from '../../contexts'
+
+const SlotButton = Slot as ComponentType<React.ButtonHTMLAttributes<HTMLButtonElement>>
+
+export interface IDPInitTriggerProps {
+	children: ReactElement
+	identityProvider: string
+}
+
+export const IDPInitTrigger = ({ identityProvider, ...props }: IDPInitTriggerProps) => {
+	const initIdp = useIDPMethods().initRedirect
+	return (
+		<SlotButton onClick={() => initIdp({ provider: identityProvider })}  {...props} />
+	)
+}
diff --git a/packages/react-client-tenant/src/components/idp/IDPState.tsx b/packages/react-client-tenant/src/components/idp/IDPState.tsx
new file mode 100644
index 0000000000..487e6f7c70
--- /dev/null
+++ b/packages/react-client-tenant/src/components/idp/IDPState.tsx
@@ -0,0 +1,14 @@
+import React, { ReactNode } from 'react'
+import { IDPStateType } from '../../types'
+import { useIDPState } from '../../contexts'
+
+export interface IDPStateProps {
+	state: IDPStateType | IDPStateType[]
+	children: ReactNode
+}
+
+export const IDPState = ({ state, children }: IDPStateProps) => {
+	const currentState = useIDPState().type
+
+	return state === currentState || (Array.isArray(state) && state.includes(currentState)) ? <>{children}</> : null
+}
diff --git a/packages/react-client-tenant/src/components/idp/index.ts b/packages/react-client-tenant/src/components/idp/index.ts
new file mode 100644
index 0000000000..694a6b9d8f
--- /dev/null
+++ b/packages/react-client-tenant/src/components/idp/index.ts
@@ -0,0 +1,3 @@
+export * from './IDPState'
+export * from './IDP'
+export * from './IDPInitTrigger'
diff --git a/packages/react-client-tenant/src/components/index.ts b/packages/react-client-tenant/src/components/index.ts
new file mode 100644
index 0000000000..83de4f5357
--- /dev/null
+++ b/packages/react-client-tenant/src/components/index.ts
@@ -0,0 +1,5 @@
+export * from './IdentityProvider'
+export * from './IdentityState'
+export * from './forms'
+export * from './idp'
+export * from './triggers'
diff --git a/packages/react-client-tenant/src/components/triggers/DisableOtpTrigger.tsx b/packages/react-client-tenant/src/components/triggers/DisableOtpTrigger.tsx
new file mode 100644
index 0000000000..c272040c93
--- /dev/null
+++ b/packages/react-client-tenant/src/components/triggers/DisableOtpTrigger.tsx
@@ -0,0 +1,25 @@
+import { ReactElement, useCallback } from 'react'
+import { useDisableOtpMutation } from '../../hooks'
+import { TenantActionTrigger } from './TenantActionTrigger'
+import { useIdentityMethods } from '../../contexts'
+
+export interface DisableOtpTriggerProps {
+	children: ReactElement
+	onSuccess?: () => void
+	onError?: (e: unknown) => void
+}
+
+export const DisableOtpTrigger = ({ onSuccess, ...props }: DisableOtpTriggerProps) => {
+	const disableOtp = useDisableOtpMutation()
+	const { refreshIdentity } = useIdentityMethods()
+
+	return (
+		<TenantActionTrigger
+			execute={useCallback(() => disableOtp({}), [disableOtp])}
+			onSuccess={() => {
+				refreshIdentity()
+				onSuccess?.()
+			}} {...props}
+		/>
+	)
+}
diff --git a/packages/react-identity/src/components/LogoutTrigger.tsx b/packages/react-client-tenant/src/components/triggers/LogoutTrigger.tsx
similarity index 84%
rename from packages/react-identity/src/components/LogoutTrigger.tsx
rename to packages/react-client-tenant/src/components/triggers/LogoutTrigger.tsx
index a8d35d3b3d..e455023b5f 100644
--- a/packages/react-identity/src/components/LogoutTrigger.tsx
+++ b/packages/react-client-tenant/src/components/triggers/LogoutTrigger.tsx
@@ -1,6 +1,6 @@
 import { ReactNode, useCallback } from 'react'
 import { Slot } from '@radix-ui/react-slot'
-import { useLogout } from '../hooks'
+import { useLogout } from '../../hooks/useLogout'
 
 export const LogoutTrigger = ({ children }: {
 	children: ReactNode
diff --git a/packages/react-client-tenant/src/components/triggers/RemoveProjectMemberTrigger.tsx b/packages/react-client-tenant/src/components/triggers/RemoveProjectMemberTrigger.tsx
new file mode 100644
index 0000000000..e97ee2f0f3
--- /dev/null
+++ b/packages/react-client-tenant/src/components/triggers/RemoveProjectMemberTrigger.tsx
@@ -0,0 +1,18 @@
+import { ReactElement, useCallback } from 'react'
+import { TenantActionTrigger } from './TenantActionTrigger'
+import { RemoveProjectMemberMutationVariables, useRemoveProjectMemberMutation } from '../../hooks'
+
+export type RemoveProjectMemberTriggerProps =
+	& RemoveProjectMemberMutationVariables
+	& {
+		children: ReactElement
+		onSuccess?: () => void
+		onError?: (e: unknown) => void
+	}
+
+
+export const RemoveProjectMemberTrigger = ({ identityId, projectSlug, ...props }: RemoveProjectMemberTriggerProps) => {
+	const removeProjectMember = useRemoveProjectMemberMutation()
+	const execute = useCallback(async () => await removeProjectMember({ projectSlug, identityId }), [identityId, projectSlug, removeProjectMember])
+	return <TenantActionTrigger {...props} execute={execute} />
+}
diff --git a/packages/react-client-tenant/src/components/triggers/TenantActionTrigger.tsx b/packages/react-client-tenant/src/components/triggers/TenantActionTrigger.tsx
new file mode 100644
index 0000000000..fda5501a48
--- /dev/null
+++ b/packages/react-client-tenant/src/components/triggers/TenantActionTrigger.tsx
@@ -0,0 +1,41 @@
+import { Slot } from '@radix-ui/react-slot'
+import { ComponentType, MouseEventHandler, ReactElement, useMemo, useState } from 'react'
+import { composeEventHandlers } from '@radix-ui/primitive'
+import { useReferentiallyStableCallback } from '@contember/react-utils'
+
+const SlotButton = Slot as ComponentType<React.ButtonHTMLAttributes<HTMLButtonElement>>
+
+export interface TenantActionTriggerProps<OkResult, Error extends string> {
+	children: ReactElement
+	onClick?: MouseEventHandler<HTMLButtonElement>
+	onSuccess?: (args: {result: OkResult}) => void
+	onError?: (args: { code: Error | 'UNKNOWN_ERROR', error: unknown }) => void
+	execute: () => Promise<({ ok: true } & (OkResult extends undefined ? {} : { result: OkResult })) | { ok: false, error?: Error }>
+}
+
+export const TenantActionTrigger = <OkResult, Error extends string>({ onError: onErrorIn, onSuccess: onSuccessIn, onClick: onClickProp, execute: executeIn, ...props }: TenantActionTriggerProps<OkResult, Error>) => {
+	const [submitting, setSubmitting] = useState(false)
+
+	const onSuccess = useReferentiallyStableCallback(onSuccessIn || (() => undefined))
+	const onError = useReferentiallyStableCallback(onErrorIn || (() => undefined))
+	const execute = useReferentiallyStableCallback(executeIn)
+
+	const onClick = useMemo(() => async () => {
+		setSubmitting(true)
+		try {
+			const response = await execute()
+			setSubmitting(false)
+			if (response.ok) {
+				onSuccess?.({ result: 'result' in response ? response.result : undefined as OkResult })
+			} else {
+				onError?.({ code: response.error ?? 'UNKNOWN_ERROR', error: response })
+			}
+		} catch (e) {
+			console.error(e)
+			setSubmitting(false)
+			onError?.({ code: 'UNKNOWN_ERROR', error: e })
+		}
+	}, [execute, onError, onSuccess])
+
+	return <SlotButton onClick={composeEventHandlers(onClickProp, onClick)} disabled={submitting} {...props} />
+}
diff --git a/packages/react-client-tenant/src/components/triggers/index.ts b/packages/react-client-tenant/src/components/triggers/index.ts
new file mode 100644
index 0000000000..8483c6b57c
--- /dev/null
+++ b/packages/react-client-tenant/src/components/triggers/index.ts
@@ -0,0 +1,3 @@
+export * from './DisableOtpTrigger'
+export * from './LogoutTrigger'
+export * from './RemoveProjectMemberTrigger'
diff --git a/packages/react-client-tenant/src/contexts.ts b/packages/react-client-tenant/src/contexts.ts
new file mode 100644
index 0000000000..1d6ecc8327
--- /dev/null
+++ b/packages/react-client-tenant/src/contexts.ts
@@ -0,0 +1,34 @@
+import { createContext, createRequiredContext } from '@contember/react-utils'
+import { FormContextValue, Identity, IdentityMethods, IdentityStateValue, IDPMethods, IDPStateValue } from './types'
+
+const IdentityContext_ = createContext<Identity | undefined>('IdentityContext', undefined)
+/** @internal */
+export const IdentityContext = IdentityContext_[0]
+export const useIdentity = IdentityContext_[1]
+
+const IdentityMethodsContext_ = createRequiredContext<IdentityMethods>('IdentityMethodsContext')
+/** @internal */
+export const IdentityMethodsContext = IdentityMethodsContext_[0]
+export const useIdentityMethods = IdentityMethodsContext_[1]
+
+const IdentityStateContext_ = createRequiredContext<IdentityStateValue>('IdentityStateContext')
+/** @internal */
+export const IdentityStateContext = IdentityStateContext_[0]
+export const useIdentityState = IdentityStateContext_[1]
+
+
+const FormContext_ = createRequiredContext<FormContextValue<any, any, any>>('FormContext')
+/** @internal */
+export const FormContext = FormContext_[0]
+export const useForm = FormContext_[1]
+
+
+const IDPStateContext = createRequiredContext<IDPStateValue>('IDPStateContext')
+/** @internal */
+export const IDPStateContextProvider = IDPStateContext[0]
+export const useIDPState = IDPStateContext[1]
+
+const IDPMethodsContext = createRequiredContext<IDPMethods>('IDPMethodsContext')
+/** @internal */
+export const IDPMethodsContextProvider = IDPMethodsContext[0]
+export const useIDPMethods = IDPMethodsContext[1]
diff --git a/packages/react-client-tenant/src/hooks/index.ts b/packages/react-client-tenant/src/hooks/index.ts
index 6862ff0b4e..fc0431c3a6 100644
--- a/packages/react-client-tenant/src/hooks/index.ts
+++ b/packages/react-client-tenant/src/hooks/index.ts
@@ -1 +1,7 @@
+export * from './mutations'
+export * from './queries'
+export * from './useFetchIdentity'
+export * from './useLogout'
 export * from './useTenantApi'
+export * from './useTenantQueryLoader'
+export * from './useTenantMutation'
diff --git a/packages/react-client-tenant/src/hooks/mutations/apiKey/index.ts b/packages/react-client-tenant/src/hooks/mutations/apiKey/index.ts
new file mode 100644
index 0000000000..b5523a7647
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/apiKey/index.ts
@@ -0,0 +1,4 @@
+export * from './useCreateApiKeyMutation'
+export * from './useCreateSessionTokenMutation'
+export * from './useCreateGlobalApiKeyMutation'
+export * from './useDisableApiKeyMutation'
diff --git a/packages/react-client-tenant/src/hooks/mutations/apiKey/useCreateApiKeyMutation.tsx b/packages/react-client-tenant/src/hooks/mutations/apiKey/useCreateApiKeyMutation.tsx
new file mode 100644
index 0000000000..12e59e4cca
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/apiKey/useCreateApiKeyMutation.tsx
@@ -0,0 +1,19 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { ModelType } from 'graphql-ts-client-api'
+import { createTenantMutation } from '../../useTenantMutation'
+
+const createApiKeyMutationResult = TenantApi.createApiKeyResult$.apiKey(TenantApi.apiKeyWithToken$$.identity(TenantApi.identity$$))
+
+export type CreateApiKeyMutationResult = ModelType<typeof createApiKeyMutationResult>
+
+export const createApiKeyMutation = TenantApi.mutation$
+	.createApiKey(
+		TenantApi
+			.createApiKeyResponse$$
+			.error(TenantApi.createApiKeyError$$.membershipValidation(TenantApi.membershipValidationError$$))
+			.result(createApiKeyMutationResult),
+		options => options.alias('mutation'),
+	)
+
+export const useCreateApiKeyMutation = createTenantMutation(createApiKeyMutation)
+export type CreateApiKeyMutationVariables = Parameters<ReturnType<typeof useCreateApiKeyMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/apiKey/useCreateGlobalApiKeyMutation.tsx b/packages/react-client-tenant/src/hooks/mutations/apiKey/useCreateGlobalApiKeyMutation.tsx
new file mode 100644
index 0000000000..34ebdd9fa3
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/apiKey/useCreateGlobalApiKeyMutation.tsx
@@ -0,0 +1,19 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { ModelType } from 'graphql-ts-client-api'
+import { createTenantMutation } from '../../useTenantMutation'
+
+const createGlobalApiKeyMutationResult = TenantApi.createApiKeyResult$.apiKey(TenantApi.apiKeyWithToken$$.identity(TenantApi.identity$$))
+
+export type CreateGlobalApiKeyMutationResult = ModelType<typeof createGlobalApiKeyMutationResult>
+
+export const createGlobalApiKeyMutation = TenantApi.mutation$
+	.createGlobalApiKey(
+		TenantApi
+			.createApiKeyResponse$$
+			.error(TenantApi.createApiKeyError$$)
+			.result(createGlobalApiKeyMutationResult),
+		options => options.alias('mutation'),
+	)
+
+export const useCreateGlobalApiKeyMutation = createTenantMutation(createGlobalApiKeyMutation)
+export type CreateGlobalApiKeyMutationVariables = Parameters<ReturnType<typeof useCreateGlobalApiKeyMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/apiKey/useCreateSessionTokenMutation.tsx b/packages/react-client-tenant/src/hooks/mutations/apiKey/useCreateSessionTokenMutation.tsx
new file mode 100644
index 0000000000..1310a3a0ae
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/apiKey/useCreateSessionTokenMutation.tsx
@@ -0,0 +1,19 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { ModelType } from 'graphql-ts-client-api'
+import { createTenantMutation } from '../../useTenantMutation'
+
+const createSessionTokenMutationResult = TenantApi.createSessionTokenResult$.token.person(TenantApi.person$$)
+
+export type CreateSessionTokenMutationResult = ModelType<typeof createSessionTokenMutationResult>
+
+export const createSessionTokenMutation = TenantApi.mutation$
+	.createSessionToken(
+		TenantApi
+			.createSessionTokenResponse$$
+			.error(TenantApi.createSessionTokenError$$)
+			.result(createSessionTokenMutationResult),
+		options => options.alias('mutation'),
+	)
+
+export const useCreateSessionTokenMutation = createTenantMutation(createSessionTokenMutation)
+export type CreateSessionTokenMutationVariables = Parameters<ReturnType<typeof useCreateSessionTokenMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/apiKey/useDisableApiKeyMutation.tsx b/packages/react-client-tenant/src/hooks/mutations/apiKey/useDisableApiKeyMutation.tsx
new file mode 100644
index 0000000000..ae7863e71d
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/apiKey/useDisableApiKeyMutation.tsx
@@ -0,0 +1,14 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { createTenantMutation } from '../../useTenantMutation'
+
+
+export const disableApiKeyMutation = TenantApi.mutation$
+	.disableApiKey(
+		TenantApi
+			.disableApiKeyResponse$$
+			.error(TenantApi.disableApiKeyError$$),
+		options => options.alias('mutation'),
+	)
+
+export const useDisableApiKeyMutation = createTenantMutation(disableApiKeyMutation)
+export type DisableApiKeyMutationVariables = Parameters<ReturnType<typeof useDisableApiKeyMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/auth/index.ts b/packages/react-client-tenant/src/hooks/mutations/auth/index.ts
new file mode 100644
index 0000000000..f9a0d68bfb
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/auth/index.ts
@@ -0,0 +1,3 @@
+export * from './useChangeMyPasswordMutation'
+export * from './useSignInMutation'
+export * from './useSignOutMutation'
diff --git a/packages/react-client-tenant/src/hooks/mutations/auth/useChangeMyPasswordMutation.ts b/packages/react-client-tenant/src/hooks/mutations/auth/useChangeMyPasswordMutation.ts
new file mode 100644
index 0000000000..2039f75cb5
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/auth/useChangeMyPasswordMutation.ts
@@ -0,0 +1,14 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { createTenantMutation } from '../../useTenantMutation'
+
+export const changeMyPasswordMutation = TenantApi
+	.mutation$
+	.changeMyPassword(
+		TenantApi
+			.changeMyPasswordResponse$$
+			.error(TenantApi.changeMyPasswordError$$),
+		options => options.alias('mutation'),
+	)
+
+export const useChangeMyPasswordMutation = createTenantMutation(changeMyPasswordMutation)
+export type ChangeMyPasswordMutationVariables = Parameters<ReturnType<typeof useChangeMyPasswordMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/auth/useSignInMutation.ts b/packages/react-client-tenant/src/hooks/mutations/auth/useSignInMutation.ts
new file mode 100644
index 0000000000..90edffa35c
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/auth/useSignInMutation.ts
@@ -0,0 +1,25 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { LoginToken } from '../../useTenantApi'
+import { ModelType } from 'graphql-ts-client-api'
+import { createTenantMutation } from '../../useTenantMutation'
+
+const signInResultFragment = TenantApi.signInResult$$.person(TenantApi.person$$)
+
+export type SignInMutationResult = ModelType<typeof signInResultFragment>
+
+export const signInMutation = TenantApi
+	.mutation$
+	.signIn(
+		TenantApi
+			.signInResponse$$
+			.error(TenantApi.signInError$$)
+			.result(signInResultFragment),
+		options => options.alias('mutation'),
+	)
+
+
+export const useSignInMutation = createTenantMutation(signInMutation, {
+	apiToken: LoginToken,
+})
+
+export type SignInMutationVariables = Parameters<ReturnType<typeof useSignInMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/auth/useSignOutMutation.ts b/packages/react-client-tenant/src/hooks/mutations/auth/useSignOutMutation.ts
new file mode 100644
index 0000000000..6385da70b1
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/auth/useSignOutMutation.ts
@@ -0,0 +1,12 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { createTenantMutation } from '../../useTenantMutation'
+
+export const signOutMutation = TenantApi.mutation$.signOut(
+	TenantApi
+		.signOutResponse$$
+		.error(TenantApi.signOutError$$),
+	options => options.alias('mutation'),
+)
+
+export const useSignOutMutation = createTenantMutation(signOutMutation)
+export type SignOutMutationVariables = Parameters<ReturnType<typeof useSignOutMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/idp/index.ts b/packages/react-client-tenant/src/hooks/mutations/idp/index.ts
new file mode 100644
index 0000000000..66b567730a
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/idp/index.ts
@@ -0,0 +1,2 @@
+export * from './useInitSignInIDPMutation'
+export * from './useSignInIdpMutation'
diff --git a/packages/react-client-tenant/src/hooks/mutations/idp/useInitSignInIDPMutation.ts b/packages/react-client-tenant/src/hooks/mutations/idp/useInitSignInIDPMutation.ts
new file mode 100644
index 0000000000..c434117797
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/idp/useInitSignInIDPMutation.ts
@@ -0,0 +1,29 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { LoginToken } from '../../useTenantApi'
+import { createTenantMutation } from '../../useTenantMutation'
+import { ModelType } from 'graphql-ts-client-api'
+
+
+export type InitSignInIDPMutationVariables = {
+	identityProvider: string
+	data: {
+		redirectUrl?: string
+	} & {
+		[key: string]: string
+	}
+}
+export type InitSignInIDPMutationResult = ModelType<typeof TenantApi.initSignInIDPResult$$>
+
+const InitSignInIDPMutation = TenantApi
+	.mutation$
+	.initSignInIDP(
+		TenantApi
+			.initSignInIDPResponse$$
+			.error(TenantApi.initSignInIDPError$$)
+			.result(TenantApi.initSignInIDPResult$$),
+		options => options.alias('mutation'),
+	)
+
+export const useInitSignInIDPMutation = createTenantMutation<InitSignInIDPMutationResult, TenantApi.InitSignInIDPErrorCode, InitSignInIDPMutationVariables>(InitSignInIDPMutation, {
+	apiToken: LoginToken,
+})
diff --git a/packages/react-client-tenant/src/hooks/mutations/idp/useSignInIdpMutation.ts b/packages/react-client-tenant/src/hooks/mutations/idp/useSignInIdpMutation.ts
new file mode 100644
index 0000000000..4cce03872c
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/idp/useSignInIdpMutation.ts
@@ -0,0 +1,35 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { LoginToken } from '../../useTenantApi'
+import { createTenantMutation } from '../../useTenantMutation'
+import { ModelType } from 'graphql-ts-client-api'
+
+const signInIdpFragment = TenantApi.signInIDPResult$$.person(TenantApi.person$$)
+
+export type SignInIDPMutationResult = ModelType<typeof signInIdpFragment>
+
+export const signInIDPMutation = TenantApi
+	.mutation$
+	.signInIDP(
+		TenantApi
+			.signInIDPResponse$$
+			.error(TenantApi.signInIDPError$$)
+			.result(signInIdpFragment),
+		options => options.alias('mutation'),
+	)
+
+export type SignInIDPMutationVariables = {
+	identityProvider: string
+	expiration?: number
+	data:
+		& {
+			url?: string
+			redirectUrl?: string
+			sessionData?: any
+		}
+		& { [key: string]: any }
+}
+
+
+export const useSignInIDPMutation = createTenantMutation<SignInIDPMutationResult, TenantApi.SignInIDPErrorCode, SignInIDPMutationVariables>(signInIDPMutation, {
+	apiToken: LoginToken,
+})
diff --git a/packages/react-client-tenant/src/hooks/mutations/index.ts b/packages/react-client-tenant/src/hooks/mutations/index.ts
new file mode 100644
index 0000000000..a13493caad
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/index.ts
@@ -0,0 +1,7 @@
+export * from './apiKey'
+export * from './auth'
+export * from './invite'
+export * from './idp'
+export * from './memberships'
+export * from './otp'
+export * from './passwordReset'
diff --git a/packages/react-client-tenant/src/hooks/mutations/invite/index.ts b/packages/react-client-tenant/src/hooks/mutations/invite/index.ts
new file mode 100644
index 0000000000..653c50b318
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/invite/index.ts
@@ -0,0 +1 @@
+export * from './useInviteMutation'
diff --git a/packages/react-client-tenant/src/hooks/mutations/invite/useInviteMutation.tsx b/packages/react-client-tenant/src/hooks/mutations/invite/useInviteMutation.tsx
new file mode 100644
index 0000000000..4e5a34e097
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/invite/useInviteMutation.tsx
@@ -0,0 +1,20 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { ModelType } from 'graphql-ts-client-api'
+import { createTenantMutation } from '../../useTenantMutation'
+
+const inviteMutationResult = TenantApi.inviteResult$$
+	.person(TenantApi.person$$.identity(TenantApi.identity$$))
+
+export type InviteMutationResult = ModelType<typeof inviteMutationResult>
+
+export const inviteMutation = TenantApi.mutation$
+	.invite(
+		TenantApi
+			.inviteResponse$$
+			.error(TenantApi.inviteError$$.membershipValidation(TenantApi.membershipValidationError$$))
+			.result(inviteMutationResult),
+		options => options.alias('mutation'),
+	)
+
+export const useInviteMutation = createTenantMutation(inviteMutation)
+export type InviteMutationVariables = Parameters<ReturnType<typeof useInviteMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/memberships/index.ts b/packages/react-client-tenant/src/hooks/mutations/memberships/index.ts
new file mode 100644
index 0000000000..47ba55e00f
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/memberships/index.ts
@@ -0,0 +1,3 @@
+export * from './useRemoveProjectMemberMutation'
+export * from './useAddProjectMemberMutation'
+export * from './useUpdateProjectMemberMutation'
diff --git a/packages/react-client-tenant/src/hooks/mutations/memberships/useAddProjectMemberMutation.ts b/packages/react-client-tenant/src/hooks/mutations/memberships/useAddProjectMemberMutation.ts
new file mode 100644
index 0000000000..84a4ee671f
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/memberships/useAddProjectMemberMutation.ts
@@ -0,0 +1,13 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { createTenantMutation } from '../../useTenantMutation'
+
+export const addProjectMemberMutation = TenantApi.mutation$
+	.addProjectMember(
+		TenantApi
+			.addProjectMemberResponse$$
+			.error(TenantApi.addProjectMemberError$$.membershipValidation(TenantApi.membershipValidationError$$)),
+		options => options.alias('mutation'),
+	)
+
+export const useAddProjectMemberMutation = createTenantMutation(addProjectMemberMutation)
+export type AddProjectMemberMutationVariables = Parameters<ReturnType<typeof useAddProjectMemberMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/memberships/useRemoveProjectMemberMutation.ts b/packages/react-client-tenant/src/hooks/mutations/memberships/useRemoveProjectMemberMutation.ts
new file mode 100644
index 0000000000..e9965d8fe7
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/memberships/useRemoveProjectMemberMutation.ts
@@ -0,0 +1,13 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { createTenantMutation } from '../../useTenantMutation'
+
+export const removeProjectMemberMutation = TenantApi.mutation$
+	.removeProjectMember(
+		TenantApi
+			.removeProjectMemberResponse$$
+			.error(TenantApi.removeProjectMemberError$$),
+		options => options.alias('mutation'),
+	)
+
+export const useRemoveProjectMemberMutation = createTenantMutation(removeProjectMemberMutation)
+export type RemoveProjectMemberMutationVariables = Parameters<ReturnType<typeof useRemoveProjectMemberMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/memberships/useUpdateProjectMemberMutation.ts b/packages/react-client-tenant/src/hooks/mutations/memberships/useUpdateProjectMemberMutation.ts
new file mode 100644
index 0000000000..5a1351e62a
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/memberships/useUpdateProjectMemberMutation.ts
@@ -0,0 +1,13 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { createTenantMutation } from '../../useTenantMutation'
+
+export const updateProjectMemberMutation = TenantApi.mutation$
+	.updateProjectMember(
+		TenantApi
+			.updateProjectMemberResponse$$
+			.error(TenantApi.updateProjectMemberError$$.membershipValidation(TenantApi.membershipValidationError$$)),
+		options => options.alias('mutation'),
+	)
+
+export const useUpdateProjectMemberMutation = createTenantMutation(updateProjectMemberMutation)
+export type UpdateProjectMemberMutationVariables = Parameters<ReturnType<typeof useUpdateProjectMemberMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/otp/index.ts b/packages/react-client-tenant/src/hooks/mutations/otp/index.ts
new file mode 100644
index 0000000000..19bc570206
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/otp/index.ts
@@ -0,0 +1,3 @@
+export * from './useConfirmOtpMutation'
+export * from './useDisableOtpMutation'
+export * from './usePrepareOtpMutation'
diff --git a/packages/react-client-tenant/src/hooks/mutations/otp/useConfirmOtpMutation.ts b/packages/react-client-tenant/src/hooks/mutations/otp/useConfirmOtpMutation.ts
new file mode 100644
index 0000000000..c61f391230
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/otp/useConfirmOtpMutation.ts
@@ -0,0 +1,13 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { createTenantMutation } from '../../useTenantMutation'
+
+export const confirmOtpMutation = TenantApi.mutation$
+	.confirmOtp(TenantApi
+			.confirmOtpResponse$$
+			.error(TenantApi.confirmOtpError$$),
+		options => options.alias('mutation'),
+	)
+
+
+export const useConfirmOtpMutation = createTenantMutation(confirmOtpMutation)
+export type ConfirmOtpMutationVariables = Parameters<ReturnType<typeof useConfirmOtpMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/otp/useDisableOtpMutation.ts b/packages/react-client-tenant/src/hooks/mutations/otp/useDisableOtpMutation.ts
new file mode 100644
index 0000000000..81959198a3
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/otp/useDisableOtpMutation.ts
@@ -0,0 +1,10 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { createTenantMutation } from '../../useTenantMutation'
+
+export const disableOtpMutation = TenantApi.mutation$.disableOtp(
+	TenantApi.disableOtpResponse$$.error(TenantApi.disableOtpError$$),
+	options => options.alias('mutation'),
+)
+
+export const useDisableOtpMutation = createTenantMutation(disableOtpMutation)
+export type DisableOtpMutationVariables = Parameters<ReturnType<typeof useDisableOtpMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/otp/usePrepareOtpMutation.ts b/packages/react-client-tenant/src/hooks/mutations/otp/usePrepareOtpMutation.ts
new file mode 100644
index 0000000000..3a85465ff1
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/otp/usePrepareOtpMutation.ts
@@ -0,0 +1,16 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { ModelType } from 'graphql-ts-client-api'
+import { createTenantMutation } from '../../useTenantMutation'
+
+const prepareOtmMutationResult = TenantApi.prepareOtpResponse$$.result(TenantApi.prepareOtpResult$$)
+
+export type PrepareOtpMutationResult = ModelType<typeof TenantApi.prepareOtpResult$$>
+
+export const prepareOtpMutation = TenantApi.mutation$.prepareOtp(
+	prepareOtmMutationResult,
+	options => options.alias('mutation'),
+)
+
+
+export const usePrepareOtpMutation = createTenantMutation(prepareOtpMutation)
+export type PrepareOtpMutationVariables = Parameters<ReturnType<typeof usePrepareOtpMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/passwordReset/index.ts b/packages/react-client-tenant/src/hooks/mutations/passwordReset/index.ts
new file mode 100644
index 0000000000..395ed43df3
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/passwordReset/index.ts
@@ -0,0 +1,2 @@
+export * from './useCreateResetPasswordRequestMutation'
+export * from './useResetPasswordMutation'
diff --git a/packages/react-client-tenant/src/hooks/mutations/passwordReset/useCreateResetPasswordRequestMutation.ts b/packages/react-client-tenant/src/hooks/mutations/passwordReset/useCreateResetPasswordRequestMutation.ts
new file mode 100644
index 0000000000..6e0788582a
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/passwordReset/useCreateResetPasswordRequestMutation.ts
@@ -0,0 +1,17 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { LoginToken } from '../../useTenantApi'
+import { createTenantMutation } from '../../useTenantMutation'
+
+export const createResetPasswordRequestMutation = TenantApi
+	.mutation$
+	.createResetPasswordRequest(
+		TenantApi
+			.createPasswordResetRequestResponse$$
+			.error(TenantApi.createPasswordResetRequestError$$),
+		options => options.alias('mutation'),
+	)
+
+export const useCreateResetPasswordRequestMutation = createTenantMutation(createResetPasswordRequestMutation, {
+	apiToken: LoginToken,
+})
+export type CreateResetPasswordRequestMutationVariables = Parameters<ReturnType<typeof useCreateResetPasswordRequestMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/mutations/passwordReset/useResetPasswordMutation.ts b/packages/react-client-tenant/src/hooks/mutations/passwordReset/useResetPasswordMutation.ts
new file mode 100644
index 0000000000..cadcb5b1c8
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/mutations/passwordReset/useResetPasswordMutation.ts
@@ -0,0 +1,17 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { LoginToken } from '../../useTenantApi'
+import { createTenantMutation } from '../../useTenantMutation'
+
+export const resetPasswordMutation = TenantApi
+	.mutation$
+	.resetPassword(
+		TenantApi
+			.resetPasswordResponse$$
+			.error(TenantApi.resetPasswordError$$),
+		options => options.alias('mutation'),
+	)
+
+export const useResetPasswordMutation = createTenantMutation(resetPasswordMutation, {
+	apiToken: LoginToken,
+})
+export type ResetPasswordMutationVariables = Parameters<ReturnType<typeof useResetPasswordMutation>>[0]
diff --git a/packages/react-client-tenant/src/hooks/queries/index.ts b/packages/react-client-tenant/src/hooks/queries/index.ts
new file mode 100644
index 0000000000..675553dcd7
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/queries/index.ts
@@ -0,0 +1,4 @@
+export * from './useMeQuery'
+export * from './useProjectMembersQuery'
+export * from './useProjectMembershipsQuery'
+export * from './useProjectRolesDefinitionQuery'
diff --git a/packages/react-identity/src/internal/hooks/useFetchMe.ts b/packages/react-client-tenant/src/hooks/queries/useMeQuery.ts
similarity index 58%
rename from packages/react-identity/src/internal/hooks/useFetchMe.ts
rename to packages/react-client-tenant/src/hooks/queries/useMeQuery.ts
index 5070e79127..a46ce3aa7b 100644
--- a/packages/react-identity/src/internal/hooks/useFetchMe.ts
+++ b/packages/react-client-tenant/src/hooks/queries/useMeQuery.ts
@@ -1,5 +1,6 @@
 import * as TenantApi from '@contember/graphql-client-tenant'
-import { ModelType, useTenantApi } from '@contember/react-client-tenant'
+import { ModelType } from 'graphql-ts-client-api'
+import { TenantApiOptions, useTenantApi } from '../useTenantApi'
 import { useCallback } from 'react'
 
 const identityFragment = TenantApi
@@ -12,11 +13,11 @@ const identityFragment = TenantApi
 	)
 	.permissions(TenantApi.identityGlobalPermissions$$)
 
-export type FetchedIdentity = ModelType<typeof identityFragment>
+export type MeQueryData = ModelType<typeof identityFragment>
 
-export const useFetchMe = () => {
-	const executor = useTenantApi()
-	return useCallback(async () => {
+export const useMeQuery = (options: TenantApiOptions = {}) => {
+	const executor = useTenantApi(options)
+	return useCallback(async ({}: {}): Promise<MeQueryData> => {
 		return (await executor(TenantApi.query$.me(identityFragment))).me
 	}, [executor])
 }
diff --git a/packages/react-client-tenant/src/hooks/queries/useProjectMembersQuery.ts b/packages/react-client-tenant/src/hooks/queries/useProjectMembersQuery.ts
new file mode 100644
index 0000000000..c4fb911522
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/queries/useProjectMembersQuery.ts
@@ -0,0 +1,43 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { ModelType, ParameterRef } from 'graphql-ts-client-api'
+import { TenantApiOptions, useTenantApi } from '../useTenantApi'
+import { useCallback } from 'react'
+
+const projectIdentityRelationFragment = TenantApi
+	.projectIdentityRelation$
+	.identity(TenantApi.identity$$
+			.person(TenantApi.person$$)
+			.apiKey(TenantApi.apiKey$$)
+		,
+	)
+	.memberships(TenantApi.membership$$.variables(TenantApi.variableEntry$$))
+
+export type ProjectMembersQueryResult = readonly ModelType<typeof projectIdentityRelationFragment>[]
+
+export type ProjectMembersQueryVariables =
+	& {
+		projectSlug: string
+	}
+	& TenantApi.ProjectMembersInput
+
+
+export const useProjectMembersQuery = ({ headers, apiToken }: TenantApiOptions = {}) => {
+	const executor = useTenantApi({
+		headers,
+		apiToken,
+	})
+	return useCallback(async ({ projectSlug, ...membersInput }: ProjectMembersQueryVariables): Promise<ProjectMembersQueryResult> => {
+		const result = await executor(TenantApi.query$.projectBySlug({
+			slug: ParameterRef.of('projectSlug'),
+		}, TenantApi.project$.members({
+			input: ParameterRef.of('membersInput'),
+		}, projectIdentityRelationFragment)), {
+			variables: {
+				projectSlug,
+				membersInput,
+			},
+		})
+
+		return result.projectBySlug?.members ?? []
+	}, [executor])
+}
diff --git a/packages/react-client-tenant/src/hooks/queries/useProjectMembershipsQuery.ts b/packages/react-client-tenant/src/hooks/queries/useProjectMembershipsQuery.ts
new file mode 100644
index 0000000000..e7066c7e77
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/queries/useProjectMembershipsQuery.ts
@@ -0,0 +1,25 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { ModelType, ParameterRef } from 'graphql-ts-client-api'
+import { TenantApiOptions, useTenantApi } from '../useTenantApi'
+import { useCallback } from 'react'
+
+const projectMembershipsFragment = TenantApi.membership$$.variables(TenantApi.variableEntry$$)
+
+export type ProjectMembershipsQueryResult = readonly ModelType<typeof projectMembershipsFragment>[]
+
+export type ProjectMembershipsQueryVariables = {
+	projectSlug: string
+	identityId: string
+}
+
+
+export const useProjectMembershipsQuery = (options: TenantApiOptions = {}) => {
+	const executor = useTenantApi(options)
+	return useCallback(async (input: ProjectMembershipsQueryVariables): Promise<ProjectMembershipsQueryResult> => {
+		const result = await executor(TenantApi.query$.projectMemberships(TenantApi.membership$$.variables(TenantApi.variableEntry$$)), {
+			variables: input,
+		})
+
+		return result.projectMemberships ?? []
+	}, [executor])
+}
diff --git a/packages/react-client-tenant/src/hooks/queries/useProjectRolesDefinitionQuery.ts b/packages/react-client-tenant/src/hooks/queries/useProjectRolesDefinitionQuery.ts
new file mode 100644
index 0000000000..4693763703
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/queries/useProjectRolesDefinitionQuery.ts
@@ -0,0 +1,34 @@
+import * as TenantApi from '@contember/graphql-client-tenant'
+import { ModelType } from 'graphql-ts-client-api'
+import { TenantApiOptions, useTenantApi } from '../useTenantApi'
+import { useCallback } from 'react'
+
+const projectRolesDefinitionFragment = TenantApi.roleDefinition$$
+	.variables(
+		TenantApi.roleVariableDefinition$$
+			.on(TenantApi.roleConditionVariableDefinition$$)
+			.on(TenantApi.roleEntityVariableDefinition$$)
+			.on(TenantApi.rolePredefinedVariableDefinition$$)
+		,
+	)
+
+export type ProjectRoleDefinition = ModelType<typeof projectRolesDefinitionFragment>
+export type ProjectRolesDefinitionQueryResult = readonly ProjectRoleDefinition[]
+
+const projectRolesDefinitionQuery = TenantApi.query$
+	.projectBySlug(
+		TenantApi
+			.project$
+			.roles(projectRolesDefinitionFragment),
+	)
+
+export interface ProjectRolesDefinitionQueryVariables {
+	slug: string
+}
+
+export const useProjectRolesDefinitionQuery = ({ headers, apiToken }: TenantApiOptions = {}) => {
+	const executor = useTenantApi()
+	return useCallback(async (variables: ProjectRolesDefinitionQueryVariables): Promise<ProjectRolesDefinitionQueryResult> => {
+		return (await executor(projectRolesDefinitionQuery, { headers, apiToken, variables })).projectBySlug?.roles ?? []
+	}, [apiToken, executor, headers])
+}
diff --git a/packages/react-identity/src/hooks/useFetchIdentity.ts b/packages/react-client-tenant/src/hooks/useFetchIdentity.ts
similarity index 93%
rename from packages/react-identity/src/hooks/useFetchIdentity.ts
rename to packages/react-client-tenant/src/hooks/useFetchIdentity.ts
index 9f89c73057..6006023b71 100644
--- a/packages/react-identity/src/hooks/useFetchIdentity.ts
+++ b/packages/react-client-tenant/src/hooks/useFetchIdentity.ts
@@ -1,12 +1,12 @@
 import { useCallback, useMemo, useState } from 'react'
 import { Identity, IdentityMethods, IdentityStateValue } from '../types'
 import { useSessionToken } from '@contember/react-client'
-import { useFetchMe } from '../internal/hooks/useFetchMe'
 import { useLogoutInternal } from '../internal/hooks/useLogoutInternal'
+import { useMeQuery } from './queries'
 
 export const useFetchIdentity = (): [{ state: IdentityStateValue, identity: Identity | undefined }, IdentityMethods] => {
 	const sessionToken = useSessionToken()
-	const fetchMe = useFetchMe()
+	const fetchMe = useMeQuery()
 
 	const [identityState, setIdentityState] = useState<ReturnType<typeof useFetchIdentity>[0]>({ state: sessionToken ? 'loading' : 'none', identity: undefined })
 
@@ -16,7 +16,7 @@ export const useFetchIdentity = (): [{ state: IdentityStateValue, identity: Iden
 	const fetch = useCallback(async () => {
 		setIdentityState({ state: 'loading', identity: undefined })
 		try {
-			const response = await fetchMe()
+			const response = await fetchMe({})
 			const person = response.person
 			const projects = response.projects
 			const permissions = response.permissions ?? { canCreateProject: false }
diff --git a/packages/react-identity/src/hooks/useLogout.ts b/packages/react-client-tenant/src/hooks/useLogout.ts
similarity index 77%
rename from packages/react-identity/src/hooks/useLogout.ts
rename to packages/react-client-tenant/src/hooks/useLogout.ts
index 1a25a69457..f27b48105b 100644
--- a/packages/react-identity/src/hooks/useLogout.ts
+++ b/packages/react-client-tenant/src/hooks/useLogout.ts
@@ -1,4 +1,4 @@
-import { useIdentityMethods } from '../internal/contexts'
+import { useIdentityMethods } from '../contexts'
 import { useLogoutInternal } from '../internal/hooks/useLogoutInternal'
 
 export const useLogout = () => {
diff --git a/packages/react-client-tenant/src/hooks/useTenantApi.ts b/packages/react-client-tenant/src/hooks/useTenantApi.ts
index a1c8f2dc50..bd2aba2249 100644
--- a/packages/react-client-tenant/src/hooks/useTenantApi.ts
+++ b/packages/react-client-tenant/src/hooks/useTenantApi.ts
@@ -1,16 +1,24 @@
-import { useTenantGraphQlClient } from '@contember/react-client'
+import { useLoginToken, useTenantGraphQlClient } from '@contember/react-client'
 import { useCallback } from 'react'
 import { Fetcher, TextWriter, util } from 'graphql-ts-client-api'
 
-export const useTenantApi = () => {
+export const LoginToken = Symbol('LoginToken')
+
+export type TenantApiOptions = {
+	readonly headers?: Record<string, string>
+	readonly apiToken?: string | typeof LoginToken
+}
+
+export const useTenantApi = ({ headers, apiToken }: TenantApiOptions = {}) => {
 	const client = useTenantGraphQlClient()
+	const loginToken = useLoginToken()
 
 	return useCallback(<TData extends object, TVariables extends object>(
 		fetcher: Fetcher<'Query' | 'Mutation', TData, TVariables>,
 		options?: {
 			readonly variables?: TVariables
 			readonly headers?: Record<string, string>
-			readonly apiToken?: string
+			readonly apiToken?: string | typeof LoginToken
 		},
 	): Promise<TData> => {
 
@@ -27,10 +35,14 @@ export const useTenantApi = () => {
 		writer.text(fetcher.toString())
 		writer.text(fetcher.toFragmentString())
 
+		const apiTokenResolved = apiToken ?? options?.apiToken
 		return client.execute(writer.toString(), {
 			variables: options?.variables,
-			headers: options?.headers,
-			apiToken: options?.apiToken,
+			headers: {
+				...headers,
+				...options?.headers,
+			},
+			apiToken: apiTokenResolved === LoginToken ? loginToken : apiTokenResolved,
 		})
-	}, [client])
+	}, [apiToken, client, headers, loginToken])
 }
diff --git a/packages/react-client-tenant/src/hooks/useTenantMutation.ts b/packages/react-client-tenant/src/hooks/useTenantMutation.ts
new file mode 100644
index 0000000000..0eefd6d73d
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/useTenantMutation.ts
@@ -0,0 +1,45 @@
+import { TenantApiOptions, useTenantApi } from './useTenantApi'
+import { useCallback, useMemo } from 'react'
+import { MutationFetcher } from '@contember/graphql-client-tenant'
+
+export type TenantMutationOkResponse<Result> = { ok: true, result: Result }
+export type TenantMutationErrorResponse<Error> = { ok: false, error: Error, developerMessage?: string }
+export type TenantMutationResponse<Result, Error> = TenantMutationOkResponse<Result> | TenantMutationErrorResponse<Error>
+
+export type TenantMutation<Result, Error> = { readonly mutation?: { readonly ok: boolean, readonly error?: { readonly code: Error, readonly developerMessage: string}, readonly result?: Result} }
+
+export const useTenantMutation = <TResult, TError extends string = never, TVariables extends object = {}>(
+	fetcher: MutationFetcher<TenantMutation<TResult, TError>, TVariables>,
+	{ headers, apiToken }: TenantApiOptions = {},
+) => {
+	const tenantApi = useTenantApi({ headers, apiToken })
+
+	return useCallback(async (variables: TVariables): Promise<TenantMutationResponse<TResult, TError>> => {
+		const result = await tenantApi(
+			fetcher,
+			{
+				variables,
+			},
+		)
+		if (!result.mutation?.ok) {
+			return {
+				ok: false,
+				error: result.mutation?.error?.code as TError,
+				developerMessage: result.mutation?.error?.developerMessage,
+			}
+		} else {
+			return { ok: true, result: result.mutation.result as TResult }
+		}
+	}, [fetcher, tenantApi])
+}
+
+
+export const createTenantMutation = <TResult, TError extends string = never, TVariables extends object = {}>(
+	fetcher: MutationFetcher<TenantMutation<TResult, TError>, TVariables>,
+	defaultOptions?: TenantApiOptions,
+) => {
+	return ({ headers, apiToken }: TenantApiOptions = {}) => useTenantMutation(fetcher, {
+		headers: useMemo(() => ({ ...defaultOptions?.headers, ...headers }), [headers]),
+		apiToken: apiToken ?? defaultOptions?.apiToken,
+	})
+}
diff --git a/packages/react-client-tenant/src/hooks/useTenantQueryLoader.ts b/packages/react-client-tenant/src/hooks/useTenantQueryLoader.ts
new file mode 100644
index 0000000000..7de3623530
--- /dev/null
+++ b/packages/react-client-tenant/src/hooks/useTenantQueryLoader.ts
@@ -0,0 +1,49 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+import { useObjectMemo } from '@contember/react-utils'
+
+export type TenantQueryLoaderState<Result> =
+	| { state: 'loading' }
+	| { state: 'error'; error: unknown }
+	| { state: 'success'; data: Result }
+	| { state: 'refreshing'; data: Result }
+
+export type TenantQueryLoaderMethods = {
+	refresh: () => void
+}
+
+export const useTenantQueryLoader = <TVariables extends object, Result>(fetcher: (variables: TVariables) => Promise<Result>, variables: TVariables): [TenantQueryLoaderState<Result>, TenantQueryLoaderMethods] => {
+	const [state, setState] = useState<TenantQueryLoaderState<Result>>({ state: 'loading' })
+	const stateRef = useRef(state)
+	stateRef.current = state
+	const variablesMemo = useObjectMemo(variables)
+
+	const reqId = useRef(0)
+
+	const triggerLoad = useCallback(async () => {
+		const currentReqId = ++reqId.current
+		try {
+			if (stateRef.current.state === 'success') {
+				setState({ state: 'refreshing', data: stateRef.current.data })
+			}
+			const data = await fetcher(variablesMemo)
+			if (reqId.current !== currentReqId) {
+				return
+			}
+			setState({ state: 'success', data })
+		} catch (e) {
+			console.error(e)
+			if (reqId.current !== currentReqId) {
+				return
+			}
+			setState({ state: 'error', error: e })
+		}
+
+	}, [fetcher, variablesMemo])
+
+
+	useEffect(() => {
+		triggerLoad()
+	}, [triggerLoad])
+
+	return [state, { refresh: triggerLoad }]
+}
diff --git a/packages/react-client-tenant/src/index.ts b/packages/react-client-tenant/src/index.ts
index a9da8fe99e..c671af5055 100644
--- a/packages/react-client-tenant/src/index.ts
+++ b/packages/react-client-tenant/src/index.ts
@@ -1,3 +1,6 @@
+export * from './components'
+export * from './contexts'
 export * from './hooks'
+export * from './types'
 
 export type { ModelType } from 'graphql-ts-client-api'
diff --git a/packages/react-client-tenant/src/internal/hooks/useHandleIDPResponse.ts b/packages/react-client-tenant/src/internal/hooks/useHandleIDPResponse.ts
new file mode 100644
index 0000000000..14f0d6420b
--- /dev/null
+++ b/packages/react-client-tenant/src/internal/hooks/useHandleIDPResponse.ts
@@ -0,0 +1,64 @@
+import { SetStateAction, useEffect, useRef } from 'react'
+import { useSetSessionToken } from '@contember/react-client'
+import { useIDPStateStore } from './useIDPStateStore'
+import { getBaseHref } from '../utils/getBaseHref'
+import { IDPStateValue } from '../../types/idp'
+import { useSignInIDPMutation } from '../../hooks'
+import { useRedirectToBacklinkCallback } from './useRedirectToBacklink'
+
+export interface UseHandleIDPResponseProps {
+	onLogin?: () => void
+	expiration?: number
+
+	setState: (state: SetStateAction<IDPStateValue>) => void
+	hasOauthResponse: boolean
+}
+
+const headers = {
+	'X-Contember-Token-Path': 'data.signInIDP.result.token',
+}
+
+const DEFAULT_LOGIN_EXPIRATION = 14 * 24 * 3600 // 14 days
+
+export const useHandleIDPResponse = ({ onLogin, expiration = DEFAULT_LOGIN_EXPIRATION, setState, hasOauthResponse }: UseHandleIDPResponseProps): void => {
+	const idpSignIn = useSignInIDPMutation({ headers })
+	const setSessionToken = useSetSessionToken()
+
+	const firstRenderRef = useRef(true)
+
+	const { get: loadIdpState } = useIDPStateStore()
+	const redirectToBackLink = useRedirectToBacklinkCallback()
+
+	useEffect(() => {
+		if (!hasOauthResponse || !firstRenderRef.current) {
+			return
+		}
+		firstRenderRef.current = false
+		;(async () => {
+			const idpState = loadIdpState()
+			if (!idpState) {
+				setState({ type: 'response_failed', error: 'INVALID_LOCAL_STATE' })
+				return
+			}
+
+			const response = await idpSignIn({
+				data: {
+					url: window.location.href,
+					redirectUrl: getBaseHref(),
+					sessionData: idpState.sessionData,
+				},
+				identityProvider: idpState.provider,
+				expiration,
+			})
+			if (!response.ok) {
+				setState({ type: 'response_failed', error: response.error || 'UNKNOWN_ERROR' })
+			} else {
+				setSessionToken(response.result.token)
+				setState({ type: 'success' })
+
+				onLogin?.()
+				redirectToBackLink()
+			}
+		})()
+	}, [idpSignIn, onLogin, setSessionToken, hasOauthResponse, loadIdpState, expiration, setState, redirectToBackLink])
+}
diff --git a/packages/react-client-tenant/src/internal/hooks/useIDPAutoInit.ts b/packages/react-client-tenant/src/internal/hooks/useIDPAutoInit.ts
new file mode 100644
index 0000000000..c51faaaf5a
--- /dev/null
+++ b/packages/react-client-tenant/src/internal/hooks/useIDPAutoInit.ts
@@ -0,0 +1,18 @@
+import { useMemo } from 'react'
+
+export const useIDPAutoInitProvider = () => {
+	return useMemo(() => {
+		const params = new URLSearchParams(window.location.search)
+		const idp = params.get('idp')
+		if (idp !== null) {
+			return idp
+		}
+		const backlink = params.get('backlink')
+
+		if (backlink !== null) {
+			const resolvedBacklink = new URL(backlink, window.location.href)
+			return resolvedBacklink.searchParams.get('idp')
+		}
+	}, [])
+}
+
diff --git a/packages/react-client-tenant/src/internal/hooks/useIDPStateStore.ts b/packages/react-client-tenant/src/internal/hooks/useIDPStateStore.ts
new file mode 100644
index 0000000000..24d3f642d0
--- /dev/null
+++ b/packages/react-client-tenant/src/internal/hooks/useIDPStateStore.ts
@@ -0,0 +1,18 @@
+import { useCallback } from 'react'
+
+export type IDPState = { provider: string, sessionData: any }
+
+export const useIDPStateStore = (): {get: () => IDPState | null, set: (state: IDPState) => void} => {
+	return {
+		get: useCallback(() => {
+			const item = sessionStorage.getItem('idp')
+			if (!item) {
+				return null
+			}
+			return JSON.parse(item)
+		}, []),
+		set: useCallback((state: IDPState) => {
+			sessionStorage.setItem('idp', JSON.stringify(state))
+		}, []),
+	}
+}
diff --git a/packages/react-client-tenant/src/internal/hooks/useInitIDPRedirect.ts b/packages/react-client-tenant/src/internal/hooks/useInitIDPRedirect.ts
new file mode 100644
index 0000000000..ece41bd840
--- /dev/null
+++ b/packages/react-client-tenant/src/internal/hooks/useInitIDPRedirect.ts
@@ -0,0 +1,48 @@
+import { SetStateAction, useCallback } from 'react'
+import { useIDPStateStore } from './useIDPStateStore'
+import { getBaseHref } from '../utils/getBaseHref'
+import { IDPInitError, IDPStateValue } from '../../types/idp'
+import { useInitSignInIDPMutation } from '../../hooks'
+import { useSaveBacklink } from './useRedirectToBacklink'
+
+export interface UseInitIDPRedirectProps {
+	onRedirect?: (url: string) => void
+	setState: (state: SetStateAction<IDPStateValue>) => void
+}
+
+export const useInitIDPRedirect = ({ onRedirect, setState }: UseInitIDPRedirectProps) => {
+	const initRequest = useInitSignInIDPMutation()
+	const saveBacklink = useSaveBacklink()
+	const { set: saveIdpState } = useIDPStateStore()
+
+	return useCallback(async ({ provider }: { provider: string }): Promise<{ ok: true } | { ok: false, error: IDPInitError }> => {
+		const fail = (error: IDPInitError) => {
+			setState({ type: 'init_failed', error })
+			return { ok: false, error }
+		}
+		try {
+			setState({ type: 'processing_init' })
+			const response = await initRequest({
+				data: {
+					redirectUrl: getBaseHref(),
+				},
+				identityProvider: provider,
+			})
+			if (!response.ok) {
+				return fail(response.error || 'UNKNOWN_ERROR')
+			} else {
+				saveIdpState({ provider, sessionData: response.result.sessionData as string })
+				saveBacklink()
+				if (onRedirect) {
+					onRedirect(response.result.authUrl as string)
+				} else {
+					window.location.href = response.result.authUrl as string
+				}
+				return { ok: true }
+			}
+		} catch (e) {
+			console.error(e)
+			return fail('UNKNOWN_ERROR')
+		}
+	}, [initRequest, onRedirect, saveBacklink, saveIdpState, setState])
+}
diff --git a/packages/react-identity/src/internal/hooks/useLogoutInternal.ts b/packages/react-client-tenant/src/internal/hooks/useLogoutInternal.ts
similarity index 87%
rename from packages/react-identity/src/internal/hooks/useLogoutInternal.ts
rename to packages/react-client-tenant/src/internal/hooks/useLogoutInternal.ts
index 54adfd4d69..c40f9ef998 100644
--- a/packages/react-identity/src/internal/hooks/useLogoutInternal.ts
+++ b/packages/react-client-tenant/src/internal/hooks/useLogoutInternal.ts
@@ -1,9 +1,9 @@
 import { useSetSessionToken } from '@contember/react-client'
 import { useCallback } from 'react'
-import { useSignOut } from './useSignOut'
+import { useSignOutMutation } from '../../hooks'
 
 export const useLogoutInternal = (clearIdentity?: () => void) => {
-	const tenantLogout = useSignOut()
+	const tenantLogout = useSignOutMutation()
 	const setSessionToken = useSetSessionToken()
 
 	return useCallback(
@@ -19,7 +19,7 @@ export const useLogoutInternal = (clearIdentity?: () => void) => {
 			clearIdentity?.()
 			setSessionToken(undefined)
 			try {
-				const response = await tenantLogout()
+				const response = await tenantLogout({})
 				if (!response?.ok) {
 					console.warn(response?.error)
 				}
diff --git a/packages/react-client-tenant/src/internal/hooks/useRedirectToBacklink.ts b/packages/react-client-tenant/src/internal/hooks/useRedirectToBacklink.ts
new file mode 100644
index 0000000000..4bf3fb8113
--- /dev/null
+++ b/packages/react-client-tenant/src/internal/hooks/useRedirectToBacklink.ts
@@ -0,0 +1,42 @@
+import { useCallback, useEffect } from 'react'
+import { useIdentity } from '../../contexts'
+
+const getBacklinkFromUrl = () => {
+	return new URLSearchParams(window.location.search).get('backlink')
+}
+
+export const useSaveBacklink = () => {
+	return useCallback(() => {
+		const backlink = getBacklinkFromUrl()
+		if (!backlink) {
+			return
+		}
+		sessionStorage.setItem('backlink', backlink)
+	}, [])
+}
+
+export const useRedirectToBacklinkCallback = () => {
+	return useCallback(() => {
+		const backlink = getBacklinkFromUrl() ?? sessionStorage.getItem('backlink')
+		if (!backlink) {
+			return
+		}
+		sessionStorage.removeItem('backlink')
+		const resolvedBacklink = new URL(backlink, window.location.href)
+		if (resolvedBacklink.origin === window.location.origin) {
+			window.location.href = resolvedBacklink.toString()
+		}
+	}, [])
+}
+
+export const useRedirectToBacklink = () => {
+	const identity = useIdentity()
+	const redirect = useRedirectToBacklinkCallback()
+	useEffect(() => {
+		if (!identity) {
+			return
+		}
+		redirect()
+	}, [identity, redirect])
+
+}
diff --git a/packages/react-client-tenant/src/internal/utils/getBaseHref.ts b/packages/react-client-tenant/src/internal/utils/getBaseHref.ts
new file mode 100644
index 0000000000..20e8542b98
--- /dev/null
+++ b/packages/react-client-tenant/src/internal/utils/getBaseHref.ts
@@ -0,0 +1,4 @@
+export const getBaseHref = () => {
+	const href = window.location.href
+	return href.includes('?') ? href.slice(0, href.indexOf('?')) : href
+}
diff --git a/packages/react-client-tenant/src/tsconfig.json b/packages/react-client-tenant/src/tsconfig.json
index 2699c1868f..00cf210eed 100644
--- a/packages/react-client-tenant/src/tsconfig.json
+++ b/packages/react-client-tenant/src/tsconfig.json
@@ -5,5 +5,6 @@
 	},
 	"references": [
 		{ "path": "../../react-client/src" },
+		{ "path": "../../react-utils/src" },
 	]
 }
diff --git a/packages/react-identity/src/types/Identity.ts b/packages/react-client-tenant/src/types/Identity.ts
similarity index 100%
rename from packages/react-identity/src/types/Identity.ts
rename to packages/react-client-tenant/src/types/Identity.ts
diff --git a/packages/react-identity/src/types/IdentityMethods.ts b/packages/react-client-tenant/src/types/IdentityMethods.ts
similarity index 100%
rename from packages/react-identity/src/types/IdentityMethods.ts
rename to packages/react-client-tenant/src/types/IdentityMethods.ts
diff --git a/packages/react-identity/src/types/IdentityStateValue.ts b/packages/react-client-tenant/src/types/IdentityStateValue.ts
similarity index 100%
rename from packages/react-identity/src/types/IdentityStateValue.ts
rename to packages/react-client-tenant/src/types/IdentityStateValue.ts
diff --git a/packages/react-client-tenant/src/types/forms.ts b/packages/react-client-tenant/src/types/forms.ts
new file mode 100644
index 0000000000..3abbf7f041
--- /dev/null
+++ b/packages/react-client-tenant/src/types/forms.ts
@@ -0,0 +1,26 @@
+import { SetStateAction } from 'react'
+
+export type FormState =
+	| 'loading'
+	| 'initial'
+	| 'submitting'
+	| 'error'
+	| 'success'
+
+type FormValueType = Record<string, unknown>;
+
+export type FormErrorCode = 'UNKNOWN_ERROR'
+
+export type FormError<V extends FormValueType, E extends string> = {
+	field?: keyof V
+	code: FormErrorCode | E
+	developerMessage?: string
+};
+
+export interface FormContextValue<V extends FormValueType, E extends string, S extends string = never> {
+	values: V
+	state: FormState | S
+	setValues: (values: SetStateAction<V>) => void
+	setValue: <F extends keyof V>(field: F, value: V[F]) => void
+	errors: FormError<V, E>[]
+}
diff --git a/packages/react-client-tenant/src/types/idp.ts b/packages/react-client-tenant/src/types/idp.ts
new file mode 100644
index 0000000000..36e216a8d2
--- /dev/null
+++ b/packages/react-client-tenant/src/types/idp.ts
@@ -0,0 +1,25 @@
+import { InitSignInIDPErrorCode, SignInIDPErrorCode } from '@contember/graphql-client-tenant'
+
+export type IDPStateValue =
+	| { type: 'nothing' }
+	| { type: 'processing_init' }
+	| { type: 'processing_response' }
+	| { type: 'success' }
+	| { type: 'init_failed', error: IDPInitError }
+	| { type: 'response_failed', error: IDPResponseError }
+
+export type IDPStateType = IDPStateValue['type']
+
+export type IDPInitError =
+	| InitSignInIDPErrorCode
+	| 'UNKNOWN_ERROR'
+
+export type IDPResponseError =
+	| SignInIDPErrorCode
+	| 'INVALID_LOCAL_STATE'
+	| 'UNKNOWN_ERROR'
+
+
+export type IDPMethods = {
+	initRedirect: (args: { provider: string }) => Promise<{ ok: true } | { ok: false, error: IDPInitError }>
+}
diff --git a/packages/react-identity/src/types/index.ts b/packages/react-client-tenant/src/types/index.ts
similarity index 68%
rename from packages/react-identity/src/types/index.ts
rename to packages/react-client-tenant/src/types/index.ts
index 38b9156d28..4bd35424eb 100644
--- a/packages/react-identity/src/types/index.ts
+++ b/packages/react-client-tenant/src/types/index.ts
@@ -1,3 +1,5 @@
+export * from './forms'
 export * from './IdentityMethods'
 export * from './IdentityStateValue'
 export * from './Identity'
+export * from './idp'
diff --git a/packages/react-identity/package.json b/packages/react-identity/package.json
index fa36e2821d..2825e35ff2 100644
--- a/packages/react-identity/package.json
+++ b/packages/react-identity/package.json
@@ -40,12 +40,9 @@
 		"directory": "packages/react-identity"
 	},
 	"dependencies": {
-		"@contember/graphql-client-tenant": "^1.3.7",
 		"@contember/react-binding": "workspace:*",
 		"@contember/react-client": "workspace:*",
-		"@contember/react-client-tenant": "workspace:*",
-		"@contember/react-utils": "workspace:*",
-		"@radix-ui/react-slot": "^1.0.2"
+		"@contember/react-client-tenant": "workspace:*"
 	},
 	"peerDependencies": {
 		"react": "^18 || ^19",
diff --git a/packages/react-identity/src/components/IdentityEnvironmentProvider.tsx b/packages/react-identity/src/components/IdentityEnvironmentProvider.tsx
new file mode 100644
index 0000000000..d0a0dbdfc7
--- /dev/null
+++ b/packages/react-identity/src/components/IdentityEnvironmentProvider.tsx
@@ -0,0 +1,19 @@
+import { ReactNode } from 'react'
+import { EnvironmentExtensionProvider } from '@contember/react-binding'
+import { identityEnvironmentExtension } from '../environment'
+import { useIdentity } from '@contember/react-client-tenant'
+
+
+export interface IdentityEnvironmentProviderProps {
+	children: ReactNode
+}
+
+export const IdentityEnvironmentProvider: React.FC<IdentityEnvironmentProviderProps> = ({ children }) => {
+	const identity = useIdentity()
+	return (
+		<EnvironmentExtensionProvider extension={identityEnvironmentExtension} state={identity ?? null}>
+			{children}
+		</EnvironmentExtensionProvider>
+
+	)
+}
diff --git a/packages/react-identity/src/components/index.ts b/packages/react-identity/src/components/index.ts
index 4c9d9cf9b5..c3576e947a 100644
--- a/packages/react-identity/src/components/index.ts
+++ b/packages/react-identity/src/components/index.ts
@@ -1,4 +1,2 @@
 export * from './HasRole'
-export * from './IdentityProvider'
-export * from './IdentityState'
-export * from './LogoutTrigger'
+export * from './IdentityEnvironmentProvider'
diff --git a/packages/react-identity/src/environment/IdentityEnvironmentExtension.ts b/packages/react-identity/src/environment/IdentityEnvironmentExtension.ts
index 550eb53de7..f3a67254c2 100644
--- a/packages/react-identity/src/environment/IdentityEnvironmentExtension.ts
+++ b/packages/react-identity/src/environment/IdentityEnvironmentExtension.ts
@@ -1,5 +1,5 @@
 import { BindingError, Environment } from '@contember/react-binding'
-import { Identity } from '../types'
+import { Identity } from '@contember/react-client-tenant'
 
 export const identityEnvironmentExtension = Environment.createExtension((state: Identity | null | undefined) => {
 	if (state === undefined) {
diff --git a/packages/react-identity/src/hooks/index.ts b/packages/react-identity/src/hooks/index.ts
index 420b18fcd7..1b6a732c99 100644
--- a/packages/react-identity/src/hooks/index.ts
+++ b/packages/react-identity/src/hooks/index.ts
@@ -1,8 +1,2 @@
-export * from './useLogout'
-export * from './useFetchIdentity'
 export * from './useProjectUserRoles'
-export {
-	useIdentityMethods,
-	useIdentity,
-	useIdentityState,
-} from '../internal/contexts'
+
diff --git a/packages/react-identity/src/hooks/useProjectUserRoles.tsx b/packages/react-identity/src/hooks/useProjectUserRoles.tsx
index 8a40055e30..e129c2e3b2 100644
--- a/packages/react-identity/src/hooks/useProjectUserRoles.tsx
+++ b/packages/react-identity/src/hooks/useProjectUserRoles.tsx
@@ -1,6 +1,6 @@
 import { useMemo } from 'react'
 import { useProjectSlug } from '@contember/react-client'
-import { useIdentity } from '../internal/contexts'
+import { useIdentity } from '@contember/react-client-tenant'
 
 export type ProjectUserRoles = Set<string>
 
diff --git a/packages/react-identity/src/index.ts b/packages/react-identity/src/index.ts
index 61a56d1484..ba0fb9b2b3 100644
--- a/packages/react-identity/src/index.ts
+++ b/packages/react-identity/src/index.ts
@@ -1,4 +1,4 @@
-export * from './types'
 export * from './components'
 export * from './hooks'
 export * from './environment'
+export * from '@contember/react-client-tenant'
diff --git a/packages/react-identity/src/internal/contexts.ts b/packages/react-identity/src/internal/contexts.ts
deleted file mode 100644
index 7c2f33368c..0000000000
--- a/packages/react-identity/src/internal/contexts.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-import { createContext, createRequiredContext } from '@contember/react-utils'
-import { IdentityMethods } from '../types/IdentityMethods'
-import { Identity } from '../types/Identity'
-import { IdentityStateValue } from '../types/IdentityStateValue'
-
-export const [IdentityContext, useIdentity] = createContext<Identity | undefined>('IdentityContext', undefined)
-export const [IdentityMethodsContext, useIdentityMethods] = createRequiredContext<IdentityMethods>('IdentityMethodsContext')
-export const [IdentityStateContext, useIdentityState] = createRequiredContext<IdentityStateValue>('IdentityStateContext')
diff --git a/packages/react-identity/src/internal/hooks/useSignOut.ts b/packages/react-identity/src/internal/hooks/useSignOut.ts
deleted file mode 100644
index e065cf82e0..0000000000
--- a/packages/react-identity/src/internal/hooks/useSignOut.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import * as TenantApi from '@contember/graphql-client-tenant'
-import { ModelType, useTenantApi } from '@contember/react-client-tenant'
-import { useCallback } from 'react'
-
-const signOutFragment = TenantApi.signOutResponse$$.error(TenantApi.signOutError$$)
-
-export type SignOutResult = ModelType<typeof signOutFragment>
-
-export const useSignOut = () => {
-	const api = useTenantApi()
-	return useCallback(async () => {
-		return (await api(TenantApi.mutation$.signOut(signOutFragment))).signOut
-	}, [api])
-}
diff --git a/packages/react-identity/src/tsconfig.json b/packages/react-identity/src/tsconfig.json
index f4bb6b6de1..f444e20f96 100644
--- a/packages/react-identity/src/tsconfig.json
+++ b/packages/react-identity/src/tsconfig.json
@@ -7,6 +7,5 @@
 		{ "path": "../../react-binding/src" },
 		{ "path": "../../react-client/src" },
 		{ "path": "../../react-client-tenant/src" },
-		{ "path": "../../react-utils/src" },
 	]
 }
diff --git a/packages/react-routing/src/RoutingProvider.tsx b/packages/react-routing/src/RoutingProvider.tsx
new file mode 100644
index 0000000000..3938bc54ec
--- /dev/null
+++ b/packages/react-routing/src/RoutingProvider.tsx
@@ -0,0 +1,19 @@
+import { RoutingContext, RoutingContextValue } from './RoutingContext'
+import { RequestProvider } from './RequestContext'
+import { ReactNode } from 'react'
+
+export type RoutingProviderProps =
+	& Partial<RoutingContextValue>
+	& {
+		children: ReactNode
+	}
+
+export const RoutingProvider = ({ children, ...props }: RoutingProviderProps) => {
+	return (
+		<RoutingContext.Provider value={{ routes: {}, basePath: '/', ...props }}>
+			<RequestProvider>
+				{children}
+			</RequestProvider>
+		</RoutingContext.Provider>
+	)
+}
diff --git a/packages/react-routing/src/index.ts b/packages/react-routing/src/index.ts
index e1fa8e67e1..d6d02b450e 100644
--- a/packages/react-routing/src/index.ts
+++ b/packages/react-routing/src/index.ts
@@ -10,3 +10,4 @@ export * from './useRoutingLink'
 export * from './RoutingParameter'
 export * from './Pages'
 export * from './Page'
+export * from './RoutingProvider'
diff --git a/yarn.lock b/yarn.lock
index 8b22d809bd..de88988bfd 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -826,7 +826,11 @@ __metadata:
   version: 0.0.0-use.local
   resolution: "@contember/react-client-tenant@workspace:packages/react-client-tenant"
   dependencies:
+    "@contember/graphql-client-tenant": ^1.3.7
     "@contember/react-client": "workspace:*"
+    "@contember/react-utils": "workspace:*"
+    "@radix-ui/primitive": ^1.0.1
+    "@radix-ui/react-slot": ^1.0.2
     graphql-ts-client-api: ^3.1.17
     react: ^18.3.1
     react-dom: ^18.3.1
@@ -978,12 +982,9 @@ __metadata:
   version: 0.0.0-use.local
   resolution: "@contember/react-identity@workspace:packages/react-identity"
   dependencies:
-    "@contember/graphql-client-tenant": ^1.3.7
     "@contember/react-binding": "workspace:*"
     "@contember/react-client": "workspace:*"
     "@contember/react-client-tenant": "workspace:*"
-    "@contember/react-utils": "workspace:*"
-    "@radix-ui/react-slot": ^1.0.2
     react: ^18.3.1
     react-dom: ^18.3.1
   peerDependencies:
@@ -2244,7 +2245,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@radix-ui/primitive@npm:1.0.1":
+"@radix-ui/primitive@npm:1.0.1, @radix-ui/primitive@npm:^1.0.1":
   version: 1.0.1
   resolution: "@radix-ui/primitive@npm:1.0.1"
   dependencies: