diff --git a/authentik/core/api/propertymappings.py b/authentik/core/api/propertymappings.py
index 1e7436be9..d0fa7267b 100644
--- a/authentik/core/api/propertymappings.py
+++ b/authentik/core/api/propertymappings.py
@@ -19,6 +19,7 @@ from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, PassiveSerializer, TypeCreateSerializer
 from authentik.core.expression.evaluator import PropertyMappingEvaluator
 from authentik.core.models import PropertyMapping
+from authentik.enterprise.apps import EnterpriseConfig
 from authentik.events.utils import sanitize_item
 from authentik.lib.utils.reflection import all_subclasses
 from authentik.policies.api.exec import PolicyTestSerializer
@@ -95,6 +96,7 @@ class PropertyMappingViewSet(
                     "description": subclass.__doc__,
                     "component": subclass().component,
                     "model_name": subclass._meta.model_name,
+                    "requires_enterprise": isinstance(subclass._meta.app_config, EnterpriseConfig),
                 }
             )
         return Response(TypeCreateSerializer(data, many=True).data)
diff --git a/authentik/core/api/providers.py b/authentik/core/api/providers.py
index a5095dcde..6c0f4db06 100644
--- a/authentik/core/api/providers.py
+++ b/authentik/core/api/providers.py
@@ -16,6 +16,7 @@ from rest_framework.viewsets import GenericViewSet
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
 from authentik.core.models import Provider
+from authentik.enterprise.apps import EnterpriseConfig
 from authentik.lib.utils.reflection import all_subclasses
 
 
@@ -113,6 +114,7 @@ class ProviderViewSet(
                     "description": subclass.__doc__,
                     "component": subclass().component,
                     "model_name": subclass._meta.model_name,
+                    "requires_enterprise": isinstance(subclass._meta.app_config, EnterpriseConfig),
                 }
             )
         data.append(
diff --git a/authentik/core/api/utils.py b/authentik/core/api/utils.py
index c7a188f5c..c79fec22e 100644
--- a/authentik/core/api/utils.py
+++ b/authentik/core/api/utils.py
@@ -5,7 +5,7 @@ from django.db.models import Model
 from drf_spectacular.extensions import OpenApiSerializerFieldExtension
 from drf_spectacular.plumbing import build_basic_type
 from drf_spectacular.types import OpenApiTypes
-from rest_framework.fields import CharField, IntegerField, JSONField
+from rest_framework.fields import BooleanField, CharField, IntegerField, JSONField
 from rest_framework.serializers import Serializer, SerializerMethodField, ValidationError
 
 
@@ -74,6 +74,7 @@ class TypeCreateSerializer(PassiveSerializer):
     description = CharField(required=True)
     component = CharField(required=True)
     model_name = CharField(required=True)
+    requires_enterprise = BooleanField(default=False)
 
 
 class CacheSerializer(PassiveSerializer):
diff --git a/authentik/enterprise/api.py b/authentik/enterprise/api.py
index fdf0a11fc..c13e34b6d 100644
--- a/authentik/enterprise/api.py
+++ b/authentik/enterprise/api.py
@@ -2,9 +2,11 @@
 from datetime import datetime, timedelta
 
 from django.utils.timezone import now
+from django.utils.translation import gettext as _
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import extend_schema, inline_serializer
 from rest_framework.decorators import action
+from rest_framework.exceptions import ValidationError
 from rest_framework.fields import BooleanField, CharField, DateTimeField, IntegerField
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.request import Request
@@ -20,6 +22,18 @@ from authentik.enterprise.models import License, LicenseKey
 from authentik.root.install_id import get_install_id
 
 
+class EnterpriseRequiredMixin:
+    """Mixin to validate that a valid enterprise license
+    exists before allowing to safe the object"""
+
+    def validate(self, attrs: dict) -> dict:
+        """Check that a valid license exists"""
+        total = LicenseKey.get_total()
+        if not total.is_valid():
+            raise ValidationError(_("Enterprise is required to create/update this object."))
+        return super().validate(attrs)
+
+
 class LicenseSerializer(ModelSerializer):
     """License Serializer"""
 
diff --git a/authentik/enterprise/apps.py b/authentik/enterprise/apps.py
index 2d918da17..a0b9bed6d 100644
--- a/authentik/enterprise/apps.py
+++ b/authentik/enterprise/apps.py
@@ -2,7 +2,11 @@
 from authentik.blueprints.apps import ManagedAppConfig
 
 
-class AuthentikEnterpriseConfig(ManagedAppConfig):
+class EnterpriseConfig(ManagedAppConfig):
+    """Base app config for all enterprise apps"""
+
+
+class AuthentikEnterpriseConfig(EnterpriseConfig):
     """Enterprise app config"""
 
     name = "authentik.enterprise"
diff --git a/authentik/enterprise/providers/rac/api/endpoints.py b/authentik/enterprise/providers/rac/api/endpoints.py
index b0b0239c5..1af281ef8 100644
--- a/authentik/enterprise/providers/rac/api/endpoints.py
+++ b/authentik/enterprise/providers/rac/api/endpoints.py
@@ -15,6 +15,7 @@ from structlog.stdlib import get_logger
 
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.models import Provider
+from authentik.enterprise.api import EnterpriseRequiredMixin
 from authentik.enterprise.providers.rac.api.providers import RACProviderSerializer
 from authentik.enterprise.providers.rac.models import Endpoint
 from authentik.policies.engine import PolicyEngine
@@ -28,7 +29,7 @@ def user_endpoint_cache_key(user_pk: str) -> str:
     return f"goauthentik.io/providers/rac/endpoint_access/{user_pk}"
 
 
-class EndpointSerializer(ModelSerializer):
+class EndpointSerializer(EnterpriseRequiredMixin, ModelSerializer):
     """Endpoint Serializer"""
 
     provider_obj = RACProviderSerializer(source="provider", read_only=True)
@@ -59,6 +60,7 @@ class EndpointSerializer(ModelSerializer):
             "property_mappings",
             "auth_mode",
             "launch_url",
+            "maximum_connections",
         ]
 
 
diff --git a/authentik/enterprise/providers/rac/api/property_mappings.py b/authentik/enterprise/providers/rac/api/property_mappings.py
index 35daec95c..4afef68bb 100644
--- a/authentik/enterprise/providers/rac/api/property_mappings.py
+++ b/authentik/enterprise/providers/rac/api/property_mappings.py
@@ -5,10 +5,11 @@ from rest_framework.viewsets import ModelViewSet
 from authentik.core.api.propertymappings import PropertyMappingSerializer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import JSONDictField
+from authentik.enterprise.api import EnterpriseRequiredMixin
 from authentik.enterprise.providers.rac.models import RACPropertyMapping
 
 
-class RACPropertyMappingSerializer(PropertyMappingSerializer):
+class RACPropertyMappingSerializer(EnterpriseRequiredMixin, PropertyMappingSerializer):
     """RACPropertyMapping Serializer"""
 
     static_settings = JSONDictField()
diff --git a/authentik/enterprise/providers/rac/api/providers.py b/authentik/enterprise/providers/rac/api/providers.py
index 6dd4f9f82..cda6c2af3 100644
--- a/authentik/enterprise/providers/rac/api/providers.py
+++ b/authentik/enterprise/providers/rac/api/providers.py
@@ -4,10 +4,11 @@ from rest_framework.viewsets import ModelViewSet
 
 from authentik.core.api.providers import ProviderSerializer
 from authentik.core.api.used_by import UsedByMixin
+from authentik.enterprise.api import EnterpriseRequiredMixin
 from authentik.enterprise.providers.rac.models import RACProvider
 
 
-class RACProviderSerializer(ProviderSerializer):
+class RACProviderSerializer(EnterpriseRequiredMixin, ProviderSerializer):
     """RACProvider Serializer"""
 
     outpost_set = ListField(child=CharField(), read_only=True, source="outpost_set.all")
diff --git a/authentik/enterprise/providers/rac/apps.py b/authentik/enterprise/providers/rac/apps.py
index 973159bb9..13930faae 100644
--- a/authentik/enterprise/providers/rac/apps.py
+++ b/authentik/enterprise/providers/rac/apps.py
@@ -1,8 +1,8 @@
 """RAC app config"""
-from authentik.blueprints.apps import ManagedAppConfig
+from authentik.enterprise.apps import EnterpriseConfig
 
 
-class AuthentikEnterpriseProviderRAC(ManagedAppConfig):
+class AuthentikEnterpriseProviderRAC(EnterpriseConfig):
     """authentik enterprise rac app config"""
 
     name = "authentik.enterprise.providers.rac"
diff --git a/authentik/enterprise/providers/rac/migrations/0002_endpoint_maximum_connections.py b/authentik/enterprise/providers/rac/migrations/0002_endpoint_maximum_connections.py
new file mode 100644
index 000000000..0760f2313
--- /dev/null
+++ b/authentik/enterprise/providers/rac/migrations/0002_endpoint_maximum_connections.py
@@ -0,0 +1,17 @@
+# Generated by Django 5.0 on 2024-01-03 23:44
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("authentik_providers_rac", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="endpoint",
+            name="maximum_connections",
+            field=models.IntegerField(default=1),
+        ),
+    ]
diff --git a/authentik/enterprise/providers/rac/models.py b/authentik/enterprise/providers/rac/models.py
index d79bbd54c..927bd23fe 100644
--- a/authentik/enterprise/providers/rac/models.py
+++ b/authentik/enterprise/providers/rac/models.py
@@ -35,7 +35,7 @@ class AuthenticationMode(models.TextChoices):
 
 
 class RACProvider(Provider):
-    """Remotely access computers/servers"""
+    """Remotely access computers/servers via RDP/SSH/VNC."""
 
     settings = models.JSONField(default=dict)
     auth_mode = models.TextField(
@@ -81,6 +81,7 @@ class Endpoint(SerializerModel, PolicyBindingModel):
     settings = models.JSONField(default=dict)
     auth_mode = models.TextField(choices=AuthenticationMode.choices)
     provider = models.ForeignKey("RACProvider", on_delete=models.CASCADE)
+    maximum_connections = models.IntegerField(default=1)
 
     property_mappings = models.ManyToManyField(
         "authentik_core.PropertyMapping", default=None, blank=True
diff --git a/authentik/enterprise/providers/rac/tests/test_endpoints_api.py b/authentik/enterprise/providers/rac/tests/test_endpoints_api.py
index 0a659bccd..3000b345c 100644
--- a/authentik/enterprise/providers/rac/tests/test_endpoints_api.py
+++ b/authentik/enterprise/providers/rac/tests/test_endpoints_api.py
@@ -81,6 +81,7 @@ class TestEndpointsAPI(APITestCase):
                         },
                         "protocol": "rdp",
                         "host": self.allowed.host,
+                        "maximum_connections": 1,
                         "settings": {},
                         "property_mappings": [],
                         "auth_mode": "",
@@ -131,6 +132,7 @@ class TestEndpointsAPI(APITestCase):
                         },
                         "protocol": "rdp",
                         "host": self.allowed.host,
+                        "maximum_connections": 1,
                         "settings": {},
                         "property_mappings": [],
                         "auth_mode": "",
@@ -158,6 +160,7 @@ class TestEndpointsAPI(APITestCase):
                         },
                         "protocol": "rdp",
                         "host": self.denied.host,
+                        "maximum_connections": 1,
                         "settings": {},
                         "property_mappings": [],
                         "auth_mode": "",
diff --git a/authentik/enterprise/providers/rac/views.py b/authentik/enterprise/providers/rac/views.py
index 31a25c721..4b93aee76 100644
--- a/authentik/enterprise/providers/rac/views.py
+++ b/authentik/enterprise/providers/rac/views.py
@@ -5,11 +5,13 @@ from django.http import Http404, HttpRequest, HttpResponse
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse
 from django.utils.timezone import now
+from django.utils.translation import gettext as _
 
 from authentik.core.models import Application, AuthenticatedSession
 from authentik.core.views.interface import InterfaceView
 from authentik.enterprise.policy import EnterprisePolicyAccessView
 from authentik.enterprise.providers.rac.models import ConnectionToken, Endpoint, RACProvider
+from authentik.events.models import Event, EventAction
 from authentik.flows.challenge import RedirectChallenge
 from authentik.flows.exceptions import FlowNonApplicableException
 from authentik.flows.models import in_memory_stage
@@ -43,6 +45,7 @@ class RACStartView(EnterprisePolicyAccessView):
         plan.insert_stage(
             in_memory_stage(
                 RACFinalStage,
+                application=self.application,
                 endpoint=self.endpoint,
                 provider=self.provider,
             )
@@ -77,29 +80,51 @@ class RACInterface(InterfaceView):
 class RACFinalStage(RedirectStage):
     """RAC Connection final stage, set the connection token in the stage"""
 
+    endpoint: Endpoint
+    provider: RACProvider
+    application: Application
+
     def dispatch(self, request: HttpRequest, *args: Any, **kwargs: Any) -> HttpResponse:
-        endpoint: Endpoint = self.executor.current_stage.endpoint
-        engine = PolicyEngine(endpoint, self.request.user, self.request)
+        self.endpoint = self.executor.current_stage.endpoint
+        self.provider = self.executor.current_stage.provider
+        self.application = self.executor.current_stage.application
+        # Check policies bound to endpoint directly
+        engine = PolicyEngine(self.endpoint, self.request.user, self.request)
         engine.use_cache = False
         engine.build()
         passing = engine.result
         if not passing.passing:
             return self.executor.stage_invalid(", ".join(passing.messages))
+        # Check if we're already at the maximum connection limit
+        all_tokens = ConnectionToken.filter_not_expired(
+            endpoint=self.endpoint,
+        ).exclude(endpoint__maximum_connections__lte=-1)
+        if all_tokens.count() >= self.endpoint.maximum_connections:
+            msg = [_("Maximum connection limit reached.")]
+            # Check if any other tokens exist for the current user, and inform them
+            # they are already connected
+            if all_tokens.filter(session__user=self.request.user).exists():
+                msg.append(_("(You are already connected in another tab/window)"))
+            return self.executor.stage_invalid(" ".join(msg))
         return super().dispatch(request, *args, **kwargs)
 
     def get_challenge(self, *args, **kwargs) -> RedirectChallenge:
-        endpoint: Endpoint = self.executor.current_stage.endpoint
-        provider: RACProvider = self.executor.current_stage.provider
         token = ConnectionToken.objects.create(
-            provider=provider,
-            endpoint=endpoint,
+            provider=self.provider,
+            endpoint=self.endpoint,
             settings=self.executor.plan.context.get("connection_settings", {}),
             session=AuthenticatedSession.objects.filter(
                 session_key=self.request.session.session_key
             ).first(),
-            expires=now() + timedelta_from_string(provider.connection_expiry),
+            expires=now() + timedelta_from_string(self.provider.connection_expiry),
             expiring=True,
         )
+        Event.new(
+            EventAction.AUTHORIZE_APPLICATION,
+            authorized_application=self.application,
+            flow=self.executor.plan.flow_pk,
+            endpoint=self.endpoint.name,
+        ).from_http(self.request)
         setattr(
             self.executor.current_stage,
             "destination",
diff --git a/authentik/events/middleware.py b/authentik/events/middleware.py
index 7834bae5e..ea7e6001f 100644
--- a/authentik/events/middleware.py
+++ b/authentik/events/middleware.py
@@ -20,6 +20,7 @@ from authentik.core.models import (
     User,
     UserSourceConnection,
 )
+from authentik.enterprise.providers.rac.models import ConnectionToken
 from authentik.events.models import Event, EventAction, Notification
 from authentik.events.utils import model_to_dict
 from authentik.flows.models import FlowToken, Stage
@@ -54,6 +55,7 @@ IGNORED_MODELS = (
     SCIMUser,
     SCIMGroup,
     Reputation,
+    ConnectionToken,
 )
 
 
diff --git a/authentik/providers/oauth2/constants.py b/authentik/providers/oauth2/constants.py
index 81460b707..baaebbd60 100644
--- a/authentik/providers/oauth2/constants.py
+++ b/authentik/providers/oauth2/constants.py
@@ -7,8 +7,8 @@ GRANT_TYPE_CLIENT_CREDENTIALS = "client_credentials"
 GRANT_TYPE_PASSWORD = "password"  # nosec
 GRANT_TYPE_DEVICE_CODE = "urn:ietf:params:oauth:grant-type:device_code"
 
-CLIENT_ASSERTION_TYPE = "client_assertion_type"
 CLIENT_ASSERTION = "client_assertion"
+CLIENT_ASSERTION_TYPE = "client_assertion_type"
 CLIENT_ASSERTION_TYPE_JWT = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
 
 PROMPT_NONE = "none"
@@ -18,9 +18,9 @@ PROMPT_LOGIN = "login"
 SCOPE_OPENID = "openid"
 SCOPE_OPENID_PROFILE = "profile"
 SCOPE_OPENID_EMAIL = "email"
+SCOPE_OFFLINE_ACCESS = "offline_access"
 
-# https://www.iana.org/assignments/oauth-parameters/\
-#   oauth-parameters.xhtml#pkce-code-challenge-method
+# https://www.iana.org/assignments/oauth-parameters/auth-parameters.xhtml#pkce-code-challenge-method
 PKCE_METHOD_PLAIN = "plain"
 PKCE_METHOD_S256 = "S256"
 
@@ -36,6 +36,12 @@ SCOPE_GITHUB_USER_READ = "read:user"
 SCOPE_GITHUB_USER_EMAIL = "user:email"
 # Read info about teams
 SCOPE_GITHUB_ORG_READ = "read:org"
+SCOPE_GITHUB = {
+    SCOPE_GITHUB_USER,
+    SCOPE_GITHUB_USER_READ,
+    SCOPE_GITHUB_USER_EMAIL,
+    SCOPE_GITHUB_ORG_READ,
+}
 
 ACR_AUTHENTIK_DEFAULT = "goauthentik.io/providers/oauth2/default"
 
diff --git a/authentik/providers/oauth2/errors.py b/authentik/providers/oauth2/errors.py
index 1788c9370..fd124cb91 100644
--- a/authentik/providers/oauth2/errors.py
+++ b/authentik/providers/oauth2/errors.py
@@ -127,7 +127,7 @@ class AuthorizeError(OAuth2Error):
         "account_selection_required": (
             "The End-User is required to select a session at the Authorization Server"
         ),
-        "consent_required": "The Authorization Server requires End-Userconsent",
+        "consent_required": "The Authorization Server requires End-User consent",
         "invalid_request_uri": (
             "The request_uri in the Authorization Request returns an error or contains invalid data"
         ),
diff --git a/authentik/providers/oauth2/tests/test_authorize.py b/authentik/providers/oauth2/tests/test_authorize.py
index 91cdc330a..7903c685c 100644
--- a/authentik/providers/oauth2/tests/test_authorize.py
+++ b/authentik/providers/oauth2/tests/test_authorize.py
@@ -5,6 +5,7 @@ from django.test import RequestFactory
 from django.urls import reverse
 from django.utils.timezone import now
 
+from authentik.blueprints.tests import apply_blueprint
 from authentik.core.models import Application
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow
 from authentik.events.models import Event, EventAction
@@ -18,6 +19,7 @@ from authentik.providers.oauth2.models import (
     AuthorizationCode,
     GrantTypes,
     OAuth2Provider,
+    ScopeMapping,
 )
 from authentik.providers.oauth2.tests.utils import OAuthTestCase
 from authentik.providers.oauth2.views.authorize import OAuthAuthorizationParams
@@ -172,14 +174,24 @@ class TestAuthorize(OAuthTestCase):
         )
         OAuthAuthorizationParams.from_request(request)
 
+    @apply_blueprint("system/providers-oauth2.yaml")
     def test_response_type(self):
         """test response_type"""
-        OAuth2Provider.objects.create(
+        provider = OAuth2Provider.objects.create(
             name=generate_id(),
             client_id="test",
             authorization_flow=create_test_flow(),
             redirect_uris="http://local.invalid/Foo",
         )
+        provider.property_mappings.set(
+            ScopeMapping.objects.filter(
+                managed__in=[
+                    "goauthentik.io/providers/oauth2/scope-openid",
+                    "goauthentik.io/providers/oauth2/scope-email",
+                    "goauthentik.io/providers/oauth2/scope-profile",
+                ]
+            )
+        )
         request = self.factory.get(
             "/",
             data={
@@ -292,6 +304,7 @@ class TestAuthorize(OAuthTestCase):
             delta=5,
         )
 
+    @apply_blueprint("system/providers-oauth2.yaml")
     def test_full_implicit(self):
         """Test full authorization"""
         flow = create_test_flow()
@@ -302,6 +315,15 @@ class TestAuthorize(OAuthTestCase):
             redirect_uris="http://localhost",
             signing_key=self.keypair,
         )
+        provider.property_mappings.set(
+            ScopeMapping.objects.filter(
+                managed__in=[
+                    "goauthentik.io/providers/oauth2/scope-openid",
+                    "goauthentik.io/providers/oauth2/scope-email",
+                    "goauthentik.io/providers/oauth2/scope-profile",
+                ]
+            )
+        )
         Application.objects.create(name="app", slug="app", provider=provider)
         state = generate_id()
         user = create_test_admin_user()
@@ -409,6 +431,7 @@ class TestAuthorize(OAuthTestCase):
                 delta=5,
             )
 
+    @apply_blueprint("system/providers-oauth2.yaml")
     def test_full_form_post_id_token(self):
         """Test full authorization (form_post response)"""
         flow = create_test_flow()
@@ -419,6 +442,15 @@ class TestAuthorize(OAuthTestCase):
             redirect_uris="http://localhost",
             signing_key=self.keypair,
         )
+        provider.property_mappings.set(
+            ScopeMapping.objects.filter(
+                managed__in=[
+                    "goauthentik.io/providers/oauth2/scope-openid",
+                    "goauthentik.io/providers/oauth2/scope-email",
+                    "goauthentik.io/providers/oauth2/scope-profile",
+                ]
+            )
+        )
         app = Application.objects.create(name=generate_id(), slug=generate_id(), provider=provider)
         state = generate_id()
         user = create_test_admin_user()
@@ -440,6 +472,7 @@ class TestAuthorize(OAuthTestCase):
             reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
         )
         token: AccessToken = AccessToken.objects.filter(user=user).first()
+        self.assertIsNotNone(token)
         self.assertJSONEqual(
             response.content.decode(),
             {
diff --git a/authentik/providers/oauth2/tests/test_token.py b/authentik/providers/oauth2/tests/test_token.py
index 79b3b13fe..5904d38be 100644
--- a/authentik/providers/oauth2/tests/test_token.py
+++ b/authentik/providers/oauth2/tests/test_token.py
@@ -6,6 +6,7 @@ from django.test import RequestFactory
 from django.urls import reverse
 from django.utils import timezone
 
+from authentik.blueprints.tests import apply_blueprint
 from authentik.core.models import Application
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow
 from authentik.events.models import Event, EventAction
@@ -21,6 +22,7 @@ from authentik.providers.oauth2.models import (
     AuthorizationCode,
     OAuth2Provider,
     RefreshToken,
+    ScopeMapping,
 )
 from authentik.providers.oauth2.tests.utils import OAuthTestCase
 from authentik.providers.oauth2.views.token import TokenParams
@@ -136,21 +138,20 @@ class TestToken(OAuthTestCase):
             HTTP_AUTHORIZATION=f"Basic {header}",
         )
         access: AccessToken = AccessToken.objects.filter(user=user, provider=provider).first()
-        refresh: RefreshToken = RefreshToken.objects.filter(user=user, provider=provider).first()
         self.assertJSONEqual(
             response.content.decode(),
             {
                 "access_token": access.token,
-                "refresh_token": refresh.token,
                 "token_type": TOKEN_TYPE,
                 "expires_in": 3600,
                 "id_token": provider.encode(
-                    refresh.id_token.to_dict(),
+                    access.id_token.to_dict(),
                 ),
             },
         )
         self.validate_jwt(access, provider)
 
+    @apply_blueprint("system/providers-oauth2.yaml")
     def test_refresh_token_view(self):
         """test request param"""
         provider = OAuth2Provider.objects.create(
@@ -159,6 +160,16 @@ class TestToken(OAuthTestCase):
             redirect_uris="http://local.invalid",
             signing_key=self.keypair,
         )
+        provider.property_mappings.set(
+            ScopeMapping.objects.filter(
+                managed__in=[
+                    "goauthentik.io/providers/oauth2/scope-openid",
+                    "goauthentik.io/providers/oauth2/scope-email",
+                    "goauthentik.io/providers/oauth2/scope-profile",
+                    "goauthentik.io/providers/oauth2/scope-offline_access",
+                ]
+            )
+        )
         # Needs to be assigned to an application for iss to be set
         self.app.provider = provider
         self.app.save()
@@ -170,6 +181,7 @@ class TestToken(OAuthTestCase):
             token=generate_id(),
             _id_token=dumps({}),
             auth_time=timezone.now(),
+            _scope="offline_access",
         )
         response = self.client.post(
             reverse("authentik_providers_oauth2:token"),
@@ -201,6 +213,7 @@ class TestToken(OAuthTestCase):
         )
         self.validate_jwt(access, provider)
 
+    @apply_blueprint("system/providers-oauth2.yaml")
     def test_refresh_token_view_invalid_origin(self):
         """test request param"""
         provider = OAuth2Provider.objects.create(
@@ -209,6 +222,16 @@ class TestToken(OAuthTestCase):
             redirect_uris="http://local.invalid",
             signing_key=self.keypair,
         )
+        provider.property_mappings.set(
+            ScopeMapping.objects.filter(
+                managed__in=[
+                    "goauthentik.io/providers/oauth2/scope-openid",
+                    "goauthentik.io/providers/oauth2/scope-email",
+                    "goauthentik.io/providers/oauth2/scope-profile",
+                    "goauthentik.io/providers/oauth2/scope-offline_access",
+                ]
+            )
+        )
         header = b64encode(f"{provider.client_id}:{provider.client_secret}".encode()).decode()
         user = create_test_admin_user()
         token: RefreshToken = RefreshToken.objects.create(
@@ -217,6 +240,7 @@ class TestToken(OAuthTestCase):
             token=generate_id(),
             _id_token=dumps({}),
             auth_time=timezone.now(),
+            _scope="offline_access",
         )
         response = self.client.post(
             reverse("authentik_providers_oauth2:token"),
@@ -247,6 +271,7 @@ class TestToken(OAuthTestCase):
             },
         )
 
+    @apply_blueprint("system/providers-oauth2.yaml")
     def test_refresh_token_revoke(self):
         """test request param"""
         provider = OAuth2Provider.objects.create(
@@ -255,6 +280,16 @@ class TestToken(OAuthTestCase):
             redirect_uris="http://testserver",
             signing_key=self.keypair,
         )
+        provider.property_mappings.set(
+            ScopeMapping.objects.filter(
+                managed__in=[
+                    "goauthentik.io/providers/oauth2/scope-openid",
+                    "goauthentik.io/providers/oauth2/scope-email",
+                    "goauthentik.io/providers/oauth2/scope-profile",
+                    "goauthentik.io/providers/oauth2/scope-offline_access",
+                ]
+            )
+        )
         # Needs to be assigned to an application for iss to be set
         self.app.provider = provider
         self.app.save()
@@ -266,6 +301,7 @@ class TestToken(OAuthTestCase):
             token=generate_id(),
             _id_token=dumps({}),
             auth_time=timezone.now(),
+            _scope="offline_access",
         )
         # Create initial refresh token
         response = self.client.post(
diff --git a/authentik/providers/oauth2/urls_root.py b/authentik/providers/oauth2/urls_root.py
index b00a90de4..9f7fe05ac 100644
--- a/authentik/providers/oauth2/urls_root.py
+++ b/authentik/providers/oauth2/urls_root.py
@@ -10,7 +10,7 @@ from authentik.providers.oauth2.views.token import TokenView
 github_urlpatterns = [
     path(
         "login/oauth/authorize",
-        AuthorizationFlowInitView.as_view(),
+        AuthorizationFlowInitView.as_view(github_compat=True),
         name="github-authorize",
     ),
     path(
diff --git a/authentik/providers/oauth2/views/authorize.py b/authentik/providers/oauth2/views/authorize.py
index 520f02d65..7ad76a642 100644
--- a/authentik/providers/oauth2/views/authorize.py
+++ b/authentik/providers/oauth2/views/authorize.py
@@ -1,5 +1,5 @@
 """authentik OAuth2 Authorization views"""
-from dataclasses import dataclass, field
+from dataclasses import InitVar, dataclass, field
 from datetime import timedelta
 from hashlib import sha256
 from json import dumps
@@ -41,6 +41,8 @@ from authentik.providers.oauth2.constants import (
     PROMPT_CONSENT,
     PROMPT_LOGIN,
     PROMPT_NONE,
+    SCOPE_GITHUB,
+    SCOPE_OFFLINE_ACCESS,
     SCOPE_OPENID,
     TOKEN_TYPE,
 )
@@ -66,7 +68,6 @@ from authentik.stages.consent.models import ConsentMode, ConsentStage
 from authentik.stages.consent.stage import (
     PLAN_CONTEXT_CONSENT_HEADER,
     PLAN_CONTEXT_CONSENT_PERMISSIONS,
-    ConsentStageView,
 )
 
 LOGGER = get_logger()
@@ -86,7 +87,7 @@ class OAuthAuthorizationParams:
     redirect_uri: str
     response_type: str
     response_mode: Optional[str]
-    scope: list[str]
+    scope: set[str]
     state: str
     nonce: Optional[str]
     prompt: set[str]
@@ -101,8 +102,10 @@ class OAuthAuthorizationParams:
     code_challenge: Optional[str] = None
     code_challenge_method: Optional[str] = None
 
+    github_compat: InitVar[bool] = False
+
     @staticmethod
-    def from_request(request: HttpRequest) -> "OAuthAuthorizationParams":
+    def from_request(request: HttpRequest, github_compat=False) -> "OAuthAuthorizationParams":
         """
         Get all the params used by the Authorization Code Flow
         (and also for the Implicit and Hybrid).
@@ -154,7 +157,7 @@ class OAuthAuthorizationParams:
             response_type=response_type,
             response_mode=response_mode,
             grant_type=grant_type,
-            scope=query_dict.get("scope", "").split(),
+            scope=set(query_dict.get("scope", "").split()),
             state=state,
             nonce=query_dict.get("nonce"),
             prompt=ALLOWED_PROMPT_PARAMS.intersection(set(query_dict.get("prompt", "").split())),
@@ -162,9 +165,10 @@ class OAuthAuthorizationParams:
             max_age=int(max_age) if max_age else None,
             code_challenge=query_dict.get("code_challenge"),
             code_challenge_method=query_dict.get("code_challenge_method", "plain"),
+            github_compat=github_compat,
         )
 
-    def __post_init__(self):
+    def __post_init__(self, github_compat=False):
         self.provider: OAuth2Provider = OAuth2Provider.objects.filter(
             client_id=self.client_id
         ).first()
@@ -172,7 +176,7 @@ class OAuthAuthorizationParams:
             LOGGER.warning("Invalid client identifier", client_id=self.client_id)
             raise ClientIdError(client_id=self.client_id)
         self.check_redirect_uri()
-        self.check_scope()
+        self.check_scope(github_compat)
         self.check_nonce()
         self.check_code_challenge()
 
@@ -199,8 +203,8 @@ class OAuthAuthorizationParams:
             if not any(fullmatch(x, self.redirect_uri) for x in allowed_redirect_urls):
                 LOGGER.warning(
                     "Invalid redirect uri (regex comparison)",
-                    redirect_uri=self.redirect_uri,
-                    expected=allowed_redirect_urls,
+                    redirect_uri_given=self.redirect_uri,
+                    redirect_uri_expected=allowed_redirect_urls,
                 )
                 raise RedirectUriError(self.redirect_uri, allowed_redirect_urls)
         except RegexError as exc:
@@ -208,8 +212,8 @@ class OAuthAuthorizationParams:
             if not any(x == self.redirect_uri for x in allowed_redirect_urls):
                 LOGGER.warning(
                     "Invalid redirect uri (strict comparison)",
-                    redirect_uri=self.redirect_uri,
-                    expected=allowed_redirect_urls,
+                    redirect_uri_given=self.redirect_uri,
+                    redirect_uri_expected=allowed_redirect_urls,
                 )
                 raise RedirectUriError(self.redirect_uri, allowed_redirect_urls)
         if self.request:
@@ -217,24 +221,50 @@ class OAuthAuthorizationParams:
                 self.redirect_uri, "request_not_supported", self.grant_type, self.state
             )
 
-    def check_scope(self):
+    def check_scope(self, github_compat=False):
         """Ensure openid scope is set in Hybrid flows, or when requesting an id_token"""
-        if len(self.scope) == 0:
-            default_scope_names = set(
-                ScopeMapping.objects.filter(provider__in=[self.provider]).values_list(
-                    "scope_name", flat=True
-                )
+        default_scope_names = set(
+            ScopeMapping.objects.filter(provider__in=[self.provider]).values_list(
+                "scope_name", flat=True
             )
+        )
+        if len(self.scope) == 0:
             self.scope = default_scope_names
             LOGGER.info(
                 "No scopes requested, defaulting to all configured scopes", scopes=self.scope
             )
+        scopes_to_check = self.scope
+        if github_compat:
+            scopes_to_check = self.scope - SCOPE_GITHUB
+        if not scopes_to_check.issubset(default_scope_names):
+            LOGGER.info(
+                "Application requested scopes not configured, setting to overlap",
+                scope_allowed=default_scope_names,
+                scope_given=self.scope,
+            )
+            self.scope = self.scope.intersection(default_scope_names)
         if SCOPE_OPENID not in self.scope and (
             self.grant_type == GrantTypes.HYBRID
             or self.response_type in [ResponseTypes.ID_TOKEN, ResponseTypes.ID_TOKEN_TOKEN]
         ):
             LOGGER.warning("Missing 'openid' scope.")
             raise AuthorizeError(self.redirect_uri, "invalid_scope", self.grant_type, self.state)
+        if SCOPE_OFFLINE_ACCESS in self.scope:
+            # https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
+            if PROMPT_CONSENT not in self.prompt:
+                raise AuthorizeError(
+                    self.redirect_uri, "consent_required", self.grant_type, self.state
+                )
+            if self.response_type not in [
+                ResponseTypes.CODE,
+                ResponseTypes.CODE_TOKEN,
+                ResponseTypes.CODE_ID_TOKEN,
+                ResponseTypes.CODE_ID_TOKEN_TOKEN,
+            ]:
+                # offline_access requires a response type that has some sort of token
+                # Spec says to ignore the scope when the response_type wouldn't result
+                # in an authorization code being generated
+                self.scope.remove(SCOPE_OFFLINE_ACCESS)
 
     def check_nonce(self):
         """Nonce parameter validation."""
@@ -297,6 +327,9 @@ class AuthorizationFlowInitView(PolicyAccessView):
     """OAuth2 Flow initializer, checks access to application and starts flow"""
 
     params: OAuthAuthorizationParams
+    # Enable GitHub compatibility (only allow for scopes which are handled
+    # differently for github compat)
+    github_compat = False
 
     def pre_permission_check(self):
         """Check prompt parameter before checking permission/authentication,
@@ -305,7 +338,9 @@ class AuthorizationFlowInitView(PolicyAccessView):
         if len(self.request.GET) < 1:
             raise Http404
         try:
-            self.params = OAuthAuthorizationParams.from_request(self.request)
+            self.params = OAuthAuthorizationParams.from_request(
+                self.request, github_compat=self.github_compat
+            )
         except AuthorizeError as error:
             LOGGER.warning(error.description, redirect_uri=error.redirect_uri)
             raise RequestValidationError(error.get_response(self.request))
@@ -402,7 +437,7 @@ class AuthorizationFlowInitView(PolicyAccessView):
         # OpenID clients can specify a `prompt` parameter, and if its set to consent we
         # need to inject a consent stage
         if PROMPT_CONSENT in self.params.prompt:
-            if not any(isinstance(x.stage, ConsentStageView) for x in plan.bindings):
+            if not any(isinstance(x.stage, ConsentStage) for x in plan.bindings):
                 # Plan does not have any consent stage, so we add an in-memory one
                 stage = ConsentStage(
                     name="OAuth2 Provider In-memory consent stage",
diff --git a/authentik/providers/oauth2/views/token.py b/authentik/providers/oauth2/views/token.py
index 93578d6ce..3bf134b09 100644
--- a/authentik/providers/oauth2/views/token.py
+++ b/authentik/providers/oauth2/views/token.py
@@ -41,6 +41,7 @@ from authentik.providers.oauth2.constants import (
     GRANT_TYPE_PASSWORD,
     GRANT_TYPE_REFRESH_TOKEN,
     PKCE_METHOD_S256,
+    SCOPE_OFFLINE_ACCESS,
     TOKEN_TYPE,
 )
 from authentik.providers.oauth2.errors import DeviceCodeError, TokenError, UserAuthError
@@ -459,7 +460,7 @@ class TokenView(View):
                 op="authentik.providers.oauth2.post.response",
             ):
                 if self.params.grant_type == GRANT_TYPE_AUTHORIZATION_CODE:
-                    LOGGER.debug("Converting authorization code to refresh token")
+                    LOGGER.debug("Converting authorization code to access token")
                     return TokenResponse(self.create_code_response())
                 if self.params.grant_type == GRANT_TYPE_REFRESH_TOKEN:
                     LOGGER.debug("Refreshing refresh token")
@@ -489,49 +490,56 @@ class TokenView(View):
             auth_time=self.params.authorization_code.auth_time,
             session_id=self.params.authorization_code.session_id,
         )
-        access_token.id_token = IDToken.new(
+        access_id_token = IDToken.new(
             self.provider,
             access_token,
             self.request,
         )
+        access_id_token.nonce = self.params.authorization_code.nonce
+        access_token.id_token = access_id_token
         access_token.save()
 
-        refresh_token_expiry = now + timedelta_from_string(self.provider.refresh_token_validity)
-        refresh_token = RefreshToken(
-            user=self.params.authorization_code.user,
-            scope=self.params.authorization_code.scope,
-            expires=refresh_token_expiry,
-            provider=self.provider,
-            auth_time=self.params.authorization_code.auth_time,
-            session_id=self.params.authorization_code.session_id,
-        )
-        id_token = IDToken.new(
-            self.provider,
-            refresh_token,
-            self.request,
-        )
-        id_token.nonce = self.params.authorization_code.nonce
-        id_token.at_hash = access_token.at_hash
-        refresh_token.id_token = id_token
-        refresh_token.save()
-
-        # Delete old code
-        self.params.authorization_code.delete()
-        return {
+        response = {
             "access_token": access_token.token,
-            "refresh_token": refresh_token.token,
             "token_type": TOKEN_TYPE,
             "expires_in": int(
                 timedelta_from_string(self.provider.access_token_validity).total_seconds()
             ),
-            "id_token": id_token.to_jwt(self.provider),
+            "id_token": access_token.id_token.to_jwt(self.provider),
         }
 
+        if SCOPE_OFFLINE_ACCESS in self.params.authorization_code.scope:
+            refresh_token_expiry = now + timedelta_from_string(self.provider.refresh_token_validity)
+            refresh_token = RefreshToken(
+                user=self.params.authorization_code.user,
+                scope=self.params.authorization_code.scope,
+                expires=refresh_token_expiry,
+                provider=self.provider,
+                auth_time=self.params.authorization_code.auth_time,
+                session_id=self.params.authorization_code.session_id,
+            )
+            id_token = IDToken.new(
+                self.provider,
+                refresh_token,
+                self.request,
+            )
+            id_token.nonce = self.params.authorization_code.nonce
+            id_token.at_hash = access_token.at_hash
+            refresh_token.id_token = id_token
+            refresh_token.save()
+            response["refresh_token"] = refresh_token.token
+
+        # Delete old code
+        self.params.authorization_code.delete()
+        return response
+
     def create_refresh_response(self) -> dict[str, Any]:
         """See https://datatracker.ietf.org/doc/html/rfc6749#section-6"""
         unauthorized_scopes = set(self.params.scope) - set(self.params.refresh_token.scope)
         if unauthorized_scopes:
             raise TokenError("invalid_scope")
+        if SCOPE_OFFLINE_ACCESS not in self.params.scope:
+            raise TokenError("invalid_scope")
         now = timezone.now()
         access_token_expiry = now + timedelta_from_string(self.provider.access_token_validity)
         access_token = AccessToken(
@@ -630,31 +638,34 @@ class TokenView(View):
         )
         access_token.save()
 
-        refresh_token_expiry = now + timedelta_from_string(self.provider.refresh_token_validity)
-        refresh_token = RefreshToken(
-            user=self.params.device_code.user,
-            scope=self.params.device_code.scope,
-            expires=refresh_token_expiry,
-            provider=self.provider,
-            auth_time=auth_event.created if auth_event else now,
-        )
-        id_token = IDToken.new(
-            self.provider,
-            refresh_token,
-            self.request,
-        )
-        id_token.at_hash = access_token.at_hash
-        refresh_token.id_token = id_token
-        refresh_token.save()
-
-        # Delete device code
-        self.params.device_code.delete()
-        return {
+        response = {
             "access_token": access_token.token,
-            "refresh_token": refresh_token.token,
             "token_type": TOKEN_TYPE,
             "expires_in": int(
                 timedelta_from_string(self.provider.access_token_validity).total_seconds()
             ),
-            "id_token": id_token.to_jwt(self.provider),
+            "id_token": access_token.id_token.to_jwt(self.provider),
         }
+
+        if SCOPE_OFFLINE_ACCESS in self.params.scope:
+            refresh_token_expiry = now + timedelta_from_string(self.provider.refresh_token_validity)
+            refresh_token = RefreshToken(
+                user=self.params.device_code.user,
+                scope=self.params.device_code.scope,
+                expires=refresh_token_expiry,
+                provider=self.provider,
+                auth_time=auth_event.created if auth_event else now,
+            )
+            id_token = IDToken.new(
+                self.provider,
+                refresh_token,
+                self.request,
+            )
+            id_token.at_hash = access_token.at_hash
+            refresh_token.id_token = id_token
+            refresh_token.save()
+            response["refresh_token"] = refresh_token.token
+
+        # Delete device code
+        self.params.device_code.delete()
+        return response
diff --git a/authentik/rbac/api/rbac_roles.py b/authentik/rbac/api/rbac_roles.py
index 1c48169a2..1ef13c115 100644
--- a/authentik/rbac/api/rbac_roles.py
+++ b/authentik/rbac/api/rbac_roles.py
@@ -24,7 +24,10 @@ class ExtraRoleObjectPermissionSerializer(RoleObjectPermissionSerializer):
 
     def get_app_label_verbose(self, instance: GroupObjectPermission) -> str:
         """Get app label from permission's model"""
-        return apps.get_app_config(instance.content_type.app_label).verbose_name
+        try:
+            return apps.get_app_config(instance.content_type.app_label).verbose_name
+        except LookupError:
+            return instance.content_type.app_label
 
     def get_model_verbose(self, instance: GroupObjectPermission) -> str:
         """Get model label from permission's model"""
diff --git a/authentik/rbac/api/rbac_users.py b/authentik/rbac/api/rbac_users.py
index 636b327f3..6de2e8bce 100644
--- a/authentik/rbac/api/rbac_users.py
+++ b/authentik/rbac/api/rbac_users.py
@@ -24,7 +24,10 @@ class ExtraUserObjectPermissionSerializer(UserObjectPermissionSerializer):
 
     def get_app_label_verbose(self, instance: UserObjectPermission) -> str:
         """Get app label from permission's model"""
-        return apps.get_app_config(instance.content_type.app_label).verbose_name
+        try:
+            return apps.get_app_config(instance.content_type.app_label).verbose_name
+        except LookupError:
+            return instance.content_type.app_label
 
     def get_model_verbose(self, instance: UserObjectPermission) -> str:
         """Get model label from permission's model"""
diff --git a/authentik/stages/user_login/middleware.py b/authentik/stages/user_login/middleware.py
index 8fea4c408..73e42e1ac 100644
--- a/authentik/stages/user_login/middleware.py
+++ b/authentik/stages/user_login/middleware.py
@@ -109,7 +109,10 @@ class BoundSessionMiddleware(SessionMiddleware):
             self.recheck_session_geo(configured_binding_geo, last_ip, new_ip)
         # If we got to this point without any error being raised, we need to
         # update the last saved IP to the current one
-        request.session[SESSION_KEY_LAST_IP] = new_ip
+        if SESSION_KEY_BINDING_NET in request.session or SESSION_KEY_BINDING_GEO in request.session:
+            # Only set the last IP in the session if there's a binding specified
+            # (== basically requires the user to be logged in)
+            request.session[SESSION_KEY_LAST_IP] = new_ip
         AuthenticatedSession.objects.filter(session_key=request.session.session_key).update(
             last_ip=new_ip, last_user_agent=request.META.get("HTTP_USER_AGENT", "")
         )
diff --git a/blueprints/schema.json b/blueprints/schema.json
index a0643ea06..e36e674c6 100644
--- a/blueprints/schema.json
+++ b/blueprints/schema.json
@@ -9011,6 +9011,12 @@
                         "prompt"
                     ],
                     "title": "Auth mode"
+                },
+                "maximum_connections": {
+                    "type": "integer",
+                    "minimum": -2147483648,
+                    "maximum": 2147483647,
+                    "title": "Maximum connections"
                 }
             },
             "required": []
diff --git a/blueprints/system/providers-oauth2.yaml b/blueprints/system/providers-oauth2.yaml
index eb4ca5442..0d2448202 100644
--- a/blueprints/system/providers-oauth2.yaml
+++ b/blueprints/system/providers-oauth2.yaml
@@ -45,3 +45,14 @@ entries:
             # groups is not part of the official userinfo schema, but is a quasi-standard
             "groups": [group.name for group in request.user.ak_groups.all()],
         }
+  - identifiers:
+      managed: goauthentik.io/providers/oauth2/scope-offline_access
+    model: authentik_providers_oauth2.scopemapping
+    attrs:
+      name: "authentik default OAuth Mapping: OpenID 'offline_access'"
+      scope_name: offline_access
+      description: "Access to request new tokens without interaction"
+      expression: |
+        # This scope grants the application a refresh token that can be used to refresh user data
+        # and let the application access authentik without the users interaction
+        return {}
diff --git a/go.mod b/go.mod
index ed9759796..5b08a4a39 100644
--- a/go.mod
+++ b/go.mod
@@ -23,15 +23,15 @@ require (
 	github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484
 	github.com/pires/go-proxyproto v0.7.0
 	github.com/prometheus/client_golang v1.18.0
-	github.com/redis/go-redis/v9 v9.3.1
+	github.com/redis/go-redis/v9 v9.4.0
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.8.0
 	github.com/stretchr/testify v1.8.4
 	github.com/wwt/guac v1.3.2
-	goauthentik.io/api/v3 v3.2023105.3
+	goauthentik.io/api/v3 v3.2023105.5
 	golang.org/x/exp v0.0.0-20230210204819-062eb4c674ab
-	golang.org/x/oauth2 v0.15.0
-	golang.org/x/sync v0.5.0
+	golang.org/x/oauth2 v0.16.0
+	golang.org/x/sync v0.6.0
 	gopkg.in/yaml.v2 v2.4.0
 	layeh.com/radius v0.0.0-20210819152912-ad72663a72ab
 )
@@ -74,9 +74,9 @@ require (
 	go.opentelemetry.io/otel v1.17.0 // indirect
 	go.opentelemetry.io/otel/metric v1.17.0 // indirect
 	go.opentelemetry.io/otel/trace v1.17.0 // indirect
-	golang.org/x/crypto v0.17.0 // indirect
-	golang.org/x/net v0.19.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/crypto v0.18.0 // indirect
+	golang.org/x/net v0.20.0 // indirect
+	golang.org/x/sys v0.16.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect
diff --git a/go.sum b/go.sum
index 3000d744b..c6ecdaf37 100644
--- a/go.sum
+++ b/go.sum
@@ -258,8 +258,8 @@ github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lne
 github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
 github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
-github.com/redis/go-redis/v9 v9.3.1 h1:KqdY8U+3X6z+iACvumCNxnoluToB+9Me+TvyFa21Mds=
-github.com/redis/go-redis/v9 v9.3.1/go.mod h1:hdY0cQFCN4fnSYT6TkisLufl/4W5UIXyv0b/CLO2V2M=
+github.com/redis/go-redis/v9 v9.4.0 h1:Yzoz33UZw9I/mFhx4MNrB6Fk+XHO1VukNcCa1+lwyKk=
+github.com/redis/go-redis/v9 v9.4.0/go.mod h1:hdY0cQFCN4fnSYT6TkisLufl/4W5UIXyv0b/CLO2V2M=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
 github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
@@ -316,8 +316,8 @@ go.opentelemetry.io/otel/trace v1.17.0 h1:/SWhSRHmDPOImIAetP1QAeMnZYiQXrTy4fMMYO
 go.opentelemetry.io/otel/trace v1.17.0/go.mod h1:I/4vKTgFclIsXRVucpH25X0mpFSczM7aHeaz0ZBLWjY=
 go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
 go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
-goauthentik.io/api/v3 v3.2023105.3 h1:x0pMJIKkbN198OOssqA94h8bO6ft9gwG8bpZqZL7WVg=
-goauthentik.io/api/v3 v3.2023105.3/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw=
+goauthentik.io/api/v3 v3.2023105.5 h1:wIL3Q0jry1g4kRWpH/Dv1sQqhzuL4BLC+uP/Tar1P/g=
+goauthentik.io/api/v3 v3.2023105.5/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -327,8 +327,8 @@ golang.org/x/crypto v0.0.0-20200709230013-948cd5f35899/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -394,16 +394,16 @@ golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
+golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.15.0 h1:s8pnnxNVzjWyrvYdFUQq5llS1PX2zhPXmccZv99h7uQ=
-golang.org/x/oauth2 v0.15.0/go.mod h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
+golang.org/x/oauth2 v0.16.0 h1:aDkGMBSYxElaoP81NpoUoz2oo2R2wHdZpGToUxfyQrQ=
+golang.org/x/oauth2 v0.16.0/go.mod h1:hqZ+0LWXsiVoZpeld6jVt06P3adbS2Uu911W1SsJv2o=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -415,8 +415,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -452,8 +452,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
diff --git a/locale/en/LC_MESSAGES/django.po b/locale/en/LC_MESSAGES/django.po
index 9fb05420d..9da4a16e2 100644
--- a/locale/en/LC_MESSAGES/django.po
+++ b/locale/en/LC_MESSAGES/django.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-01-03 11:22+0000\n"
+"POT-Creation-Date: 2024-01-09 15:37+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -92,11 +92,11 @@ msgstr ""
 msgid "Brands"
 msgstr ""
 
-#: authentik/core/api/providers.py:120
+#: authentik/core/api/providers.py:122
 msgid "SAML Provider from Metadata"
 msgstr ""
 
-#: authentik/core/api/providers.py:121
+#: authentik/core/api/providers.py:123
 msgid "Create a SAML Provider by importing its Metadata."
 msgstr ""
 
@@ -343,7 +343,7 @@ msgid "Powered by authentik"
 msgstr ""
 
 #: authentik/core/views/apps.py:53
-#: authentik/providers/oauth2/views/authorize.py:395
+#: authentik/providers/oauth2/views/authorize.py:430
 #: authentik/providers/oauth2/views/device_init.py:70
 #: authentik/providers/saml/views/sso.py:70
 #, python-format
@@ -372,6 +372,10 @@ msgstr ""
 msgid "Certificate-Key Pairs"
 msgstr ""
 
+#: authentik/enterprise/api.py:33
+msgid "Enterprise is required to create/update this object."
+msgstr ""
+
 #: authentik/enterprise/models.py:183
 msgid "License"
 msgstr ""
@@ -411,22 +415,30 @@ msgstr ""
 msgid "RAC Providers"
 msgstr ""
 
-#: authentik/enterprise/providers/rac/models.py:99
+#: authentik/enterprise/providers/rac/models.py:100
 msgid "RAC Endpoint"
 msgstr ""
 
-#: authentik/enterprise/providers/rac/models.py:100
+#: authentik/enterprise/providers/rac/models.py:101
 msgid "RAC Endpoints"
 msgstr ""
 
-#: authentik/enterprise/providers/rac/models.py:121
+#: authentik/enterprise/providers/rac/models.py:122
 msgid "RAC Property Mapping"
 msgstr ""
 
-#: authentik/enterprise/providers/rac/models.py:122
+#: authentik/enterprise/providers/rac/models.py:123
 msgid "RAC Property Mappings"
 msgstr ""
 
+#: authentik/enterprise/providers/rac/views.py:103
+msgid "Maximum connection limit reached."
+msgstr ""
+
+#: authentik/enterprise/providers/rac/views.py:107
+msgid "(You are already connected in another tab/window)"
+msgstr ""
+
 #: authentik/events/models.py:289
 msgid "Event"
 msgstr ""
@@ -1282,7 +1294,7 @@ msgstr ""
 msgid "Device Tokens"
 msgstr ""
 
-#: authentik/providers/oauth2/views/authorize.py:450
+#: authentik/providers/oauth2/views/authorize.py:485
 #: authentik/providers/saml/views/flows.py:87
 #, python-format
 msgid "Redirecting to %(app)s..."
diff --git a/schema.yml b/schema.yml
index 5d03ab5d9..7cd7718ef 100644
--- a/schema.yml
+++ b/schema.yml
@@ -19247,6 +19247,7 @@ paths:
           - tr
           - tt
           - udm
+          - ug
           - uk
           - ur
           - uz
@@ -32108,6 +32109,10 @@ components:
             Build actual launch URL (the provider itself does not have one, just
             individual endpoints)
           readOnly: true
+        maximum_connections:
+          type: integer
+          maximum: 2147483647
+          minimum: -2147483648
       required:
       - auth_mode
       - host
@@ -32139,6 +32144,10 @@ components:
             format: uuid
         auth_mode:
           $ref: '#/components/schemas/AuthModeEnum'
+        maximum_connections:
+          type: integer
+          maximum: 2147483647
+          minimum: -2147483648
       required:
       - auth_mode
       - host
@@ -38118,6 +38127,10 @@ components:
             format: uuid
         auth_mode:
           $ref: '#/components/schemas/AuthModeEnum'
+        maximum_connections:
+          type: integer
+          maximum: 2147483647
+          minimum: -2147483648
     PatchedEventMatcherPolicyRequest:
       type: object
       description: Event Matcher Policy Serializer
@@ -43786,6 +43799,9 @@ components:
           type: string
         model_name:
           type: string
+        requires_enterprise:
+          type: boolean
+          default: false
       required:
       - component
       - description
diff --git a/tests/e2e/test_provider_oauth2_github.py b/tests/e2e/test_provider_oauth2_github.py
index 5e19dd146..5095421a8 100644
--- a/tests/e2e/test_provider_oauth2_github.py
+++ b/tests/e2e/test_provider_oauth2_github.py
@@ -74,7 +74,7 @@ class TestProviderOAuth2Github(SeleniumTestCase):
             slug="default-provider-authorization-implicit-consent"
         )
         provider = OAuth2Provider.objects.create(
-            name="grafana",
+            name=generate_id(),
             client_id=self.client_id,
             client_secret=self.client_secret,
             client_type=ClientTypes.CONFIDENTIAL,
@@ -82,8 +82,8 @@ class TestProviderOAuth2Github(SeleniumTestCase):
             authorization_flow=authorization_flow,
         )
         Application.objects.create(
-            name="Grafana",
-            slug="grafana",
+            name=generate_id(),
+            slug=generate_id(),
             provider=provider,
         )
 
@@ -129,7 +129,7 @@ class TestProviderOAuth2Github(SeleniumTestCase):
             slug="default-provider-authorization-explicit-consent"
         )
         provider = OAuth2Provider.objects.create(
-            name="grafana",
+            name=generate_id(),
             client_id=self.client_id,
             client_secret=self.client_secret,
             client_type=ClientTypes.CONFIDENTIAL,
@@ -137,8 +137,8 @@ class TestProviderOAuth2Github(SeleniumTestCase):
             authorization_flow=authorization_flow,
         )
         app = Application.objects.create(
-            name="Grafana",
-            slug="grafana",
+            name=generate_id(),
+            slug=generate_id(),
             provider=provider,
         )
 
@@ -200,7 +200,7 @@ class TestProviderOAuth2Github(SeleniumTestCase):
             slug="default-provider-authorization-explicit-consent"
         )
         provider = OAuth2Provider.objects.create(
-            name="grafana",
+            name=generate_id(),
             client_id=self.client_id,
             client_secret=self.client_secret,
             client_type=ClientTypes.CONFIDENTIAL,
@@ -208,8 +208,8 @@ class TestProviderOAuth2Github(SeleniumTestCase):
             authorization_flow=authorization_flow,
         )
         app = Application.objects.create(
-            name="Grafana",
-            slug="grafana",
+            name=generate_id(),
+            slug=generate_id(),
             provider=provider,
         )
 
diff --git a/tests/e2e/test_provider_oauth2_grafana.py b/tests/e2e/test_provider_oauth2_grafana.py
index 2538fae70..fa8f12d1d 100644
--- a/tests/e2e/test_provider_oauth2_grafana.py
+++ b/tests/e2e/test_provider_oauth2_grafana.py
@@ -14,6 +14,7 @@ from authentik.lib.generators import generate_id, generate_key
 from authentik.policies.expression.models import ExpressionPolicy
 from authentik.policies.models import PolicyBinding
 from authentik.providers.oauth2.constants import (
+    SCOPE_OFFLINE_ACCESS,
     SCOPE_OPENID,
     SCOPE_OPENID_EMAIL,
     SCOPE_OPENID_PROFILE,
@@ -80,7 +81,7 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
             slug="default-provider-authorization-implicit-consent"
         )
         provider = OAuth2Provider.objects.create(
-            name="grafana",
+            name=generate_id(),
             client_type=ClientTypes.CONFIDENTIAL,
             client_id=self.client_id,
             client_secret=self.client_secret,
@@ -90,12 +91,17 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
         provider.save()
         Application.objects.create(
-            name="Grafana",
+            name=generate_id(),
             slug=self.app_slug,
             provider=provider,
         )
@@ -113,12 +119,8 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
         "default/flow-default-authentication-flow.yaml",
         "default/flow-default-invalidation-flow.yaml",
     )
-    @apply_blueprint(
-        "default/flow-default-provider-authorization-implicit-consent.yaml",
-    )
-    @apply_blueprint(
-        "system/providers-oauth2.yaml",
-    )
+    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
+    @apply_blueprint("system/providers-oauth2.yaml")
     @reconcile_app("authentik_crypto")
     def test_authorization_consent_implied(self):
         """test OpenID Provider flow (default authorization flow with implied consent)"""
@@ -128,7 +130,7 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
             slug="default-provider-authorization-implicit-consent"
         )
         provider = OAuth2Provider.objects.create(
-            name="grafana",
+            name=generate_id(),
             client_type=ClientTypes.CONFIDENTIAL,
             client_id=self.client_id,
             client_secret=self.client_secret,
@@ -138,11 +140,16 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
         Application.objects.create(
-            name="Grafana",
+            name=generate_id(),
             slug=self.app_slug,
             provider=provider,
         )
@@ -174,12 +181,8 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
         "default/flow-default-authentication-flow.yaml",
         "default/flow-default-invalidation-flow.yaml",
     )
-    @apply_blueprint(
-        "default/flow-default-provider-authorization-implicit-consent.yaml",
-    )
-    @apply_blueprint(
-        "system/providers-oauth2.yaml",
-    )
+    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
+    @apply_blueprint("system/providers-oauth2.yaml")
     @reconcile_app("authentik_crypto")
     def test_authorization_logout(self):
         """test OpenID Provider flow with logout"""
@@ -189,7 +192,7 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
             slug="default-provider-authorization-implicit-consent"
         )
         provider = OAuth2Provider.objects.create(
-            name="grafana",
+            name=generate_id(),
             client_type=ClientTypes.CONFIDENTIAL,
             client_id=self.client_id,
             client_secret=self.client_secret,
@@ -199,12 +202,17 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
         provider.save()
         Application.objects.create(
-            name="Grafana",
+            name=generate_id(),
             slug=self.app_slug,
             provider=provider,
         )
@@ -244,12 +252,8 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
         "default/flow-default-authentication-flow.yaml",
         "default/flow-default-invalidation-flow.yaml",
     )
-    @apply_blueprint(
-        "default/flow-default-provider-authorization-explicit-consent.yaml",
-    )
-    @apply_blueprint(
-        "system/providers-oauth2.yaml",
-    )
+    @apply_blueprint("default/flow-default-provider-authorization-explicit-consent.yaml")
+    @apply_blueprint("system/providers-oauth2.yaml")
     @reconcile_app("authentik_crypto")
     def test_authorization_consent_explicit(self):
         """test OpenID Provider flow (default authorization flow with explicit consent)"""
@@ -259,7 +263,7 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
             slug="default-provider-authorization-explicit-consent"
         )
         provider = OAuth2Provider.objects.create(
-            name="grafana",
+            name=generate_id(),
             authorization_flow=authorization_flow,
             client_type=ClientTypes.CONFIDENTIAL,
             client_id=self.client_id,
@@ -269,12 +273,17 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
         provider.save()
         app = Application.objects.create(
-            name="Grafana",
+            name=generate_id(),
             slug=self.app_slug,
             provider=provider,
         )
@@ -323,12 +332,8 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
         "default/flow-default-authentication-flow.yaml",
         "default/flow-default-invalidation-flow.yaml",
     )
-    @apply_blueprint(
-        "default/flow-default-provider-authorization-explicit-consent.yaml",
-    )
-    @apply_blueprint(
-        "system/providers-oauth2.yaml",
-    )
+    @apply_blueprint("default/flow-default-provider-authorization-explicit-consent.yaml")
+    @apply_blueprint("system/providers-oauth2.yaml")
     @reconcile_app("authentik_crypto")
     def test_authorization_denied(self):
         """test OpenID Provider flow (default authorization with access deny)"""
@@ -338,7 +343,7 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
             slug="default-provider-authorization-explicit-consent"
         )
         provider = OAuth2Provider.objects.create(
-            name="grafana",
+            name=generate_id(),
             authorization_flow=authorization_flow,
             client_type=ClientTypes.CONFIDENTIAL,
             client_id=self.client_id,
@@ -348,12 +353,17 @@ class TestProviderOAuth2OAuth(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
         provider.save()
         app = Application.objects.create(
-            name="Grafana",
+            name=generate_id(),
             slug=self.app_slug,
             provider=provider,
         )
diff --git a/tests/e2e/test_provider_oidc.py b/tests/e2e/test_provider_oidc.py
index 3180f9534..c14a498a6 100644
--- a/tests/e2e/test_provider_oidc.py
+++ b/tests/e2e/test_provider_oidc.py
@@ -15,6 +15,7 @@ from authentik.lib.generators import generate_id, generate_key
 from authentik.policies.expression.models import ExpressionPolicy
 from authentik.policies.models import PolicyBinding
 from authentik.providers.oauth2.constants import (
+    SCOPE_OFFLINE_ACCESS,
     SCOPE_OPENID,
     SCOPE_OPENID_EMAIL,
     SCOPE_OPENID_PROFILE,
@@ -29,7 +30,7 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
     def setUp(self):
         self.client_id = generate_id()
         self.client_secret = generate_key()
-        self.application_slug = "test"
+        self.application_slug = generate_id()
         super().setUp()
 
     def setup_client(self) -> Container:
@@ -37,7 +38,7 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         sleep(1)
         client: DockerClient = from_env()
         container = client.containers.run(
-            image="ghcr.io/beryju/oidc-test-client:1.3",
+            image="ghcr.io/beryju/oidc-test-client:2.1",
             detach=True,
             ports={
                 "9009": "9009",
@@ -56,9 +57,7 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         "default/flow-default-authentication-flow.yaml",
         "default/flow-default-invalidation-flow.yaml",
     )
-    @apply_blueprint(
-        "default/flow-default-provider-authorization-implicit-consent.yaml",
-    )
+    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
     @reconcile_app("authentik_crypto")
     def test_redirect_uri_error(self):
         """test OpenID Provider flow (invalid redirect URI, check error message)"""
@@ -78,10 +77,14 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
-        provider.save()
         Application.objects.create(
             name=self.application_slug,
             slug=self.application_slug,
@@ -101,13 +104,12 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         "default/flow-default-authentication-flow.yaml",
         "default/flow-default-invalidation-flow.yaml",
     )
-    @apply_blueprint(
-        "default/flow-default-provider-authorization-implicit-consent.yaml",
-    )
-    @reconcile_app("authentik_crypto")
+    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
     @apply_blueprint("system/providers-oauth2.yaml")
+    @reconcile_app("authentik_crypto")
     def test_authorization_consent_implied(self):
-        """test OpenID Provider flow (default authorization flow with implied consent)"""
+        """test OpenID Provider flow (default authorization flow with implied consent)
+        (due to offline_access a consent will still be triggered)"""
         sleep(1)
         # Bootstrap all needed objects
         authorization_flow = Flow.objects.get(
@@ -124,11 +126,15 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
-        provider.save()
-        Application.objects.create(
+        app = Application.objects.create(
             name=self.application_slug,
             slug=self.application_slug,
             provider=provider,
@@ -137,6 +143,20 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
 
         self.driver.get("http://localhost:9009")
         self.login()
+        self.wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "ak-flow-executor")))
+
+        flow_executor = self.get_shadow_root("ak-flow-executor")
+        consent_stage = self.get_shadow_root("ak-stage-consent", flow_executor)
+
+        self.assertIn(
+            app.name,
+            consent_stage.find_element(By.CSS_SELECTOR, "#header-text").text,
+        )
+        consent_stage.find_element(
+            By.CSS_SELECTOR,
+            "[type=submit]",
+        ).click()
+
         self.wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "pre")))
         self.wait.until(ec.text_to_be_present_in_element((By.CSS_SELECTOR, "pre"), "{"))
         body = loads(self.driver.find_element(By.CSS_SELECTOR, "pre").text)
@@ -155,11 +175,9 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         "default/flow-default-authentication-flow.yaml",
         "default/flow-default-invalidation-flow.yaml",
     )
-    @apply_blueprint(
-        "default/flow-default-provider-authorization-explicit-consent.yaml",
-    )
-    @reconcile_app("authentik_crypto")
+    @apply_blueprint("default/flow-default-provider-authorization-explicit-consent.yaml")
     @apply_blueprint("system/providers-oauth2.yaml")
+    @reconcile_app("authentik_crypto")
     def test_authorization_consent_explicit(self):
         """test OpenID Provider flow (default authorization flow with explicit consent)"""
         sleep(1)
@@ -178,10 +196,14 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
-        provider.save()
         app = Application.objects.create(
             name=self.application_slug,
             slug=self.application_slug,
@@ -224,9 +246,8 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         "default/flow-default-authentication-flow.yaml",
         "default/flow-default-invalidation-flow.yaml",
     )
-    @apply_blueprint(
-        "default/flow-default-provider-authorization-explicit-consent.yaml",
-    )
+    @apply_blueprint("default/flow-default-provider-authorization-explicit-consent.yaml")
+    @apply_blueprint("system/providers-oauth2.yaml")
     @reconcile_app("authentik_crypto")
     def test_authorization_denied(self):
         """test OpenID Provider flow (default authorization with access deny)"""
@@ -246,10 +267,14 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
-        provider.save()
         app = Application.objects.create(
             name=self.application_slug,
             slug=self.application_slug,
diff --git a/tests/e2e/test_provider_oidc_implicit.py b/tests/e2e/test_provider_oidc_implicit.py
index c5d9d37d0..37dff0aa3 100644
--- a/tests/e2e/test_provider_oidc_implicit.py
+++ b/tests/e2e/test_provider_oidc_implicit.py
@@ -15,6 +15,7 @@ from authentik.lib.generators import generate_id, generate_key
 from authentik.policies.expression.models import ExpressionPolicy
 from authentik.policies.models import PolicyBinding
 from authentik.providers.oauth2.constants import (
+    SCOPE_OFFLINE_ACCESS,
     SCOPE_OPENID,
     SCOPE_OPENID_EMAIL,
     SCOPE_OPENID_PROFILE,
@@ -37,7 +38,7 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
         sleep(1)
         client: DockerClient = from_env()
         container = client.containers.run(
-            image="ghcr.io/beryju/oidc-test-client:1.3",
+            image="ghcr.io/beryju/oidc-test-client:2.1",
             detach=True,
             ports={
                 "9009": "9009",
@@ -56,9 +57,8 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
         "default/flow-default-authentication-flow.yaml",
         "default/flow-default-invalidation-flow.yaml",
     )
-    @apply_blueprint(
-        "default/flow-default-provider-authorization-implicit-consent.yaml",
-    )
+    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
+    @apply_blueprint("system/providers-oauth2.yaml")
     @reconcile_app("authentik_crypto")
     def test_redirect_uri_error(self):
         """test OpenID Provider flow (invalid redirect URI, check error message)"""
@@ -78,7 +78,12 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
         provider.save()
@@ -101,11 +106,9 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
         "default/flow-default-authentication-flow.yaml",
         "default/flow-default-invalidation-flow.yaml",
     )
-    @apply_blueprint(
-        "default/flow-default-provider-authorization-implicit-consent.yaml",
-    )
-    @reconcile_app("authentik_crypto")
+    @apply_blueprint("default/flow-default-provider-authorization-implicit-consent.yaml")
     @apply_blueprint("system/providers-oauth2.yaml")
+    @reconcile_app("authentik_crypto")
     def test_authorization_consent_implied(self):
         """test OpenID Provider flow (default authorization flow with implied consent)"""
         sleep(1)
@@ -124,7 +127,12 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
         provider.save()
@@ -150,11 +158,9 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
         "default/flow-default-authentication-flow.yaml",
         "default/flow-default-invalidation-flow.yaml",
     )
-    @apply_blueprint(
-        "default/flow-default-provider-authorization-explicit-consent.yaml",
-    )
-    @reconcile_app("authentik_crypto")
+    @apply_blueprint("default/flow-default-provider-authorization-explicit-consent.yaml")
     @apply_blueprint("system/providers-oauth2.yaml")
+    @reconcile_app("authentik_crypto")
     def test_authorization_consent_explicit(self):
         """test OpenID Provider flow (default authorization flow with explicit consent)"""
         sleep(1)
@@ -173,7 +179,12 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
         provider.save()
@@ -215,9 +226,8 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
         "default/flow-default-authentication-flow.yaml",
         "default/flow-default-invalidation-flow.yaml",
     )
-    @apply_blueprint(
-        "default/flow-default-provider-authorization-explicit-consent.yaml",
-    )
+    @apply_blueprint("default/flow-default-provider-authorization-explicit-consent.yaml")
+    @apply_blueprint("system/providers-oauth2.yaml")
     @reconcile_app("authentik_crypto")
     def test_authorization_denied(self):
         """test OpenID Provider flow (default authorization with access deny)"""
@@ -237,7 +247,12 @@ class TestProviderOAuth2OIDCImplicit(SeleniumTestCase):
         )
         provider.property_mappings.set(
             ScopeMapping.objects.filter(
-                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+                scope_name__in=[
+                    SCOPE_OPENID,
+                    SCOPE_OPENID_EMAIL,
+                    SCOPE_OPENID_PROFILE,
+                    SCOPE_OFFLINE_ACCESS,
+                ]
             )
         )
         provider.save()
diff --git a/tests/wdio/package-lock.json b/tests/wdio/package-lock.json
index 3d56efbe1..6ab7d4717 100644
--- a/tests/wdio/package-lock.json
+++ b/tests/wdio/package-lock.json
@@ -7,8 +7,8 @@
             "name": "@goauthentik/web-tests",
             "devDependencies": {
                 "@trivago/prettier-plugin-sort-imports": "^4.3.0",
-                "@typescript-eslint/eslint-plugin": "^6.17.0",
-                "@typescript-eslint/parser": "^6.17.0",
+                "@typescript-eslint/eslint-plugin": "^6.18.1",
+                "@typescript-eslint/parser": "^6.18.1",
                 "@wdio/cli": "^8.27.1",
                 "@wdio/local-runner": "^8.27.0",
                 "@wdio/mocha-framework": "^8.27.0",
@@ -946,16 +946,16 @@
             }
         },
         "node_modules/@typescript-eslint/eslint-plugin": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-6.17.0.tgz",
-            "integrity": "sha512-Vih/4xLXmY7V490dGwBQJTpIZxH4ZFH6eCVmQ4RFkB+wmaCTDAx4dtgoWwMNGKLkqRY1L6rPqzEbjorRnDo4rQ==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-6.18.1.tgz",
+            "integrity": "sha512-nISDRYnnIpk7VCFrGcu1rnZfM1Dh9LRHnfgdkjcbi/l7g16VYRri3TjXi9Ir4lOZSw5N/gnV/3H7jIPQ8Q4daA==",
             "dev": true,
             "dependencies": {
                 "@eslint-community/regexpp": "^4.5.1",
-                "@typescript-eslint/scope-manager": "6.17.0",
-                "@typescript-eslint/type-utils": "6.17.0",
-                "@typescript-eslint/utils": "6.17.0",
-                "@typescript-eslint/visitor-keys": "6.17.0",
+                "@typescript-eslint/scope-manager": "6.18.1",
+                "@typescript-eslint/type-utils": "6.18.1",
+                "@typescript-eslint/utils": "6.18.1",
+                "@typescript-eslint/visitor-keys": "6.18.1",
                 "debug": "^4.3.4",
                 "graphemer": "^1.4.0",
                 "ignore": "^5.2.4",
@@ -981,15 +981,15 @@
             }
         },
         "node_modules/@typescript-eslint/parser": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-6.17.0.tgz",
-            "integrity": "sha512-C4bBaX2orvhK+LlwrY8oWGmSl4WolCfYm513gEccdWZj0CwGadbIADb0FtVEcI+WzUyjyoBj2JRP8g25E6IB8A==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-6.18.1.tgz",
+            "integrity": "sha512-zct/MdJnVaRRNy9e84XnVtRv9Vf91/qqe+hZJtKanjojud4wAVy/7lXxJmMyX6X6J+xc6c//YEWvpeif8cAhWA==",
             "dev": true,
             "dependencies": {
-                "@typescript-eslint/scope-manager": "6.17.0",
-                "@typescript-eslint/types": "6.17.0",
-                "@typescript-eslint/typescript-estree": "6.17.0",
-                "@typescript-eslint/visitor-keys": "6.17.0",
+                "@typescript-eslint/scope-manager": "6.18.1",
+                "@typescript-eslint/types": "6.18.1",
+                "@typescript-eslint/typescript-estree": "6.18.1",
+                "@typescript-eslint/visitor-keys": "6.18.1",
                 "debug": "^4.3.4"
             },
             "engines": {
@@ -1009,13 +1009,13 @@
             }
         },
         "node_modules/@typescript-eslint/scope-manager": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-6.17.0.tgz",
-            "integrity": "sha512-RX7a8lwgOi7am0k17NUO0+ZmMOX4PpjLtLRgLmT1d3lBYdWH4ssBUbwdmc5pdRX8rXon8v9x8vaoOSpkHfcXGA==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-6.18.1.tgz",
+            "integrity": "sha512-BgdBwXPFmZzaZUuw6wKiHKIovms97a7eTImjkXCZE04TGHysG+0hDQPmygyvgtkoB/aOQwSM/nWv3LzrOIQOBw==",
             "dev": true,
             "dependencies": {
-                "@typescript-eslint/types": "6.17.0",
-                "@typescript-eslint/visitor-keys": "6.17.0"
+                "@typescript-eslint/types": "6.18.1",
+                "@typescript-eslint/visitor-keys": "6.18.1"
             },
             "engines": {
                 "node": "^16.0.0 || >=18.0.0"
@@ -1026,13 +1026,13 @@
             }
         },
         "node_modules/@typescript-eslint/type-utils": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-6.17.0.tgz",
-            "integrity": "sha512-hDXcWmnbtn4P2B37ka3nil3yi3VCQO2QEB9gBiHJmQp5wmyQWqnjA85+ZcE8c4FqnaB6lBwMrPkgd4aBYz3iNg==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-6.18.1.tgz",
+            "integrity": "sha512-wyOSKhuzHeU/5pcRDP2G2Ndci+4g653V43gXTpt4nbyoIOAASkGDA9JIAgbQCdCkcr1MvpSYWzxTz0olCn8+/Q==",
             "dev": true,
             "dependencies": {
-                "@typescript-eslint/typescript-estree": "6.17.0",
-                "@typescript-eslint/utils": "6.17.0",
+                "@typescript-eslint/typescript-estree": "6.18.1",
+                "@typescript-eslint/utils": "6.18.1",
                 "debug": "^4.3.4",
                 "ts-api-utils": "^1.0.1"
             },
@@ -1053,9 +1053,9 @@
             }
         },
         "node_modules/@typescript-eslint/types": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-6.17.0.tgz",
-            "integrity": "sha512-qRKs9tvc3a4RBcL/9PXtKSehI/q8wuU9xYJxe97WFxnzH8NWWtcW3ffNS+EWg8uPvIerhjsEZ+rHtDqOCiH57A==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-6.18.1.tgz",
+            "integrity": "sha512-4TuMAe+tc5oA7wwfqMtB0Y5OrREPF1GeJBAjqwgZh1lEMH5PJQgWgHGfYufVB51LtjD+peZylmeyxUXPfENLCw==",
             "dev": true,
             "engines": {
                 "node": "^16.0.0 || >=18.0.0"
@@ -1066,13 +1066,13 @@
             }
         },
         "node_modules/@typescript-eslint/typescript-estree": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-6.17.0.tgz",
-            "integrity": "sha512-gVQe+SLdNPfjlJn5VNGhlOhrXz4cajwFd5kAgWtZ9dCZf4XJf8xmgCTLIqec7aha3JwgLI2CK6GY1043FRxZwg==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-6.18.1.tgz",
+            "integrity": "sha512-fv9B94UAhywPRhUeeV/v+3SBDvcPiLxRZJw/xZeeGgRLQZ6rLMG+8krrJUyIf6s1ecWTzlsbp0rlw7n9sjufHA==",
             "dev": true,
             "dependencies": {
-                "@typescript-eslint/types": "6.17.0",
-                "@typescript-eslint/visitor-keys": "6.17.0",
+                "@typescript-eslint/types": "6.18.1",
+                "@typescript-eslint/visitor-keys": "6.18.1",
                 "debug": "^4.3.4",
                 "globby": "^11.1.0",
                 "is-glob": "^4.0.3",
@@ -1118,17 +1118,17 @@
             }
         },
         "node_modules/@typescript-eslint/utils": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-6.17.0.tgz",
-            "integrity": "sha512-LofsSPjN/ITNkzV47hxas2JCsNCEnGhVvocfyOcLzT9c/tSZE7SfhS/iWtzP1lKNOEfLhRTZz6xqI8N2RzweSQ==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-6.18.1.tgz",
+            "integrity": "sha512-zZmTuVZvD1wpoceHvoQpOiewmWu3uP9FuTWo8vqpy2ffsmfCE8mklRPi+vmnIYAIk9t/4kOThri2QCDgor+OpQ==",
             "dev": true,
             "dependencies": {
                 "@eslint-community/eslint-utils": "^4.4.0",
                 "@types/json-schema": "^7.0.12",
                 "@types/semver": "^7.5.0",
-                "@typescript-eslint/scope-manager": "6.17.0",
-                "@typescript-eslint/types": "6.17.0",
-                "@typescript-eslint/typescript-estree": "6.17.0",
+                "@typescript-eslint/scope-manager": "6.18.1",
+                "@typescript-eslint/types": "6.18.1",
+                "@typescript-eslint/typescript-estree": "6.18.1",
                 "semver": "^7.5.4"
             },
             "engines": {
@@ -1143,12 +1143,12 @@
             }
         },
         "node_modules/@typescript-eslint/visitor-keys": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-6.17.0.tgz",
-            "integrity": "sha512-H6VwB/k3IuIeQOyYczyyKN8wH6ed8EwliaYHLxOIhyF0dYEIsN8+Bk3GE19qafeMKyZJJHP8+O1HiFhFLUNKSg==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-6.18.1.tgz",
+            "integrity": "sha512-/kvt0C5lRqGoCfsbmm7/CwMqoSkY3zzHLIjdhHZQW3VFrnz7ATecOHR7nb7V+xn4286MBxfnQfQhAmCI0u+bJA==",
             "dev": true,
             "dependencies": {
-                "@typescript-eslint/types": "6.17.0",
+                "@typescript-eslint/types": "6.18.1",
                 "eslint-visitor-keys": "^3.4.1"
             },
             "engines": {
diff --git a/tests/wdio/package.json b/tests/wdio/package.json
index 768dabac3..a55a8012f 100644
--- a/tests/wdio/package.json
+++ b/tests/wdio/package.json
@@ -4,8 +4,8 @@
     "type": "module",
     "devDependencies": {
         "@trivago/prettier-plugin-sort-imports": "^4.3.0",
-        "@typescript-eslint/eslint-plugin": "^6.17.0",
-        "@typescript-eslint/parser": "^6.17.0",
+        "@typescript-eslint/eslint-plugin": "^6.18.1",
+        "@typescript-eslint/parser": "^6.18.1",
         "@wdio/cli": "^8.27.1",
         "@wdio/local-runner": "^8.27.0",
         "@wdio/mocha-framework": "^8.27.0",
diff --git a/web/README.md b/web/README.md
index 24cc5c622..9a8c1c846 100644
--- a/web/README.md
+++ b/web/README.md
@@ -3,6 +3,92 @@
 This is the default UI for the authentik server. The documentation is going to be a little sparse
 for awhile, but at least let's get started.
 
+# The Theory of the authentik UI
+
+In Peter Naur's 1985 essay [Programming as Theory
+Building](https://pages.cs.wisc.edu/~remzi/Naur.pdf), programming is described as creating a mental
+model of how a program _should_ run, then writing the code to test if the program _can_ run that
+way.
+
+The mental model for the authentik UI is straightforward. There are five "applications" within the
+UI, each with its own base URL, router, and responsibilities, and each application needs as many as
+three contexts in which to run.
+
+The three contexts corresponds to objects in the API's `model` section, so let's use those names.
+
+-   The root `Config`. The root configuration object of the server, containing mostly caching and
+    error reporting information. This is misleading, however; the `Config` object contains some user
+    information, specifically a list of permissions the current user (or "no user") has.
+-   The root `CurrentTenant`. This describes the `Brand` information UIs should use, such as themes,
+    logos, favicon, and specific default flows for logging in, logging out, and recovering a user
+    password.
+-   The current `SessionUser`, the person logged in: username, display name, and various states.
+    (Note: the authentik server permits administrators to "impersonate" any other user in order to
+    debug their authentikation experience. If impersonation is active, the `user` field reflects that
+    user, but it also includes a field, `original`, with the administrator's information.)
+
+(There is a fourth context object, Version, but its use is limited to displaying version information
+and checking for upgrades. Just be aware that you will see it, but you will probably never interact
+with it.)
+
+There are five applications. Two (`loading` and `api-browser`) are trivial applications whose
+insides are provided by third-party libraries (Patternfly and Rapidoc, respectively). The other
+three are actual applications. The descriptions below are wholly from the view of the user's
+experience:
+
+-   `Flow`: From a given URL, displays a form that requests information from the user to accomplish a
+    task. Some tasks require the user to be logged in, but many (such as logging in itself!)
+    obviously do not.
+-   `User`: Provides the user with access to the applications they can access, plus a few user
+    settings.
+-   `Admin`: Provides someone with super-user permissions access to the administrative functions of
+    the authentik server.
+
+**Mental Model**
+
+-   Upon initialization, _every_ authentik UI application fetches `Config` and `CurrentTenant`. `User`
+    and `Admin` will also attempt to load the `SessionUser`; if there is none, the user is kicked out
+    to the `Flow` for logging into authentik itself.
+-   `Config`, `CurrentTenant`, and `SessionUser`, are provided by the `@goauthentik/api` application,
+    not by the codebase under `./web`. (Where you are now).
+-   `Flow`, `User`, and `Admin` are all called `Interfaces` and are found in
+    `./web/src/flow/FlowInterface`, `./web/src/user/UserInterface`, `./web/src/admin/AdminInterface`,
+    respectively.
+
+Inside each of these you will find, in a hierarchal order:
+
+-   The context layer described above
+    -   A theme managing layer
+    -   The orchestration layer:
+        -   web socket handler for server-generated events
+        -   The router
+            -   Individual routes for each vertical slice and its relationship to other objects:
+
+Each slice corresponds to an object table on the server, and each slice _usually_ consists of the
+following:
+
+-   A paginated collection display, usually using the `Table` foundation (found in
+    `./web/src/elements/Table`)
+-   The ability to view an individual object from the collection, which you may be able to:
+    -   Edit
+    -   Delete
+-   A form for creating a new object
+-   Tabs showing that object's relationship to other objects
+    -   Interactive elements for changing or deleting those relationships, or creating new ones.
+    -   The ability to create new objects with which to have that relationship, if they're not part of
+        the core objects (such as User->MFA authenticator apps, since the latter is not a "core" object
+        and has no tab of its own).
+
+We are still a bit "all over the place" with respect to sub-units and common units; there are
+folders `common`, `elements`, and `components`, and ideally they would be:
+
+-   `common`: non-UI related libraries all of our applications need
+-   `elements`: UI elements shared among multiple applications that do not need context
+-   `components`: UI elements shared among multiple that use one or more context
+
+... but at the moment there are some context-sensitive elements, and some UI-related stuff in
+`common`.
+
 # Comments
 
 **NOTE:** The comments in this section are for specific changes to this repository that cannot be
diff --git a/web/lit-localize.json b/web/lit-localize.json
index 19a901a91..3c9564de8 100644
--- a/web/lit-localize.json
+++ b/web/lit-localize.json
@@ -3,15 +3,18 @@
     "sourceLocale": "en",
     "targetLocales": [
         "en",
-        "pseudo-LOCALE",
-        "fr",
-        "tr",
+        "de",
         "es",
+        "fr",
+        "ko",
+        "nl",
         "pl",
-        "zh_TW",
+        "tr",
         "zh-Hans",
         "zh-Hant",
-        "de"
+        "zh-CN",
+        "zh_TW",
+        "pseudo-LOCALE"
     ],
     "tsConfig": "./tsconfig.json",
     "output": {
diff --git a/web/package-lock.json b/web/package-lock.json
index d6305b661..6cab57f36 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -17,15 +17,15 @@
                 "@codemirror/theme-one-dark": "^6.1.2",
                 "@formatjs/intl-listformat": "^7.5.3",
                 "@fortawesome/fontawesome-free": "^6.5.1",
-                "@goauthentik/api": "^2023.10.5-1703968412",
+                "@goauthentik/api": "^2023.10.5-1704382057",
                 "@lit-labs/context": "^0.4.0",
                 "@lit-labs/task": "^3.1.0",
                 "@lit/localize": "^0.11.4",
                 "@open-wc/lit-helpers": "^0.6.0",
                 "@patternfly/elements": "^2.4.0",
                 "@patternfly/patternfly": "^4.224.2",
-                "@sentry/browser": "^7.91.0",
-                "@sentry/tracing": "^7.91.0",
+                "@sentry/browser": "^7.92.0",
+                "@sentry/tracing": "^7.92.0",
                 "@webcomponents/webcomponentsjs": "^2.8.0",
                 "base64-js": "^1.5.1",
                 "chart.js": "^4.4.1",
@@ -50,7 +50,7 @@
                 "@babel/plugin-transform-private-methods": "^7.23.3",
                 "@babel/plugin-transform-private-property-in-object": "^7.23.4",
                 "@babel/plugin-transform-runtime": "^7.23.7",
-                "@babel/preset-env": "^7.23.7",
+                "@babel/preset-env": "^7.23.8",
                 "@babel/preset-typescript": "^7.23.3",
                 "@hcaptcha/types": "^1.0.3",
                 "@jackfranklin/rollup-plugin-markdown": "^0.4.0",
@@ -74,8 +74,8 @@
                 "@types/codemirror": "5.60.15",
                 "@types/grecaptcha": "^3.0.7",
                 "@types/guacamole-common-js": "1.5.2",
-                "@typescript-eslint/eslint-plugin": "^6.17.0",
-                "@typescript-eslint/parser": "^6.17.0",
+                "@typescript-eslint/eslint-plugin": "^6.18.1",
+                "@typescript-eslint/parser": "^6.18.1",
                 "babel-plugin-macros": "^3.1.0",
                 "babel-plugin-tsconfig-paths": "^1.0.3",
                 "cross-env": "^7.0.3",
@@ -85,21 +85,21 @@
                 "eslint-plugin-lit": "^1.11.0",
                 "eslint-plugin-sonarjs": "^0.23.0",
                 "eslint-plugin-storybook": "^0.6.15",
-                "lit-analyzer": "^2.0.2",
+                "lit-analyzer": "^2.0.3",
                 "npm-run-all": "^4.1.5",
                 "prettier": "^3.1.1",
                 "pseudolocale": "^2.0.0",
                 "pyright": "=1.1.338",
                 "react": "^18.2.0",
                 "react-dom": "^18.2.0",
-                "rollup": "^4.9.2",
+                "rollup": "^4.9.4",
                 "rollup-plugin-copy": "^3.5.0",
                 "rollup-plugin-cssimport": "^1.0.3",
                 "rollup-plugin-modify": "^3.0.0",
                 "rollup-plugin-postcss-lit": "^2.1.0",
                 "storybook": "^7.6.7",
                 "storybook-addon-mock": "^4.3.0",
-                "ts-lit-plugin": "^2.0.1",
+                "ts-lit-plugin": "^2.0.2",
                 "tslib": "^2.6.2",
                 "turnstile-types": "^1.2.0",
                 "typescript": "^5.3.3",
@@ -1119,16 +1119,15 @@
             }
         },
         "node_modules/@babel/plugin-transform-classes": {
-            "version": "7.23.5",
-            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.23.5.tgz",
-            "integrity": "sha512-jvOTR4nicqYC9yzOHIhXG5emiFEOpappSJAl73SDSEDcybD+Puuze8Tnpb9p9qEyYup24tq891gkaygIFvWDqg==",
+            "version": "7.23.8",
+            "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.23.8.tgz",
+            "integrity": "sha512-yAYslGsY1bX6Knmg46RjiCiNSwJKv2IUC8qOdYKqMMr0491SXFhcHqOdRDeCRohOOIzwN/90C6mQ9qAKgrP7dg==",
             "dev": true,
             "dependencies": {
                 "@babel/helper-annotate-as-pure": "^7.22.5",
-                "@babel/helper-compilation-targets": "^7.22.15",
+                "@babel/helper-compilation-targets": "^7.23.6",
                 "@babel/helper-environment-visitor": "^7.22.20",
                 "@babel/helper-function-name": "^7.23.0",
-                "@babel/helper-optimise-call-expression": "^7.22.5",
                 "@babel/helper-plugin-utils": "^7.22.5",
                 "@babel/helper-replace-supers": "^7.22.20",
                 "@babel/helper-split-export-declaration": "^7.22.6",
@@ -1833,9 +1832,9 @@
             }
         },
         "node_modules/@babel/preset-env": {
-            "version": "7.23.7",
-            "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.23.7.tgz",
-            "integrity": "sha512-SY27X/GtTz/L4UryMNJ6p4fH4nsgWbz84y9FE0bQeWJP6O5BhgVCt53CotQKHCOeXJel8VyhlhujhlltKms/CA==",
+            "version": "7.23.8",
+            "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.23.8.tgz",
+            "integrity": "sha512-lFlpmkApLkEP6woIKprO6DO60RImpatTQKtz4sUcDjVcK8M8mQ4sZsuxaTMNOZf0sqAq/ReYW1ZBHnOQwKpLWA==",
             "dev": true,
             "dependencies": {
                 "@babel/compat-data": "^7.23.5",
@@ -1871,7 +1870,7 @@
                 "@babel/plugin-transform-block-scoping": "^7.23.4",
                 "@babel/plugin-transform-class-properties": "^7.23.3",
                 "@babel/plugin-transform-class-static-block": "^7.23.4",
-                "@babel/plugin-transform-classes": "^7.23.5",
+                "@babel/plugin-transform-classes": "^7.23.8",
                 "@babel/plugin-transform-computed-properties": "^7.23.3",
                 "@babel/plugin-transform-destructuring": "^7.23.3",
                 "@babel/plugin-transform-dotall-regex": "^7.23.3",
@@ -2913,9 +2912,9 @@
             }
         },
         "node_modules/@goauthentik/api": {
-            "version": "2023.10.5-1703968412",
-            "resolved": "https://registry.npmjs.org/@goauthentik/api/-/api-2023.10.5-1703968412.tgz",
-            "integrity": "sha512-/2QDgGkWGXOYDqH49/2hNs+U8TqdE94hkMrJc8A6L+NAy8x/zKAY39eUHs85jmwt013N5duD/jKiJsRftHsDig=="
+            "version": "2023.10.5-1704382057",
+            "resolved": "https://registry.npmjs.org/@goauthentik/api/-/api-2023.10.5-1704382057.tgz",
+            "integrity": "sha512-nzmAQgTrFXiOwKDeHhq1gAfIMRilAcDPmNvjhqoQc3GQfWs5GG2lAGzIewWyxsfxNABsg+I0BYTPxN7ffD6tXw=="
         },
         "node_modules/@hcaptcha/types": {
             "version": "1.0.3",
@@ -4582,9 +4581,9 @@
             }
         },
         "node_modules/@rollup/rollup-android-arm-eabi": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.9.2.tgz",
-            "integrity": "sha512-RKzxFxBHq9ysZ83fn8Iduv3A283K7zPPYuhL/z9CQuyFrjwpErJx0h4aeb/bnJ+q29GRLgJpY66ceQ/Wcsn3wA==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.9.4.tgz",
+            "integrity": "sha512-ub/SN3yWqIv5CWiAZPHVS1DloyZsJbtXmX4HxUTIpS0BHm9pW5iYBo2mIZi+hE3AeiTzHz33blwSnhdUo+9NpA==",
             "cpu": [
                 "arm"
             ],
@@ -4595,9 +4594,9 @@
             ]
         },
         "node_modules/@rollup/rollup-android-arm64": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.9.2.tgz",
-            "integrity": "sha512-yZ+MUbnwf3SHNWQKJyWh88ii2HbuHCFQnAYTeeO1Nb8SyEiWASEi5dQUygt3ClHWtA9My9RQAYkjvrsZ0WK8Xg==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.9.4.tgz",
+            "integrity": "sha512-ehcBrOR5XTl0W0t2WxfTyHCR/3Cq2jfb+I4W+Ch8Y9b5G+vbAecVv0Fx/J1QKktOrgUYsIKxWAKgIpvw56IFNA==",
             "cpu": [
                 "arm64"
             ],
@@ -4608,9 +4607,9 @@
             ]
         },
         "node_modules/@rollup/rollup-darwin-arm64": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.9.2.tgz",
-            "integrity": "sha512-vqJ/pAUh95FLc/G/3+xPqlSBgilPnauVf2EXOQCZzhZJCXDXt/5A8mH/OzU6iWhb3CNk5hPJrh8pqJUPldN5zw==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.9.4.tgz",
+            "integrity": "sha512-1fzh1lWExwSTWy8vJPnNbNM02WZDS8AW3McEOb7wW+nPChLKf3WG2aG7fhaUmfX5FKw9zhsF5+MBwArGyNM7NA==",
             "cpu": [
                 "arm64"
             ],
@@ -4621,9 +4620,9 @@
             ]
         },
         "node_modules/@rollup/rollup-darwin-x64": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.9.2.tgz",
-            "integrity": "sha512-otPHsN5LlvedOprd3SdfrRNhOahhVBwJpepVKUN58L0RnC29vOAej1vMEaVU6DadnpjivVsNTM5eNt0CcwTahw==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.9.4.tgz",
+            "integrity": "sha512-Gc6cukkF38RcYQ6uPdiXi70JB0f29CwcQ7+r4QpfNpQFVHXRd0DfWFidoGxjSx1DwOETM97JPz1RXL5ISSB0pA==",
             "cpu": [
                 "x64"
             ],
@@ -4634,9 +4633,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.9.2.tgz",
-            "integrity": "sha512-ewG5yJSp+zYKBYQLbd1CUA7b1lSfIdo9zJShNTyc2ZP1rcPrqyZcNlsHgs7v1zhgfdS+kW0p5frc0aVqhZCiYQ==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.9.4.tgz",
+            "integrity": "sha512-g21RTeFzoTl8GxosHbnQZ0/JkuFIB13C3T7Y0HtKzOXmoHhewLbVTFBQZu+z5m9STH6FZ7L/oPgU4Nm5ErN2fw==",
             "cpu": [
                 "arm"
             ],
@@ -4647,9 +4646,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-arm64-gnu": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.9.2.tgz",
-            "integrity": "sha512-pL6QtV26W52aCWTG1IuFV3FMPL1m4wbsRG+qijIvgFO/VBsiXJjDPE/uiMdHBAO6YcpV4KvpKtd0v3WFbaxBtg==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.9.4.tgz",
+            "integrity": "sha512-TVYVWD/SYwWzGGnbfTkrNpdE4HON46orgMNHCivlXmlsSGQOx/OHHYiQcMIOx38/GWgwr/po2LBn7wypkWw/Mg==",
             "cpu": [
                 "arm64"
             ],
@@ -4660,9 +4659,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-arm64-musl": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.9.2.tgz",
-            "integrity": "sha512-On+cc5EpOaTwPSNetHXBuqylDW+765G/oqB9xGmWU3npEhCh8xu0xqHGUA+4xwZLqBbIZNcBlKSIYfkBm6ko7g==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.9.4.tgz",
+            "integrity": "sha512-XcKvuendwizYYhFxpvQ3xVpzje2HHImzg33wL9zvxtj77HvPStbSGI9czrdbfrf8DGMcNNReH9pVZv8qejAQ5A==",
             "cpu": [
                 "arm64"
             ],
@@ -4673,9 +4672,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.9.2.tgz",
-            "integrity": "sha512-Wnx/IVMSZ31D/cO9HSsU46FjrPWHqtdF8+0eyZ1zIB5a6hXaZXghUKpRrC4D5DcRTZOjml2oBhXoqfGYyXKipw==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.9.4.tgz",
+            "integrity": "sha512-LFHS/8Q+I9YA0yVETyjonMJ3UA+DczeBd/MqNEzsGSTdNvSJa1OJZcSH8GiXLvcizgp9AlHs2walqRcqzjOi3A==",
             "cpu": [
                 "riscv64"
             ],
@@ -4686,9 +4685,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-x64-gnu": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.9.2.tgz",
-            "integrity": "sha512-ym5x1cj4mUAMBummxxRkI4pG5Vht1QMsJexwGP8547TZ0sox9fCLDHw9KCH9c1FO5d9GopvkaJsBIOkTKxksdw==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.9.4.tgz",
+            "integrity": "sha512-dIYgo+j1+yfy81i0YVU5KnQrIJZE8ERomx17ReU4GREjGtDW4X+nvkBak2xAUpyqLs4eleDSj3RrV72fQos7zw==",
             "cpu": [
                 "x64"
             ],
@@ -4699,9 +4698,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-x64-musl": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.9.2.tgz",
-            "integrity": "sha512-m0hYELHGXdYx64D6IDDg/1vOJEaiV8f1G/iO+tejvRCJNSwK4jJ15e38JQy5Q6dGkn1M/9KcyEOwqmlZ2kqaZg==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.9.4.tgz",
+            "integrity": "sha512-RoaYxjdHQ5TPjaPrLsfKqR3pakMr3JGqZ+jZM0zP2IkDtsGa4CqYaWSfQmZVgFUCgLrTnzX+cnHS3nfl+kB6ZQ==",
             "cpu": [
                 "x64"
             ],
@@ -4712,9 +4711,9 @@
             ]
         },
         "node_modules/@rollup/rollup-win32-arm64-msvc": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.9.2.tgz",
-            "integrity": "sha512-x1CWburlbN5JjG+juenuNa4KdedBdXLjZMp56nHFSHTOsb/MI2DYiGzLtRGHNMyydPGffGId+VgjOMrcltOksA==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.9.4.tgz",
+            "integrity": "sha512-T8Q3XHV+Jjf5e49B4EAaLKV74BbX7/qYBRQ8Wop/+TyyU0k+vSjiLVSHNWdVd1goMjZcbhDmYZUYW5RFqkBNHQ==",
             "cpu": [
                 "arm64"
             ],
@@ -4725,9 +4724,9 @@
             ]
         },
         "node_modules/@rollup/rollup-win32-ia32-msvc": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.9.2.tgz",
-            "integrity": "sha512-VVzCB5yXR1QlfsH1Xw1zdzQ4Pxuzv+CPr5qpElpKhVxlxD3CRdfubAG9mJROl6/dmj5gVYDDWk8sC+j9BI9/kQ==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.9.4.tgz",
+            "integrity": "sha512-z+JQ7JirDUHAsMecVydnBPWLwJjbppU+7LZjffGf+Jvrxq+dVjIE7By163Sc9DKc3ADSU50qPVw0KonBS+a+HQ==",
             "cpu": [
                 "ia32"
             ],
@@ -4738,9 +4737,9 @@
             ]
         },
         "node_modules/@rollup/rollup-win32-x64-msvc": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.9.2.tgz",
-            "integrity": "sha512-SYRedJi+mweatroB+6TTnJYLts0L0bosg531xnQWtklOI6dezEagx4Q0qDyvRdK+qgdA3YZpjjGuPFtxBmddBA==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.9.4.tgz",
+            "integrity": "sha512-LfdGXCV9rdEify1oxlN9eamvDSjv9md9ZVMAbNHA87xqIfFCxImxan9qZ8+Un54iK2nnqPlbnSi4R54ONtbWBw==",
             "cpu": [
                 "x64"
             ],
@@ -4751,98 +4750,98 @@
             ]
         },
         "node_modules/@sentry-internal/feedback": {
-            "version": "7.91.0",
-            "resolved": "https://registry.npmjs.org/@sentry-internal/feedback/-/feedback-7.91.0.tgz",
-            "integrity": "sha512-SJKTSaz68F5YIwF79EttBm915M2LnacgZMYRnRumyTmMKnebGhYQLwWbZdpaDvOa1U18dgRajDX8Qed/8A3tXw==",
+            "version": "7.92.0",
+            "resolved": "https://registry.npmjs.org/@sentry-internal/feedback/-/feedback-7.92.0.tgz",
+            "integrity": "sha512-/jEALRtVqboxB9kcK2tag8QCO6XANTlGBb9RV3oeGXJe0DDNJXRq6wVZbfgztXJRrfgx4XVDcNt1pRVoGGG++g==",
             "dependencies": {
-                "@sentry/core": "7.91.0",
-                "@sentry/types": "7.91.0",
-                "@sentry/utils": "7.91.0"
+                "@sentry/core": "7.92.0",
+                "@sentry/types": "7.92.0",
+                "@sentry/utils": "7.92.0"
             },
             "engines": {
                 "node": ">=12"
             }
         },
         "node_modules/@sentry-internal/tracing": {
-            "version": "7.91.0",
-            "resolved": "https://registry.npmjs.org/@sentry-internal/tracing/-/tracing-7.91.0.tgz",
-            "integrity": "sha512-JH5y6gs6BS0its7WF2DhySu7nkhPDfZcdpAXldxzIlJpqFkuwQKLU5nkYJpiIyZz1NHYYtW5aum2bV2oCOdDRA==",
+            "version": "7.92.0",
+            "resolved": "https://registry.npmjs.org/@sentry-internal/tracing/-/tracing-7.92.0.tgz",
+            "integrity": "sha512-ur55vPcUUUWFUX4eVLNP71ohswK7ZZpleNZw9Y1GfLqyI+0ILQUwjtzqItJrdClvVsdRZJMRmDV40Hp9Lbb9mA==",
             "dependencies": {
-                "@sentry/core": "7.91.0",
-                "@sentry/types": "7.91.0",
-                "@sentry/utils": "7.91.0"
+                "@sentry/core": "7.92.0",
+                "@sentry/types": "7.92.0",
+                "@sentry/utils": "7.92.0"
             },
             "engines": {
                 "node": ">=8"
             }
         },
         "node_modules/@sentry/browser": {
-            "version": "7.91.0",
-            "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-7.91.0.tgz",
-            "integrity": "sha512-lJv3x/xekzC/biiyAsVCioq2XnKNOZhI6jY3ZzLJZClYV8eKRi7D3KCsHRvMiCdGak1d/6sVp8F4NYY+YiWy1Q==",
+            "version": "7.92.0",
+            "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-7.92.0.tgz",
+            "integrity": "sha512-loMr02/zQ38u8aQhYLtIBg0i5n3ps2e3GUXrt3CdsJQdkRYfa62gcrE7SzvoEpMVHTk7VOI4fWGht8cWw/1k3A==",
             "dependencies": {
-                "@sentry-internal/feedback": "7.91.0",
-                "@sentry-internal/tracing": "7.91.0",
-                "@sentry/core": "7.91.0",
-                "@sentry/replay": "7.91.0",
-                "@sentry/types": "7.91.0",
-                "@sentry/utils": "7.91.0"
+                "@sentry-internal/feedback": "7.92.0",
+                "@sentry-internal/tracing": "7.92.0",
+                "@sentry/core": "7.92.0",
+                "@sentry/replay": "7.92.0",
+                "@sentry/types": "7.92.0",
+                "@sentry/utils": "7.92.0"
             },
             "engines": {
                 "node": ">=8"
             }
         },
         "node_modules/@sentry/core": {
-            "version": "7.91.0",
-            "resolved": "https://registry.npmjs.org/@sentry/core/-/core-7.91.0.tgz",
-            "integrity": "sha512-tu+gYq4JrTdrR+YSh5IVHF0fJi/Pi9y0HZ5H9HnYy+UMcXIotxf6hIEaC6ZKGeLWkGXffz2gKpQLe/g6vy/lPA==",
+            "version": "7.92.0",
+            "resolved": "https://registry.npmjs.org/@sentry/core/-/core-7.92.0.tgz",
+            "integrity": "sha512-1Tly7YB2I1byI5xb0Cwrxs56Rhww+6mQ7m9P7rTmdC3/ijOzbEoohtYIUPwcooCEarpbEJe/tAayRx6BrH2UbQ==",
             "dependencies": {
-                "@sentry/types": "7.91.0",
-                "@sentry/utils": "7.91.0"
+                "@sentry/types": "7.92.0",
+                "@sentry/utils": "7.92.0"
             },
             "engines": {
                 "node": ">=8"
             }
         },
         "node_modules/@sentry/replay": {
-            "version": "7.91.0",
-            "resolved": "https://registry.npmjs.org/@sentry/replay/-/replay-7.91.0.tgz",
-            "integrity": "sha512-XwbesnLLNtaVXKtDoyBB96GxJuhGi9zy3a662Ba/McmumCnkXrMQYpQPh08U7MgkTyDRgjDwm7PXDhiKpcb03g==",
+            "version": "7.92.0",
+            "resolved": "https://registry.npmjs.org/@sentry/replay/-/replay-7.92.0.tgz",
+            "integrity": "sha512-G1t9Uvc9cR8VpNkElwvHIMGzykjIKikb10n0tfVd3e+rBPMCCjCPWOduwG6jZYxcvCjTpqmJh6NSLXxL/Mt4JA==",
             "dependencies": {
-                "@sentry-internal/tracing": "7.91.0",
-                "@sentry/core": "7.91.0",
-                "@sentry/types": "7.91.0",
-                "@sentry/utils": "7.91.0"
+                "@sentry-internal/tracing": "7.92.0",
+                "@sentry/core": "7.92.0",
+                "@sentry/types": "7.92.0",
+                "@sentry/utils": "7.92.0"
             },
             "engines": {
                 "node": ">=12"
             }
         },
         "node_modules/@sentry/tracing": {
-            "version": "7.91.0",
-            "resolved": "https://registry.npmjs.org/@sentry/tracing/-/tracing-7.91.0.tgz",
-            "integrity": "sha512-IlSAMvqfCL/2TwwN4Tmk6bGMgilGruv5oIJ1GMenVZk53bHwjpjzMbd0ms8+S5zJwAgTQXoCbRhaFFrNmptteQ==",
+            "version": "7.92.0",
+            "resolved": "https://registry.npmjs.org/@sentry/tracing/-/tracing-7.92.0.tgz",
+            "integrity": "sha512-1+TFFPVEdax4dNi68gin6MENiyGe9mOuNXfjulrP5eCzUEByus5HAxeDI/LLQ1hArfn048AzwSwKUsS2fO5sbg==",
             "dependencies": {
-                "@sentry-internal/tracing": "7.91.0"
+                "@sentry-internal/tracing": "7.92.0"
             },
             "engines": {
                 "node": ">=8"
             }
         },
         "node_modules/@sentry/types": {
-            "version": "7.91.0",
-            "resolved": "https://registry.npmjs.org/@sentry/types/-/types-7.91.0.tgz",
-            "integrity": "sha512-bcQnb7J3P3equbCUc+sPuHog2Y47yGD2sCkzmnZBjvBT0Z1B4f36fI/5WjyZhTjLSiOdg3F2otwvikbMjmBDew==",
+            "version": "7.92.0",
+            "resolved": "https://registry.npmjs.org/@sentry/types/-/types-7.92.0.tgz",
+            "integrity": "sha512-APmSOuZuoRGpbPpPeYIbMSplPjiWNLZRQa73QiXuTflW4Tu/ItDlU8hOa2+A6JKVkJCuD2EN6yUrxDGSMyNXeg==",
             "engines": {
                 "node": ">=8"
             }
         },
         "node_modules/@sentry/utils": {
-            "version": "7.91.0",
-            "resolved": "https://registry.npmjs.org/@sentry/utils/-/utils-7.91.0.tgz",
-            "integrity": "sha512-fvxjrEbk6T6Otu++Ax9ntlQ0sGRiwSC179w68aC3u26Wr30FAIRKqHTCCdc2jyWk7Gd9uWRT/cq+g8NG/8BfSg==",
+            "version": "7.92.0",
+            "resolved": "https://registry.npmjs.org/@sentry/utils/-/utils-7.92.0.tgz",
+            "integrity": "sha512-3nEfrQ1z28b/2zgFGANPh5yMVtgwXmrasZxTvKbrAj+KWJpjrJHrIR84r9W277J44NMeZ5RhRW2uoDmuBslPnA==",
             "dependencies": {
-                "@sentry/types": "7.91.0"
+                "@sentry/types": "7.92.0"
             },
             "engines": {
                 "node": ">=8"
@@ -7265,9 +7264,9 @@
             "dev": true
         },
         "node_modules/@types/estree": {
-            "version": "1.0.1",
-            "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.1.tgz",
-            "integrity": "sha512-LG4opVs2ANWZ1TJoKc937iMmNstM/d0ae1vNbnBvBhqCSezgVUOzcLCqbI5elV8Vy6WKwKjaqR+zO9VKirBBCA==",
+            "version": "1.0.5",
+            "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.5.tgz",
+            "integrity": "sha512-/kYRxGDLWzHOB7q+wtSUQlFrtcdUccpfy+X+9iMBpHK8QLLhx2wIPYuS5DYtR9Wa/YlZAbIovy7qVdB1Aq6Lyw==",
             "dev": true
         },
         "node_modules/@types/express": {
@@ -7576,16 +7575,16 @@
             "dev": true
         },
         "node_modules/@typescript-eslint/eslint-plugin": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-6.17.0.tgz",
-            "integrity": "sha512-Vih/4xLXmY7V490dGwBQJTpIZxH4ZFH6eCVmQ4RFkB+wmaCTDAx4dtgoWwMNGKLkqRY1L6rPqzEbjorRnDo4rQ==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-6.18.1.tgz",
+            "integrity": "sha512-nISDRYnnIpk7VCFrGcu1rnZfM1Dh9LRHnfgdkjcbi/l7g16VYRri3TjXi9Ir4lOZSw5N/gnV/3H7jIPQ8Q4daA==",
             "dev": true,
             "dependencies": {
                 "@eslint-community/regexpp": "^4.5.1",
-                "@typescript-eslint/scope-manager": "6.17.0",
-                "@typescript-eslint/type-utils": "6.17.0",
-                "@typescript-eslint/utils": "6.17.0",
-                "@typescript-eslint/visitor-keys": "6.17.0",
+                "@typescript-eslint/scope-manager": "6.18.1",
+                "@typescript-eslint/type-utils": "6.18.1",
+                "@typescript-eslint/utils": "6.18.1",
+                "@typescript-eslint/visitor-keys": "6.18.1",
                 "debug": "^4.3.4",
                 "graphemer": "^1.4.0",
                 "ignore": "^5.2.4",
@@ -7644,15 +7643,15 @@
             "dev": true
         },
         "node_modules/@typescript-eslint/parser": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-6.17.0.tgz",
-            "integrity": "sha512-C4bBaX2orvhK+LlwrY8oWGmSl4WolCfYm513gEccdWZj0CwGadbIADb0FtVEcI+WzUyjyoBj2JRP8g25E6IB8A==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-6.18.1.tgz",
+            "integrity": "sha512-zct/MdJnVaRRNy9e84XnVtRv9Vf91/qqe+hZJtKanjojud4wAVy/7lXxJmMyX6X6J+xc6c//YEWvpeif8cAhWA==",
             "dev": true,
             "dependencies": {
-                "@typescript-eslint/scope-manager": "6.17.0",
-                "@typescript-eslint/types": "6.17.0",
-                "@typescript-eslint/typescript-estree": "6.17.0",
-                "@typescript-eslint/visitor-keys": "6.17.0",
+                "@typescript-eslint/scope-manager": "6.18.1",
+                "@typescript-eslint/types": "6.18.1",
+                "@typescript-eslint/typescript-estree": "6.18.1",
+                "@typescript-eslint/visitor-keys": "6.18.1",
                 "debug": "^4.3.4"
             },
             "engines": {
@@ -7672,13 +7671,13 @@
             }
         },
         "node_modules/@typescript-eslint/scope-manager": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-6.17.0.tgz",
-            "integrity": "sha512-RX7a8lwgOi7am0k17NUO0+ZmMOX4PpjLtLRgLmT1d3lBYdWH4ssBUbwdmc5pdRX8rXon8v9x8vaoOSpkHfcXGA==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-6.18.1.tgz",
+            "integrity": "sha512-BgdBwXPFmZzaZUuw6wKiHKIovms97a7eTImjkXCZE04TGHysG+0hDQPmygyvgtkoB/aOQwSM/nWv3LzrOIQOBw==",
             "dev": true,
             "dependencies": {
-                "@typescript-eslint/types": "6.17.0",
-                "@typescript-eslint/visitor-keys": "6.17.0"
+                "@typescript-eslint/types": "6.18.1",
+                "@typescript-eslint/visitor-keys": "6.18.1"
             },
             "engines": {
                 "node": "^16.0.0 || >=18.0.0"
@@ -7689,13 +7688,13 @@
             }
         },
         "node_modules/@typescript-eslint/type-utils": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-6.17.0.tgz",
-            "integrity": "sha512-hDXcWmnbtn4P2B37ka3nil3yi3VCQO2QEB9gBiHJmQp5wmyQWqnjA85+ZcE8c4FqnaB6lBwMrPkgd4aBYz3iNg==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-6.18.1.tgz",
+            "integrity": "sha512-wyOSKhuzHeU/5pcRDP2G2Ndci+4g653V43gXTpt4nbyoIOAASkGDA9JIAgbQCdCkcr1MvpSYWzxTz0olCn8+/Q==",
             "dev": true,
             "dependencies": {
-                "@typescript-eslint/typescript-estree": "6.17.0",
-                "@typescript-eslint/utils": "6.17.0",
+                "@typescript-eslint/typescript-estree": "6.18.1",
+                "@typescript-eslint/utils": "6.18.1",
                 "debug": "^4.3.4",
                 "ts-api-utils": "^1.0.1"
             },
@@ -7716,9 +7715,9 @@
             }
         },
         "node_modules/@typescript-eslint/types": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-6.17.0.tgz",
-            "integrity": "sha512-qRKs9tvc3a4RBcL/9PXtKSehI/q8wuU9xYJxe97WFxnzH8NWWtcW3ffNS+EWg8uPvIerhjsEZ+rHtDqOCiH57A==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-6.18.1.tgz",
+            "integrity": "sha512-4TuMAe+tc5oA7wwfqMtB0Y5OrREPF1GeJBAjqwgZh1lEMH5PJQgWgHGfYufVB51LtjD+peZylmeyxUXPfENLCw==",
             "dev": true,
             "engines": {
                 "node": "^16.0.0 || >=18.0.0"
@@ -7729,13 +7728,13 @@
             }
         },
         "node_modules/@typescript-eslint/typescript-estree": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-6.17.0.tgz",
-            "integrity": "sha512-gVQe+SLdNPfjlJn5VNGhlOhrXz4cajwFd5kAgWtZ9dCZf4XJf8xmgCTLIqec7aha3JwgLI2CK6GY1043FRxZwg==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-6.18.1.tgz",
+            "integrity": "sha512-fv9B94UAhywPRhUeeV/v+3SBDvcPiLxRZJw/xZeeGgRLQZ6rLMG+8krrJUyIf6s1ecWTzlsbp0rlw7n9sjufHA==",
             "dev": true,
             "dependencies": {
-                "@typescript-eslint/types": "6.17.0",
-                "@typescript-eslint/visitor-keys": "6.17.0",
+                "@typescript-eslint/types": "6.18.1",
+                "@typescript-eslint/visitor-keys": "6.18.1",
                 "debug": "^4.3.4",
                 "globby": "^11.1.0",
                 "is-glob": "^4.0.3",
@@ -7814,17 +7813,17 @@
             "dev": true
         },
         "node_modules/@typescript-eslint/utils": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-6.17.0.tgz",
-            "integrity": "sha512-LofsSPjN/ITNkzV47hxas2JCsNCEnGhVvocfyOcLzT9c/tSZE7SfhS/iWtzP1lKNOEfLhRTZz6xqI8N2RzweSQ==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-6.18.1.tgz",
+            "integrity": "sha512-zZmTuVZvD1wpoceHvoQpOiewmWu3uP9FuTWo8vqpy2ffsmfCE8mklRPi+vmnIYAIk9t/4kOThri2QCDgor+OpQ==",
             "dev": true,
             "dependencies": {
                 "@eslint-community/eslint-utils": "^4.4.0",
                 "@types/json-schema": "^7.0.12",
                 "@types/semver": "^7.5.0",
-                "@typescript-eslint/scope-manager": "6.17.0",
-                "@typescript-eslint/types": "6.17.0",
-                "@typescript-eslint/typescript-estree": "6.17.0",
+                "@typescript-eslint/scope-manager": "6.18.1",
+                "@typescript-eslint/types": "6.18.1",
+                "@typescript-eslint/typescript-estree": "6.18.1",
                 "semver": "^7.5.4"
             },
             "engines": {
@@ -7872,12 +7871,12 @@
             "dev": true
         },
         "node_modules/@typescript-eslint/visitor-keys": {
-            "version": "6.17.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-6.17.0.tgz",
-            "integrity": "sha512-H6VwB/k3IuIeQOyYczyyKN8wH6ed8EwliaYHLxOIhyF0dYEIsN8+Bk3GE19qafeMKyZJJHP8+O1HiFhFLUNKSg==",
+            "version": "6.18.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-6.18.1.tgz",
+            "integrity": "sha512-/kvt0C5lRqGoCfsbmm7/CwMqoSkY3zzHLIjdhHZQW3VFrnz7ATecOHR7nb7V+xn4286MBxfnQfQhAmCI0u+bJA==",
             "dev": true,
             "dependencies": {
-                "@typescript-eslint/types": "6.17.0",
+                "@typescript-eslint/types": "6.18.1",
                 "eslint-visitor-keys": "^3.4.1"
             },
             "engines": {
@@ -11456,9 +11455,9 @@
             }
         },
         "node_modules/follow-redirects": {
-            "version": "1.15.2",
-            "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz",
-            "integrity": "sha512-VQLG33o04KaQ8uYi2tVNbdrWp1QWxNNea+nmIB4EVM28v0hmP17z7aG1+wAkNzVq4KeXTq3221ye5qTJP91JwA==",
+            "version": "1.15.4",
+            "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.4.tgz",
+            "integrity": "sha512-Cr4D/5wlrb0z9dgERpUL3LrmPKVDsETIJhaCMeDfuFYcqa5bldGV6wBsAN6X/vxlXQtFBMrXdXxdL8CbDTGniw==",
             "funding": [
                 {
                     "type": "individual",
@@ -13327,9 +13326,9 @@
             }
         },
         "node_modules/lit-analyzer": {
-            "version": "2.0.2",
-            "resolved": "https://registry.npmjs.org/lit-analyzer/-/lit-analyzer-2.0.2.tgz",
-            "integrity": "sha512-Is3cx8ypCVq5uNl8EKkPdlLuV3HDVntDVUeLNQlzTM2Je3uG5wHcn+06NB+yhCoa4rhwwXCjprU/7g21CSFqOA==",
+            "version": "2.0.3",
+            "resolved": "https://registry.npmjs.org/lit-analyzer/-/lit-analyzer-2.0.3.tgz",
+            "integrity": "sha512-XiAjnwVipNrKav7r3CSEZpWt+mwYxrhPRVC7h8knDmn/HWTzzWJvPe+mwBcL2brn4xhItAMzZhFC8tzzqHKmiQ==",
             "dev": true,
             "dependencies": {
                 "@vscode/web-custom-data": "^0.4.2",
@@ -16419,10 +16418,13 @@
             "integrity": "sha512-IXgzBWvWQwE6PrDI05OvmXUIruQTcoMDzRsOd5CDvHCVLcLHMTSYvOK5Cm46kWqlV3yAbuSpBZdJ5oP5OUoStg=="
         },
         "node_modules/rollup": {
-            "version": "4.9.2",
-            "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.9.2.tgz",
-            "integrity": "sha512-66RB8OtFKUTozmVEh3qyNfH+b+z2RXBVloqO2KCC/pjFaGaHtxP9fVfOQKPSGXg2mElmjmxjW/fZ7iKrEpMH5Q==",
+            "version": "4.9.4",
+            "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.9.4.tgz",
+            "integrity": "sha512-2ztU7pY/lrQyXSCnnoU4ICjT/tCG9cdH3/G25ERqE3Lst6vl2BCM5hL2Nw+sslAvAf+ccKsAq1SkKQALyqhR7g==",
             "dev": true,
+            "dependencies": {
+                "@types/estree": "1.0.5"
+            },
             "bin": {
                 "rollup": "dist/bin/rollup"
             },
@@ -16431,19 +16433,19 @@
                 "npm": ">=8.0.0"
             },
             "optionalDependencies": {
-                "@rollup/rollup-android-arm-eabi": "4.9.2",
-                "@rollup/rollup-android-arm64": "4.9.2",
-                "@rollup/rollup-darwin-arm64": "4.9.2",
-                "@rollup/rollup-darwin-x64": "4.9.2",
-                "@rollup/rollup-linux-arm-gnueabihf": "4.9.2",
-                "@rollup/rollup-linux-arm64-gnu": "4.9.2",
-                "@rollup/rollup-linux-arm64-musl": "4.9.2",
-                "@rollup/rollup-linux-riscv64-gnu": "4.9.2",
-                "@rollup/rollup-linux-x64-gnu": "4.9.2",
-                "@rollup/rollup-linux-x64-musl": "4.9.2",
-                "@rollup/rollup-win32-arm64-msvc": "4.9.2",
-                "@rollup/rollup-win32-ia32-msvc": "4.9.2",
-                "@rollup/rollup-win32-x64-msvc": "4.9.2",
+                "@rollup/rollup-android-arm-eabi": "4.9.4",
+                "@rollup/rollup-android-arm64": "4.9.4",
+                "@rollup/rollup-darwin-arm64": "4.9.4",
+                "@rollup/rollup-darwin-x64": "4.9.4",
+                "@rollup/rollup-linux-arm-gnueabihf": "4.9.4",
+                "@rollup/rollup-linux-arm64-gnu": "4.9.4",
+                "@rollup/rollup-linux-arm64-musl": "4.9.4",
+                "@rollup/rollup-linux-riscv64-gnu": "4.9.4",
+                "@rollup/rollup-linux-x64-gnu": "4.9.4",
+                "@rollup/rollup-linux-x64-musl": "4.9.4",
+                "@rollup/rollup-win32-arm64-msvc": "4.9.4",
+                "@rollup/rollup-win32-ia32-msvc": "4.9.4",
+                "@rollup/rollup-win32-x64-msvc": "4.9.4",
                 "fsevents": "~2.3.2"
             }
         },
@@ -17835,9 +17837,9 @@
             }
         },
         "node_modules/ts-lit-plugin": {
-            "version": "2.0.1",
-            "resolved": "https://registry.npmjs.org/ts-lit-plugin/-/ts-lit-plugin-2.0.1.tgz",
-            "integrity": "sha512-Y5G03aDiMYHMLzoZ50kdeVkzgVig2mBw6PVY2oI9PcWl3ONTcDyYq6rJ0QzhlACYWP8sT0dmaPMsHMObgNNvvg==",
+            "version": "2.0.2",
+            "resolved": "https://registry.npmjs.org/ts-lit-plugin/-/ts-lit-plugin-2.0.2.tgz",
+            "integrity": "sha512-DPXlVxhjWHxg8AyBLcfSYt2JXgpANV1ssxxwjY98o26gD8MzeiM68HFW9c2VeDd1CjoR3w7B/6/uKxwBQe+ioA==",
             "dev": true,
             "dependencies": {
                 "lit-analyzer": "^2.0.1",
diff --git a/web/package.json b/web/package.json
index 92cb66ec9..07a86fdae 100644
--- a/web/package.json
+++ b/web/package.json
@@ -42,15 +42,15 @@
         "@codemirror/theme-one-dark": "^6.1.2",
         "@formatjs/intl-listformat": "^7.5.3",
         "@fortawesome/fontawesome-free": "^6.5.1",
-        "@goauthentik/api": "^2023.10.5-1703968412",
+        "@goauthentik/api": "^2023.10.5-1704382057",
         "@lit-labs/context": "^0.4.0",
         "@lit-labs/task": "^3.1.0",
         "@lit/localize": "^0.11.4",
         "@open-wc/lit-helpers": "^0.6.0",
         "@patternfly/elements": "^2.4.0",
         "@patternfly/patternfly": "^4.224.2",
-        "@sentry/browser": "^7.91.0",
-        "@sentry/tracing": "^7.91.0",
+        "@sentry/browser": "^7.92.0",
+        "@sentry/tracing": "^7.92.0",
         "@webcomponents/webcomponentsjs": "^2.8.0",
         "base64-js": "^1.5.1",
         "chart.js": "^4.4.1",
@@ -75,7 +75,7 @@
         "@babel/plugin-transform-private-methods": "^7.23.3",
         "@babel/plugin-transform-private-property-in-object": "^7.23.4",
         "@babel/plugin-transform-runtime": "^7.23.7",
-        "@babel/preset-env": "^7.23.7",
+        "@babel/preset-env": "^7.23.8",
         "@babel/preset-typescript": "^7.23.3",
         "@hcaptcha/types": "^1.0.3",
         "@jackfranklin/rollup-plugin-markdown": "^0.4.0",
@@ -99,8 +99,8 @@
         "@types/codemirror": "5.60.15",
         "@types/grecaptcha": "^3.0.7",
         "@types/guacamole-common-js": "1.5.2",
-        "@typescript-eslint/eslint-plugin": "^6.17.0",
-        "@typescript-eslint/parser": "^6.17.0",
+        "@typescript-eslint/eslint-plugin": "^6.18.1",
+        "@typescript-eslint/parser": "^6.18.1",
         "babel-plugin-macros": "^3.1.0",
         "babel-plugin-tsconfig-paths": "^1.0.3",
         "cross-env": "^7.0.3",
@@ -110,21 +110,21 @@
         "eslint-plugin-lit": "^1.11.0",
         "eslint-plugin-sonarjs": "^0.23.0",
         "eslint-plugin-storybook": "^0.6.15",
-        "lit-analyzer": "^2.0.2",
+        "lit-analyzer": "^2.0.3",
         "npm-run-all": "^4.1.5",
         "prettier": "^3.1.1",
         "pseudolocale": "^2.0.0",
         "pyright": "=1.1.338",
         "react": "^18.2.0",
         "react-dom": "^18.2.0",
-        "rollup": "^4.9.2",
+        "rollup": "^4.9.4",
         "rollup-plugin-copy": "^3.5.0",
         "rollup-plugin-cssimport": "^1.0.3",
         "rollup-plugin-modify": "^3.0.0",
         "rollup-plugin-postcss-lit": "^2.1.0",
         "storybook": "^7.6.7",
         "storybook-addon-mock": "^4.3.0",
-        "ts-lit-plugin": "^2.0.1",
+        "ts-lit-plugin": "^2.0.2",
         "tslib": "^2.6.2",
         "turnstile-types": "^1.2.0",
         "typescript": "^5.3.3",
diff --git a/web/src/admin/AdminInterface/AdminInterface.ts b/web/src/admin/AdminInterface/AdminInterface.ts
index 834c98f37..0f1a59ccd 100644
--- a/web/src/admin/AdminInterface/AdminInterface.ts
+++ b/web/src/admin/AdminInterface/AdminInterface.ts
@@ -7,7 +7,7 @@ import {
 import { configureSentry } from "@goauthentik/common/sentry";
 import { me } from "@goauthentik/common/users";
 import { WebsocketClient } from "@goauthentik/common/ws";
-import { Interface } from "@goauthentik/elements/Base";
+import { Interface } from "@goauthentik/elements/Interface";
 import "@goauthentik/elements/ak-locale-context";
 import "@goauthentik/elements/enterprise/EnterpriseStatusBanner";
 import "@goauthentik/elements/messages/MessageContainer";
diff --git a/web/src/admin/AdminInterface/AdminSidebar.ts b/web/src/admin/AdminInterface/AdminSidebar.ts
index 57381a1de..eb860dd5b 100644
--- a/web/src/admin/AdminInterface/AdminSidebar.ts
+++ b/web/src/admin/AdminInterface/AdminSidebar.ts
@@ -1,23 +1,25 @@
 import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
 import { EVENT_SIDEBAR_TOGGLE, VERSION } from "@goauthentik/common/constants";
 import { me } from "@goauthentik/common/users";
-import { authentikConfigContext } from "@goauthentik/elements/AuthentikContexts";
 import { AKElement } from "@goauthentik/elements/Base";
+import {
+    CapabilitiesEnum,
+    WithCapabilitiesConfig,
+} from "@goauthentik/elements/Interface/capabilitiesProvider";
 import { ID_REGEX, SLUG_REGEX, UUID_REGEX } from "@goauthentik/elements/router/Route";
 import { getRootStyle } from "@goauthentik/elements/utils/getRootStyle";
 import { spread } from "@open-wc/lit-helpers";
 
-import { consume } from "@lit-labs/context";
 import { msg, str } from "@lit/localize";
 import { TemplateResult, html, nothing } from "lit";
 import { customElement, property, state } from "lit/decorators.js";
 import { map } from "lit/directives/map.js";
 
-import { AdminApi, CapabilitiesEnum, CoreApi, UiThemeEnum, Version } from "@goauthentik/api";
-import type { Config, SessionUser, UserSelf } from "@goauthentik/api";
+import { AdminApi, CoreApi, UiThemeEnum, Version } from "@goauthentik/api";
+import type { SessionUser, UserSelf } from "@goauthentik/api";
 
 @customElement("ak-admin-sidebar")
-export class AkAdminSidebar extends AKElement {
+export class AkAdminSidebar extends WithCapabilitiesConfig(AKElement) {
     @property({ type: Boolean, reflect: true })
     open = true;
 
@@ -27,9 +29,6 @@ export class AkAdminSidebar extends AKElement {
     @state()
     impersonation: UserSelf["username"] | null = null;
 
-    @consume({ context: authentikConfigContext })
-    public config!: Config;
-
     constructor() {
         super();
         new AdminApi(DEFAULT_CONFIG).adminVersionRetrieve().then((version) => {
@@ -201,7 +200,7 @@ export class AkAdminSidebar extends AKElement {
     }
 
     renderEnterpriseMessage() {
-        return this.config?.capabilities.includes(CapabilitiesEnum.IsEnterprise)
+        return this.can(CapabilitiesEnum.IsEnterprise)
             ? html`
                   <ak-sidebar-item>
                       <span slot="label">${msg("Enterprise")}</span>
diff --git a/web/src/admin/admin-overview/AdminOverviewPage.ts b/web/src/admin/admin-overview/AdminOverviewPage.ts
index a7e210a7c..9b79f5334 100644
--- a/web/src/admin/admin-overview/AdminOverviewPage.ts
+++ b/web/src/admin/admin-overview/AdminOverviewPage.ts
@@ -74,10 +74,7 @@ export class AdminOverviewPage extends AKElement {
     }
 
     render(): TemplateResult {
-        let name = this.user?.user.username;
-        if (this.user?.user.name) {
-            name = this.user.user.name;
-        }
+        const name = this.user?.user.name ?? this.user?.user.username;
         return html`<ak-page-header icon="" header="" description=${msg("General system status")}>
                 <span slot="header"> ${msg(str`Welcome, ${name}.`)} </span>
             </ak-page-header>
diff --git a/web/src/admin/applications/ApplicationForm.ts b/web/src/admin/applications/ApplicationForm.ts
index 970b3638e..ead17e9b2 100644
--- a/web/src/admin/applications/ApplicationForm.ts
+++ b/web/src/admin/applications/ApplicationForm.ts
@@ -1,13 +1,16 @@
 import "@goauthentik/admin/applications/ProviderSelectModal";
 import { iconHelperText } from "@goauthentik/admin/helperText";
-import { DEFAULT_CONFIG, config } from "@goauthentik/common/api/config";
+import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
 import { first } from "@goauthentik/common/utils";
 import "@goauthentik/components/ak-file-input";
 import "@goauthentik/components/ak-radio-input";
 import "@goauthentik/components/ak-switch-input";
 import "@goauthentik/components/ak-text-input";
 import "@goauthentik/components/ak-textarea-input";
-import { rootInterface } from "@goauthentik/elements/Base";
+import {
+    CapabilitiesEnum,
+    WithCapabilitiesConfig,
+} from "@goauthentik/elements/Interface/capabilitiesProvider";
 import "@goauthentik/elements/forms/FormGroup";
 import "@goauthentik/elements/forms/HorizontalFormElement";
 import "@goauthentik/elements/forms/ModalForm";
@@ -22,13 +25,7 @@ import { TemplateResult, html } from "lit";
 import { customElement, property, state } from "lit/decorators.js";
 import { ifDefined } from "lit/directives/if-defined.js";
 
-import {
-    Application,
-    CapabilitiesEnum,
-    CoreApi,
-    PolicyEngineMode,
-    Provider,
-} from "@goauthentik/api";
+import { Application, CoreApi, PolicyEngineMode, Provider } from "@goauthentik/api";
 
 import "./components/ak-backchannel-input";
 import "./components/ak-provider-search-input";
@@ -48,7 +45,7 @@ export const policyOptions = [
 ];
 
 @customElement("ak-application-form")
-export class ApplicationForm extends ModelForm<Application, string> {
+export class ApplicationForm extends WithCapabilitiesConfig(ModelForm<Application, string>) {
     constructor() {
         super();
         this.handleConfirmBackchannelProviders = this.handleConfirmBackchannelProviders.bind(this);
@@ -93,8 +90,7 @@ export class ApplicationForm extends ModelForm<Application, string> {
                 applicationRequest: data,
             });
         }
-        const c = await config();
-        if (c.capabilities.includes(CapabilitiesEnum.CanSaveMedia)) {
+        if (this.can(CapabilitiesEnum.CanSaveMedia)) {
             const icon = this.getFormFiles()["metaIcon"];
             if (icon || this.clearIcon) {
                 await new CoreApi(DEFAULT_CONFIG).coreApplicationsSetIconCreate({
@@ -140,21 +136,21 @@ export class ApplicationForm extends ModelForm<Application, string> {
         return html`<form class="pf-c-form pf-m-horizontal">
             <ak-text-input
                 name="name"
-                .value=${this.instance?.name}
+                value=${ifDefined(this.instance?.name)}
                 label=${msg("Name")}
                 required
                 help=${msg("Application's display Name.")}
             ></ak-text-input>
             <ak-text-input
                 name="slug"
-                .value=${this.instance?.slug}
+                value=${ifDefined(this.instance?.slug)}
                 label=${msg("Slug")}
                 required
                 help=${msg("Internal application name used in URLs.")}
             ></ak-text-input>
             <ak-text-input
                 name="group"
-                .value=${this.instance?.group}
+                value=${ifDefined(this.instance?.group)}
                 label=${msg("Group")}
                 help=${msg(
                     "Optionally enter a group name. Applications with identical groups are shown grouped together.",
@@ -163,7 +159,7 @@ export class ApplicationForm extends ModelForm<Application, string> {
             <ak-provider-search-input
                 name="provider"
                 label=${msg("Provider")}
-                .value=${this.instance?.provider}
+                value=${ifDefined(this.instance?.provider ?? undefined)}
                 help=${msg("Select a provider that this application should use.")}
                 blankable
             ></ak-provider-search-input>
@@ -209,11 +205,11 @@ export class ApplicationForm extends ModelForm<Application, string> {
                         )}
                     >
                     </ak-switch-input>
-                    ${rootInterface()?.config?.capabilities.includes(CapabilitiesEnum.CanSaveMedia)
+                    ${this.can(CapabilitiesEnum.CanSaveMedia)
                         ? html`<ak-file-input
                                   label="${msg("Icon")}"
                                   name="metaIcon"
-                                  .value=${this.instance?.metaIcon}
+                                  value=${ifDefined(this.instance?.metaIcon ?? undefined)}
                                   current=${msg("Currently set to:")}
                               ></ak-file-input>
                               ${this.instance?.metaIcon
diff --git a/web/src/admin/applications/wizard/methods/ldap/ak-application-wizard-authentication-by-ldap.ts b/web/src/admin/applications/wizard/methods/ldap/ak-application-wizard-authentication-by-ldap.ts
index f95972e0a..c4a0b6c06 100644
--- a/web/src/admin/applications/wizard/methods/ldap/ak-application-wizard-authentication-by-ldap.ts
+++ b/web/src/admin/applications/wizard/methods/ldap/ak-application-wizard-authentication-by-ldap.ts
@@ -7,7 +7,7 @@ import "@goauthentik/components/ak-number-input";
 import "@goauthentik/components/ak-radio-input";
 import "@goauthentik/components/ak-switch-input";
 import "@goauthentik/components/ak-text-input";
-import { rootInterface } from "@goauthentik/elements/Base";
+import { WithBrandConfig } from "@goauthentik/elements/Interface/brandProvider";
 import "@goauthentik/elements/forms/FormGroup";
 import "@goauthentik/elements/forms/HorizontalFormElement";
 
@@ -32,7 +32,7 @@ import {
 } from "./LDAPOptionsAndHelp";
 
 @customElement("ak-application-wizard-authentication-by-ldap")
-export class ApplicationWizardApplicationDetails extends BaseProviderPanel {
+export class ApplicationWizardApplicationDetails extends WithBrandConfig(BaseProviderPanel) {
     render() {
         const provider = this.wizard.provider as LDAPProvider | undefined;
         const errors = this.wizard.errors.provider;
@@ -57,7 +57,7 @@ export class ApplicationWizardApplicationDetails extends BaseProviderPanel {
                     <ak-branded-flow-search
                         flowType=${FlowsInstancesListDesignationEnum.Authentication}
                         .currentFlow=${provider?.authorizationFlow}
-                        .brandFlow=${rootInterface()?.brand?.flowAuthentication}
+                        .brandFlow=${this.brand.flowAuthentication}
                         required
                     ></ak-branded-flow-search>
                     <p class="pf-c-form__helper-text">
diff --git a/web/src/admin/applications/wizard/methods/radius/ak-application-wizard-authentication-by-radius.ts b/web/src/admin/applications/wizard/methods/radius/ak-application-wizard-authentication-by-radius.ts
index 836ec721f..854e2570b 100644
--- a/web/src/admin/applications/wizard/methods/radius/ak-application-wizard-authentication-by-radius.ts
+++ b/web/src/admin/applications/wizard/methods/radius/ak-application-wizard-authentication-by-radius.ts
@@ -3,7 +3,7 @@ import "@goauthentik/admin/common/ak-crypto-certificate-search";
 import "@goauthentik/admin/common/ak-flow-search/ak-branded-flow-search";
 import { ascii_letters, digits, first, randomString } from "@goauthentik/common/utils";
 import "@goauthentik/components/ak-text-input";
-import { rootInterface } from "@goauthentik/elements/Base";
+import { WithBrandConfig } from "@goauthentik/elements/Interface/brandProvider";
 import "@goauthentik/elements/forms/FormGroup";
 import "@goauthentik/elements/forms/HorizontalFormElement";
 
@@ -17,7 +17,7 @@ import { FlowsInstancesListDesignationEnum, RadiusProvider } from "@goauthentik/
 import BaseProviderPanel from "../BaseProviderPanel";
 
 @customElement("ak-application-wizard-authentication-by-radius")
-export class ApplicationWizardAuthenticationByRadius extends BaseProviderPanel {
+export class ApplicationWizardAuthenticationByRadius extends WithBrandConfig(BaseProviderPanel) {
     render() {
         const provider = this.wizard.provider as RadiusProvider | undefined;
         const errors = this.wizard.errors.provider;
@@ -42,7 +42,7 @@ export class ApplicationWizardAuthenticationByRadius extends BaseProviderPanel {
                     <ak-branded-flow-search
                         flowType=${FlowsInstancesListDesignationEnum.Authentication}
                         .currentFlow=${provider?.authorizationFlow}
-                        .brandFlow=${rootInterface()?.brand?.flowAuthentication}
+                        .brandFlow=${this.brand.flowAuthentication}
                         required
                     ></ak-branded-flow-search>
                     <p class="pf-c-form__helper-text">
diff --git a/web/src/admin/flows/FlowForm.ts b/web/src/admin/flows/FlowForm.ts
index 1d279070f..3925f6db9 100644
--- a/web/src/admin/flows/FlowForm.ts
+++ b/web/src/admin/flows/FlowForm.ts
@@ -1,8 +1,11 @@
 import { DesignationToLabel, LayoutToLabel } from "@goauthentik/admin/flows/utils";
 import { AuthenticationEnum } from "@goauthentik/api/dist/models/AuthenticationEnum";
-import { DEFAULT_CONFIG, config } from "@goauthentik/common/api/config";
+import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
 import { first } from "@goauthentik/common/utils";
-import { rootInterface } from "@goauthentik/elements/Base";
+import {
+    CapabilitiesEnum,
+    WithCapabilitiesConfig,
+} from "@goauthentik/elements/Interface/capabilitiesProvider";
 import "@goauthentik/elements/forms/FormGroup";
 import "@goauthentik/elements/forms/HorizontalFormElement";
 import { ModelForm } from "@goauthentik/elements/forms/ModelForm";
@@ -14,7 +17,6 @@ import { customElement, property } from "lit/decorators.js";
 import { ifDefined } from "lit/directives/if-defined.js";
 
 import {
-    CapabilitiesEnum,
     DeniedActionEnum,
     Flow,
     FlowDesignationEnum,
@@ -24,7 +26,7 @@ import {
 } from "@goauthentik/api";
 
 @customElement("ak-flow-form")
-export class FlowForm extends ModelForm<Flow, string> {
+export class FlowForm extends WithCapabilitiesConfig(ModelForm<Flow, string>) {
     async loadInstance(pk: string): Promise<Flow> {
         const flow = await new FlowsApi(DEFAULT_CONFIG).flowsInstancesRetrieve({
             slug: pk,
@@ -54,8 +56,8 @@ export class FlowForm extends ModelForm<Flow, string> {
                 flowRequest: data,
             });
         }
-        const c = await config();
-        if (c.capabilities.includes(CapabilitiesEnum.CanSaveMedia)) {
+
+        if (this.can(CapabilitiesEnum.CanSaveMedia)) {
             const icon = this.getFormFiles()["background"];
             if (icon || this.clearBackground) {
                 await new FlowsApi(DEFAULT_CONFIG).flowsInstancesSetBackgroundCreate({
@@ -340,7 +342,7 @@ export class FlowForm extends ModelForm<Flow, string> {
                             </option>
                         </select>
                     </ak-form-element-horizontal>
-                    ${rootInterface()?.config?.capabilities.includes(CapabilitiesEnum.CanSaveMedia)
+                    ${this.can(CapabilitiesEnum.CanSaveMedia)
                         ? html`<ak-form-element-horizontal
                                   label=${msg("Background")}
                                   name="background"
diff --git a/web/src/admin/groups/GroupViewPage.ts b/web/src/admin/groups/GroupViewPage.ts
index 8faaca198..a2f704363 100644
--- a/web/src/admin/groups/GroupViewPage.ts
+++ b/web/src/admin/groups/GroupViewPage.ts
@@ -118,7 +118,7 @@ export class GroupViewPage extends AKElement {
                                         <div class="pf-c-description-list__text">
                                             <ak-status-label
                                                 type="warning"
-                                                ?good=${this.group.isSuperuser}
+                                                ?good${this.group.isSuperuser}
                                             ></ak-status-label>
                                         </div>
                                     </dd>
diff --git a/web/src/admin/groups/RelatedUserList.ts b/web/src/admin/groups/RelatedUserList.ts
index c5230749f..91feb6cd4 100644
--- a/web/src/admin/groups/RelatedUserList.ts
+++ b/web/src/admin/groups/RelatedUserList.ts
@@ -9,7 +9,11 @@ import { MessageLevel } from "@goauthentik/common/messages";
 import { uiConfig } from "@goauthentik/common/ui/config";
 import { first } from "@goauthentik/common/utils";
 import "@goauthentik/components/ak-status-label";
-import { rootInterface } from "@goauthentik/elements/Base";
+import { WithBrandConfig } from "@goauthentik/elements/Interface/brandProvider";
+import {
+    CapabilitiesEnum,
+    WithCapabilitiesConfig,
+} from "@goauthentik/elements/Interface/capabilitiesProvider";
 import "@goauthentik/elements/buttons/ActionButton";
 import "@goauthentik/elements/buttons/Dropdown";
 import "@goauthentik/elements/forms/DeleteBulkForm";
@@ -33,7 +37,6 @@ import PFBanner from "@patternfly/patternfly/components/Banner/banner.css";
 import PFDescriptionList from "@patternfly/patternfly/components/DescriptionList/description-list.css";
 
 import {
-    CapabilitiesEnum,
     CoreApi,
     CoreUsersListTypeEnum,
     Group,
@@ -107,7 +110,7 @@ export class RelatedUserAdd extends Form<{ users: number[] }> {
 }
 
 @customElement("ak-user-related-list")
-export class RelatedUserList extends Table<User> {
+export class RelatedUserList extends WithBrandConfig(WithCapabilitiesConfig(Table<User>)) {
     expandable = true;
     checkbox = true;
 
@@ -188,8 +191,7 @@ export class RelatedUserList extends Table<User> {
 
     row(item: User): TemplateResult[] {
         const canImpersonate =
-            rootInterface()?.config?.capabilities.includes(CapabilitiesEnum.CanImpersonate) &&
-            item.pk !== this.me?.user.pk;
+            this.can(CapabilitiesEnum.CanImpersonate) && item.pk !== this.me?.user.pk;
         return [
             html`<a href="#/identity/users/${item.pk}">
                 <div>${item.username}</div>
@@ -293,7 +295,7 @@ export class RelatedUserList extends Table<User> {
                                             ${msg("Set password")}
                                         </button>
                                     </ak-forms-modal>
-                                    ${rootInterface()?.brand?.flowRecovery
+                                    ${this.brand?.flowRecovery
                                         ? html`
                                               <ak-action-button
                                                   class="pf-m-secondary"
diff --git a/web/src/admin/outposts/OutpostForm.ts b/web/src/admin/outposts/OutpostForm.ts
index 2c5ac9722..7c6c9dda5 100644
--- a/web/src/admin/outposts/OutpostForm.ts
+++ b/web/src/admin/outposts/OutpostForm.ts
@@ -3,6 +3,7 @@ import { docLink } from "@goauthentik/common/global";
 import { groupBy } from "@goauthentik/common/utils";
 import "@goauthentik/elements/CodeMirror";
 import { CodeMirrorMode } from "@goauthentik/elements/CodeMirror";
+import "@goauthentik/elements/forms/FormGroup";
 import "@goauthentik/elements/forms/HorizontalFormElement";
 import { ModelForm } from "@goauthentik/elements/forms/ModelForm";
 import "@goauthentik/elements/forms/SearchSelect";
@@ -220,24 +221,27 @@ export class OutpostForm extends ModelForm<Outpost, string> {
                     ${msg("Hold control/command to select multiple items.")}
                 </p>
             </ak-form-element-horizontal>
-            <ak-form-element-horizontal label=${msg("Configuration")} name="config">
-                <ak-codemirror
-                    mode=${CodeMirrorMode.YAML}
-                    value="${YAML.stringify(
-                        this.instance ? this.instance.config : this.defaultConfig?.config,
-                    )}"
-                ></ak-codemirror>
-                <p class="pf-c-form__helper-text">
-                    ${msg("Set custom attributes using YAML or JSON.")}
-                </p>
-                <p class="pf-c-form__helper-text">
-                    ${msg("See more here:")}&nbsp;
-                    <a
-                        target="_blank"
-                        href="${docLink("/docs/outposts?utm_source=authentik#configuration")}"
-                        >${msg("Documentation")}</a
-                    >
-                </p>
-            </ak-form-element-horizontal>`;
+            <ak-form-group aria-label="Advanced settings">
+                <span slot="header"> ${msg("Advanced settings")} </span>
+                <ak-form-element-horizontal label=${msg("Configuration")} name="config">
+                    <ak-codemirror
+                        mode=${CodeMirrorMode.YAML}
+                        value="${YAML.stringify(
+                            this.instance ? this.instance.config : this.defaultConfig?.config,
+                        )}"
+                    ></ak-codemirror>
+                    <p class="pf-c-form__helper-text">
+                        ${msg("Set custom attributes using YAML or JSON.")}
+                    </p>
+                    <p class="pf-c-form__helper-text">
+                        ${msg("See more here:")}&nbsp;
+                        <a
+                            target="_blank"
+                            href="${docLink("/docs/outposts?utm_source=authentik#configuration")}"
+                            >${msg("Documentation")}</a
+                        >
+                    </p>
+                </ak-form-element-horizontal>
+            </ak-form-group>`;
     }
 }
diff --git a/web/src/admin/property-mappings/PropertyMappingWizard.ts b/web/src/admin/property-mappings/PropertyMappingWizard.ts
index 4773dd93a..4f0ab6122 100644
--- a/web/src/admin/property-mappings/PropertyMappingWizard.ts
+++ b/web/src/admin/property-mappings/PropertyMappingWizard.ts
@@ -13,21 +13,24 @@ import { WizardPage } from "@goauthentik/elements/wizard/WizardPage";
 
 import { msg, str } from "@lit/localize";
 import { customElement } from "@lit/reactive-element/decorators/custom-element.js";
-import { CSSResult, TemplateResult, html } from "lit";
-import { property } from "lit/decorators.js";
+import { CSSResult, TemplateResult, html, nothing } from "lit";
+import { property, state } from "lit/decorators.js";
 
 import PFButton from "@patternfly/patternfly/components/Button/button.css";
 import PFForm from "@patternfly/patternfly/components/Form/form.css";
 import PFRadio from "@patternfly/patternfly/components/Radio/radio.css";
 import PFBase from "@patternfly/patternfly/patternfly-base.css";
 
-import { PropertymappingsApi, TypeCreate } from "@goauthentik/api";
+import { EnterpriseApi, LicenseSummary, PropertymappingsApi, TypeCreate } from "@goauthentik/api";
 
 @customElement("ak-property-mapping-wizard-initial")
 export class InitialPropertyMappingWizardPage extends WizardPage {
     @property({ attribute: false })
     mappingTypes: TypeCreate[] = [];
 
+    @property({ attribute: false })
+    enterprise?: LicenseSummary;
+
     static get styles(): CSSResult[] {
         return [PFBase, PFForm, PFButton, PFRadio];
     }
@@ -60,11 +63,20 @@ export class InitialPropertyMappingWizardPage extends WizardPage {
                             ];
                             this.host.isValid = true;
                         }}
+                        ?disabled=${type.requiresEnterprise ? !this.enterprise?.hasLicense : false}
                     />
                     <label class="pf-c-radio__label" for=${`${type.component}-${type.modelName}`}
                         >${type.name}</label
                     >
                     <span class="pf-c-radio__description">${type.description}</span>
+                    ${type.requiresEnterprise && !this.enterprise?.hasLicense
+                        ? html`
+                              <ak-alert class="pf-c-radio__description" ?inline=${true}>
+                                  ${msg("Provider require enterprise.")}
+                                  <a href="#/enterprise/licenses">${msg("Learn more")}</a>
+                              </ak-alert>
+                          `
+                        : nothing}
                 </div>`;
             })}
         </form>`;
@@ -80,10 +92,16 @@ export class PropertyMappingWizard extends AKElement {
     @property({ attribute: false })
     mappingTypes: TypeCreate[] = [];
 
-    firstUpdated(): void {
-        new PropertymappingsApi(DEFAULT_CONFIG).propertymappingsAllTypesList().then((types) => {
-            this.mappingTypes = types;
-        });
+    @state()
+    enterprise?: LicenseSummary;
+
+    async firstUpdated(): Promise<void> {
+        this.mappingTypes = await new PropertymappingsApi(
+            DEFAULT_CONFIG,
+        ).propertymappingsAllTypesList();
+        this.enterprise = await new EnterpriseApi(
+            DEFAULT_CONFIG,
+        ).enterpriseLicenseSummaryRetrieve();
     }
 
     render(): TemplateResult {
diff --git a/web/src/admin/providers/ProviderWizard.ts b/web/src/admin/providers/ProviderWizard.ts
index a65945354..7f19b4d02 100644
--- a/web/src/admin/providers/ProviderWizard.ts
+++ b/web/src/admin/providers/ProviderWizard.ts
@@ -4,6 +4,7 @@ import "@goauthentik/admin/providers/proxy/ProxyProviderForm";
 import "@goauthentik/admin/providers/saml/SAMLProviderForm";
 import "@goauthentik/admin/providers/saml/SAMLProviderImportForm";
 import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
+import "@goauthentik/elements/Alert";
 import { AKElement } from "@goauthentik/elements/Base";
 import "@goauthentik/elements/forms/ProxyForm";
 import { paramURL } from "@goauthentik/elements/router/RouterOutlet";
@@ -13,8 +14,8 @@ import { WizardPage } from "@goauthentik/elements/wizard/WizardPage";
 
 import { msg, str } from "@lit/localize";
 import { customElement } from "@lit/reactive-element/decorators/custom-element.js";
-import { CSSResult, TemplateResult, html } from "lit";
-import { property } from "lit/decorators.js";
+import { CSSResult, TemplateResult, html, nothing } from "lit";
+import { property, state } from "lit/decorators.js";
 
 import PFButton from "@patternfly/patternfly/components/Button/button.css";
 import PFForm from "@patternfly/patternfly/components/Form/form.css";
@@ -22,13 +23,16 @@ import PFHint from "@patternfly/patternfly/components/Hint/hint.css";
 import PFRadio from "@patternfly/patternfly/components/Radio/radio.css";
 import PFBase from "@patternfly/patternfly/patternfly-base.css";
 
-import { ProvidersApi, TypeCreate } from "@goauthentik/api";
+import { EnterpriseApi, LicenseSummary, ProvidersApi, TypeCreate } from "@goauthentik/api";
 
 @customElement("ak-provider-wizard-initial")
 export class InitialProviderWizardPage extends WizardPage {
     @property({ attribute: false })
     providerTypes: TypeCreate[] = [];
 
+    @property({ attribute: false })
+    enterprise?: LicenseSummary;
+
     static get styles(): CSSResult[] {
         return [PFBase, PFForm, PFHint, PFButton, PFRadio];
     }
@@ -79,9 +83,18 @@ export class InitialProviderWizardPage extends WizardPage {
                             this.host.steps = ["initial", `type-${type.component}`];
                             this.host.isValid = true;
                         }}
+                        ?disabled=${type.requiresEnterprise ? !this.enterprise?.hasLicense : false}
                     />
                     <label class="pf-c-radio__label" for=${type.component}>${type.name}</label>
                     <span class="pf-c-radio__description">${type.description}</span>
+                    ${type.requiresEnterprise && !this.enterprise?.hasLicense
+                        ? html`
+                              <ak-alert class="pf-c-radio__description" ?inline=${true}>
+                                  ${msg("Provider require enterprise.")}
+                                  <a href="#/enterprise/licenses">${msg("Learn more")}</a>
+                              </ak-alert>
+                          `
+                        : nothing}
                 </div>`;
             })}
         </form>`;
@@ -100,15 +113,19 @@ export class ProviderWizard extends AKElement {
     @property({ attribute: false })
     providerTypes: TypeCreate[] = [];
 
+    @state()
+    enterprise?: LicenseSummary;
+
     @property({ attribute: false })
     finalHandler: () => Promise<void> = () => {
         return Promise.resolve();
     };
 
-    firstUpdated(): void {
-        new ProvidersApi(DEFAULT_CONFIG).providersAllTypesList().then((types) => {
-            this.providerTypes = types;
-        });
+    async firstUpdated(): Promise<void> {
+        this.providerTypes = await new ProvidersApi(DEFAULT_CONFIG).providersAllTypesList();
+        this.enterprise = await new EnterpriseApi(
+            DEFAULT_CONFIG,
+        ).enterpriseLicenseSummaryRetrieve();
     }
 
     render(): TemplateResult {
@@ -121,7 +138,11 @@ export class ProviderWizard extends AKElement {
                     return this.finalHandler();
                 }}
             >
-                <ak-provider-wizard-initial slot="initial" .providerTypes=${this.providerTypes}>
+                <ak-provider-wizard-initial
+                    slot="initial"
+                    .providerTypes=${this.providerTypes}
+                    .enterprise=${this.enterprise}
+                >
                 </ak-provider-wizard-initial>
                 ${this.providerTypes.map((type) => {
                     return html`
diff --git a/web/src/admin/providers/ldap/LDAPProviderForm.ts b/web/src/admin/providers/ldap/LDAPProviderForm.ts
index d64109b3c..db426cc1a 100644
--- a/web/src/admin/providers/ldap/LDAPProviderForm.ts
+++ b/web/src/admin/providers/ldap/LDAPProviderForm.ts
@@ -3,7 +3,7 @@ import "@goauthentik/admin/common/ak-flow-search/ak-branded-flow-search";
 import { BaseProviderForm } from "@goauthentik/admin/providers/BaseProviderForm";
 import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
 import { first } from "@goauthentik/common/utils";
-import { rootInterface } from "@goauthentik/elements/Base";
+import { WithBrandConfig } from "@goauthentik/elements/Interface/brandProvider";
 import "@goauthentik/elements/forms/FormGroup";
 import "@goauthentik/elements/forms/HorizontalFormElement";
 import "@goauthentik/elements/forms/Radio";
@@ -25,7 +25,7 @@ import {
 } from "@goauthentik/api";
 
 @customElement("ak-provider-ldap-form")
-export class LDAPProviderFormPage extends BaseProviderForm<LDAPProvider> {
+export class LDAPProviderFormPage extends WithBrandConfig(BaseProviderForm<LDAPProvider>) {
     async loadInstance(pk: number): Promise<LDAPProvider> {
         return new ProvidersApi(DEFAULT_CONFIG).providersLdapRetrieve({
             id: pk,
@@ -68,7 +68,7 @@ export class LDAPProviderFormPage extends BaseProviderForm<LDAPProvider> {
                 <ak-branded-flow-search
                     flowType=${FlowsInstancesListDesignationEnum.Authentication}
                     .currentFlow=${this.instance?.authorizationFlow}
-                    .brandFlow=${rootInterface()?.brand?.flowAuthentication}
+                    .brandFlow=${this.brand?.flowAuthentication}
                     required
                 ></ak-branded-flow-search>
                 <p class="pf-c-form__helper-text">${msg("Flow used for users to authenticate.")}</p>
diff --git a/web/src/admin/providers/oauth2/OAuth2ProviderForm.ts b/web/src/admin/providers/oauth2/OAuth2ProviderForm.ts
index 000df8cad..74f3acbeb 100644
--- a/web/src/admin/providers/oauth2/OAuth2ProviderForm.ts
+++ b/web/src/admin/providers/oauth2/OAuth2ProviderForm.ts
@@ -290,9 +290,13 @@ export class OAuth2ProviderFormPage extends BaseProviderForm<OAuth2Provider> {
                                 let selected = false;
                                 if (!provider?.propertyMappings) {
                                     selected =
-                                        scope.managed?.startsWith(
+                                        // By default select all managed scope mappings, except offline_access
+                                        (scope.managed?.startsWith(
                                             "goauthentik.io/providers/oauth2/scope-",
-                                        ) || false;
+                                        ) &&
+                                            scope.managed !==
+                                                "goauthentik.io/providers/oauth2/scope-offline_access") ||
+                                        false;
                                 } else {
                                     selected = Array.from(provider?.propertyMappings).some((su) => {
                                         return su == scope.pk;
diff --git a/web/src/admin/providers/rac/EndpointForm.ts b/web/src/admin/providers/rac/EndpointForm.ts
index af83af23f..0f23f4fca 100644
--- a/web/src/admin/providers/rac/EndpointForm.ts
+++ b/web/src/admin/providers/rac/EndpointForm.ts
@@ -106,6 +106,23 @@ export class EndpointForm extends ModelForm<Endpoint, string> {
                 />
                 <p class="pf-c-form__helper-text">${msg("Hostname/IP to connect to.")}</p>
             </ak-form-element-horizontal>
+            <ak-form-element-horizontal
+                label=${msg("Maximum concurrent connections")}
+                name="maximumConnections"
+                ?required=${true}
+            >
+                <input
+                    type="number"
+                    value="${first(this.instance?.maximumConnections, 1)}"
+                    class="pf-c-form-control"
+                    required
+                />
+                <p class="pf-c-form__helper-text">
+                    ${msg(
+                        "Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.",
+                    )}
+                </p>
+            </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${msg("Property mappings")}
                 ?required=${true}
diff --git a/web/src/admin/providers/radius/RadiusProviderForm.ts b/web/src/admin/providers/radius/RadiusProviderForm.ts
index 20f9f493f..2d08fc0b6 100644
--- a/web/src/admin/providers/radius/RadiusProviderForm.ts
+++ b/web/src/admin/providers/radius/RadiusProviderForm.ts
@@ -1,7 +1,7 @@
 import { BaseProviderForm } from "@goauthentik/admin/providers/BaseProviderForm";
 import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
 import { ascii_letters, digits, first, randomString } from "@goauthentik/common/utils";
-import { rootInterface } from "@goauthentik/elements/Base";
+import { WithBrandConfig } from "@goauthentik/elements/Interface/brandProvider";
 import "@goauthentik/elements/forms/FormGroup";
 import "@goauthentik/elements/forms/HorizontalFormElement";
 import "@goauthentik/elements/forms/SearchSelect";
@@ -14,7 +14,7 @@ import { customElement } from "lit/decorators.js";
 import { FlowsInstancesListDesignationEnum, ProvidersApi, RadiusProvider } from "@goauthentik/api";
 
 @customElement("ak-provider-radius-form")
-export class RadiusProviderFormPage extends BaseProviderForm<RadiusProvider> {
+export class RadiusProviderFormPage extends WithBrandConfig(BaseProviderForm<RadiusProvider>) {
     loadInstance(pk: number): Promise<RadiusProvider> {
         return new ProvidersApi(DEFAULT_CONFIG).providersRadiusRetrieve({
             id: pk,
@@ -57,7 +57,7 @@ export class RadiusProviderFormPage extends BaseProviderForm<RadiusProvider> {
                 <ak-branded-flow-search
                     flowType=${FlowsInstancesListDesignationEnum.Authentication}
                     .currentFlow=${this.instance?.authorizationFlow}
-                    .brandFlow=${rootInterface()?.brand?.flowAuthentication}
+                    .brandFlow=${this.brand?.flowAuthentication}
                     required
                 ></ak-branded-flow-search>
                 <p class="pf-c-form__helper-text">${msg("Flow used for users to authenticate.")}</p>
diff --git a/web/src/admin/sources/oauth/OAuthSourceForm.ts b/web/src/admin/sources/oauth/OAuthSourceForm.ts
index cf0209fcb..92763bf7b 100644
--- a/web/src/admin/sources/oauth/OAuthSourceForm.ts
+++ b/web/src/admin/sources/oauth/OAuthSourceForm.ts
@@ -4,9 +4,12 @@ import { BaseSourceForm } from "@goauthentik/admin/sources/BaseSourceForm";
 import { UserMatchingModeToLabel } from "@goauthentik/admin/sources/oauth/utils";
 import { DEFAULT_CONFIG, config } from "@goauthentik/common/api/config";
 import { first } from "@goauthentik/common/utils";
-import { rootInterface } from "@goauthentik/elements/Base";
 import "@goauthentik/elements/CodeMirror";
 import { CodeMirrorMode } from "@goauthentik/elements/CodeMirror";
+import {
+    CapabilitiesEnum,
+    WithCapabilitiesConfig,
+} from "@goauthentik/elements/Interface/capabilitiesProvider";
 import "@goauthentik/elements/forms/FormGroup";
 import "@goauthentik/elements/forms/HorizontalFormElement";
 import "@goauthentik/elements/forms/SearchSelect";
@@ -17,7 +20,6 @@ import { customElement, property, state } from "lit/decorators.js";
 import { ifDefined } from "lit/directives/if-defined.js";
 
 import {
-    CapabilitiesEnum,
     FlowsInstancesListDesignationEnum,
     OAuthSource,
     OAuthSourceRequest,
@@ -28,7 +30,7 @@ import {
 } from "@goauthentik/api";
 
 @customElement("ak-source-oauth-form")
-export class OAuthSourceForm extends BaseSourceForm<OAuthSource> {
+export class OAuthSourceForm extends WithCapabilitiesConfig(BaseSourceForm<OAuthSource>) {
     async loadInstance(pk: string): Promise<OAuthSource> {
         const source = await new SourcesApi(DEFAULT_CONFIG).sourcesOauthRetrieve({
             slug: pk,
@@ -318,7 +320,7 @@ export class OAuthSourceForm extends BaseSourceForm<OAuthSource> {
                 />
                 <p class="pf-c-form__helper-text">${placeholderHelperText}</p>
             </ak-form-element-horizontal>
-            ${rootInterface()?.config?.capabilities.includes(CapabilitiesEnum.CanSaveMedia)
+            ${this.can(CapabilitiesEnum.CanSaveMedia)
                 ? html`<ak-form-element-horizontal label=${msg("Icon")} name="icon">
                           <input type="file" value="" class="pf-c-form-control" />
                           ${this.instance?.icon
diff --git a/web/src/admin/sources/plex/PlexSourceForm.ts b/web/src/admin/sources/plex/PlexSourceForm.ts
index 8091067ff..8444e1112 100644
--- a/web/src/admin/sources/plex/PlexSourceForm.ts
+++ b/web/src/admin/sources/plex/PlexSourceForm.ts
@@ -2,10 +2,13 @@ import "@goauthentik/admin/common/ak-flow-search/ak-source-flow-search";
 import { iconHelperText, placeholderHelperText } from "@goauthentik/admin/helperText";
 import { BaseSourceForm } from "@goauthentik/admin/sources/BaseSourceForm";
 import { UserMatchingModeToLabel } from "@goauthentik/admin/sources/oauth/utils";
-import { DEFAULT_CONFIG, config } from "@goauthentik/common/api/config";
+import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
 import { PlexAPIClient, PlexResource, popupCenterScreen } from "@goauthentik/common/helpers/plex";
 import { ascii_letters, digits, first, randomString } from "@goauthentik/common/utils";
-import { rootInterface } from "@goauthentik/elements/Base";
+import {
+    CapabilitiesEnum,
+    WithCapabilitiesConfig,
+} from "@goauthentik/elements/Interface/capabilitiesProvider";
 import "@goauthentik/elements/forms/FormGroup";
 import "@goauthentik/elements/forms/HorizontalFormElement";
 import "@goauthentik/elements/forms/SearchSelect";
@@ -16,7 +19,6 @@ import { customElement, property, state } from "lit/decorators.js";
 import { ifDefined } from "lit/directives/if-defined.js";
 
 import {
-    CapabilitiesEnum,
     FlowsInstancesListDesignationEnum,
     PlexSource,
     SourcesApi,
@@ -24,7 +26,7 @@ import {
 } from "@goauthentik/api";
 
 @customElement("ak-source-plex-form")
-export class PlexSourceForm extends BaseSourceForm<PlexSource> {
+export class PlexSourceForm extends WithCapabilitiesConfig(BaseSourceForm<PlexSource>) {
     async loadInstance(pk: string): Promise<PlexSource> {
         const source = await new SourcesApi(DEFAULT_CONFIG).sourcesPlexRetrieve({
             slug: pk,
@@ -63,8 +65,7 @@ export class PlexSourceForm extends BaseSourceForm<PlexSource> {
                 plexSourceRequest: data,
             });
         }
-        const c = await config();
-        if (c.capabilities.includes(CapabilitiesEnum.CanSaveMedia)) {
+        if (this.can(CapabilitiesEnum.CanSaveMedia)) {
             const icon = this.getFormFiles()["icon"];
             if (icon || this.clearIcon) {
                 await new SourcesApi(DEFAULT_CONFIG).sourcesAllSetIconCreate({
@@ -255,7 +256,7 @@ export class PlexSourceForm extends BaseSourceForm<PlexSource> {
                 />
                 <p class="pf-c-form__helper-text">${placeholderHelperText}</p>
             </ak-form-element-horizontal>
-            ${rootInterface()?.config?.capabilities.includes(CapabilitiesEnum.CanSaveMedia)
+            ${this.can(CapabilitiesEnum.CanSaveMedia)
                 ? html`<ak-form-element-horizontal label=${msg("Icon")} name="icon">
                           <input type="file" value="" class="pf-c-form-control" />
                           ${this.instance?.icon
diff --git a/web/src/admin/sources/saml/SAMLSourceForm.ts b/web/src/admin/sources/saml/SAMLSourceForm.ts
index 76e996322..c969411fb 100644
--- a/web/src/admin/sources/saml/SAMLSourceForm.ts
+++ b/web/src/admin/sources/saml/SAMLSourceForm.ts
@@ -5,7 +5,10 @@ import { BaseSourceForm } from "@goauthentik/admin/sources/BaseSourceForm";
 import { UserMatchingModeToLabel } from "@goauthentik/admin/sources/oauth/utils";
 import { DEFAULT_CONFIG, config } from "@goauthentik/common/api/config";
 import { first } from "@goauthentik/common/utils";
-import { rootInterface } from "@goauthentik/elements/Base";
+import {
+    CapabilitiesEnum,
+    WithCapabilitiesConfig,
+} from "@goauthentik/elements/Interface/capabilitiesProvider";
 import "@goauthentik/elements/forms/FormGroup";
 import "@goauthentik/elements/forms/HorizontalFormElement";
 import "@goauthentik/elements/forms/Radio";
@@ -18,7 +21,6 @@ import { ifDefined } from "lit/directives/if-defined.js";
 
 import {
     BindingTypeEnum,
-    CapabilitiesEnum,
     DigestAlgorithmEnum,
     FlowsInstancesListDesignationEnum,
     NameIdPolicyEnum,
@@ -29,7 +31,7 @@ import {
 } from "@goauthentik/api";
 
 @customElement("ak-source-saml-form")
-export class SAMLSourceForm extends BaseSourceForm<SAMLSource> {
+export class SAMLSourceForm extends WithCapabilitiesConfig(BaseSourceForm<SAMLSource>) {
     @state()
     clearIcon = false;
 
@@ -149,7 +151,7 @@ export class SAMLSourceForm extends BaseSourceForm<SAMLSource> {
                     </option>
                 </select>
             </ak-form-element-horizontal>
-            ${rootInterface()?.config?.capabilities.includes(CapabilitiesEnum.CanSaveMedia)
+            ${this.can(CapabilitiesEnum.CanSaveMedia)
                 ? html`<ak-form-element-horizontal label=${msg("Icon")} name="icon">
                           <input type="file" value="" class="pf-c-form-control" />
                           ${this.instance?.icon
diff --git a/web/src/admin/users/UserListPage.ts b/web/src/admin/users/UserListPage.ts
index 2fcb6bbb1..4f6895560 100644
--- a/web/src/admin/users/UserListPage.ts
+++ b/web/src/admin/users/UserListPage.ts
@@ -12,6 +12,11 @@ import { DefaultUIConfig, uiConfig } from "@goauthentik/common/ui/config";
 import { first } from "@goauthentik/common/utils";
 import "@goauthentik/components/ak-status-label";
 import { rootInterface } from "@goauthentik/elements/Base";
+import { WithBrandConfig } from "@goauthentik/elements/Interface/brandProvider";
+import {
+    CapabilitiesEnum,
+    WithCapabilitiesConfig,
+} from "@goauthentik/elements/Interface/capabilitiesProvider";
 import { PFSize } from "@goauthentik/elements/Spinner";
 import "@goauthentik/elements/TreeView";
 import "@goauthentik/elements/buttons/ActionButton";
@@ -33,14 +38,7 @@ import PFAlert from "@patternfly/patternfly/components/Alert/alert.css";
 import PFCard from "@patternfly/patternfly/components/Card/card.css";
 import PFDescriptionList from "@patternfly/patternfly/components/DescriptionList/description-list.css";
 
-import {
-    CapabilitiesEnum,
-    CoreApi,
-    ResponseError,
-    SessionUser,
-    User,
-    UserPath,
-} from "@goauthentik/api";
+import { CoreApi, ResponseError, SessionUser, User, UserPath } from "@goauthentik/api";
 
 export const requestRecoveryLink = (user: User) =>
     new CoreApi(DEFAULT_CONFIG)
@@ -93,7 +91,7 @@ const recoveryButtonStyles = css`
 `;
 
 @customElement("ak-user-list")
-export class UserListPage extends TablePage<User> {
+export class UserListPage extends WithBrandConfig(WithCapabilitiesConfig(TablePage<User>)) {
     expandable = true;
     checkbox = true;
 
@@ -244,8 +242,7 @@ export class UserListPage extends TablePage<User> {
 
     row(item: User): TemplateResult[] {
         const canImpersonate =
-            rootInterface()?.config?.capabilities.includes(CapabilitiesEnum.CanImpersonate) &&
-            item.pk !== this.me?.user.pk;
+            this.can(CapabilitiesEnum.CanImpersonate) && item.pk !== this.me?.user.pk;
         return [
             html`<a href="#/identity/users/${item.pk}">
                     <div>${item.username}</div>
@@ -355,7 +352,7 @@ export class UserListPage extends TablePage<User> {
                                             ${msg("Set password")}
                                         </button>
                                     </ak-forms-modal>
-                                    ${rootInterface()?.brand?.flowRecovery
+                                    ${this.brand.flowRecovery
                                         ? html`
                                               <ak-action-button
                                                   class="pf-m-secondary"
diff --git a/web/src/admin/users/UserViewPage.ts b/web/src/admin/users/UserViewPage.ts
index 6ef77aa51..ddc9e92ba 100644
--- a/web/src/admin/users/UserViewPage.ts
+++ b/web/src/admin/users/UserViewPage.ts
@@ -22,8 +22,9 @@ import {
 import "@goauthentik/components/ak-status-label";
 import "@goauthentik/components/events/ObjectChangelog";
 import "@goauthentik/components/events/UserEvents";
-import { AKElement, rootInterface } from "@goauthentik/elements/Base";
+import { AKElement } from "@goauthentik/elements/Base";
 import "@goauthentik/elements/CodeMirror";
+import { WithCapabilitiesConfig } from "@goauthentik/elements/Interface/capabilitiesProvider";
 import "@goauthentik/elements/PageHeader";
 import { PFSize } from "@goauthentik/elements/Spinner";
 import "@goauthentik/elements/Tabs";
@@ -60,7 +61,7 @@ import {
 import "./UserDevicesTable";
 
 @customElement("ak-user-view")
-export class UserViewPage extends AKElement {
+export class UserViewPage extends WithCapabilitiesConfig(AKElement) {
     @property({ type: Number })
     set userId(id: number) {
         me().then((me) => {
@@ -163,8 +164,7 @@ export class UserViewPage extends AKElement {
 
     renderActionButtons(user: User) {
         const canImpersonate =
-            rootInterface()?.config?.capabilities.includes(CapabilitiesEnum.CanImpersonate) &&
-            user.pk !== this.me?.user.pk;
+            this.can(CapabilitiesEnum.CanImpersonate) && user.pk !== this.me?.user.pk;
 
         return html`<div class="ak-button-collection">
             <ak-forms-modal>
diff --git a/web/src/elements/AuthentikContexts.ts b/web/src/elements/AuthentikContexts.ts
index 97a89a881..3a0f1dd1b 100644
--- a/web/src/elements/AuthentikContexts.ts
+++ b/web/src/elements/AuthentikContexts.ts
@@ -1,7 +1,9 @@
 import { createContext } from "@lit-labs/context";
 
-import { type Config } from "@goauthentik/api";
+import type { Config, CurrentBrand } from "@goauthentik/api";
 
 export const authentikConfigContext = createContext<Config>(Symbol("authentik-config-context"));
 
+export const authentikBrandContext = createContext<CurrentBrand>(Symbol("authentik-brand-context"));
+
 export default authentikConfigContext;
diff --git a/web/src/elements/Base.ts b/web/src/elements/Base.ts
index 1817ef331..3e251ce12 100644
--- a/web/src/elements/Base.ts
+++ b/web/src/elements/Base.ts
@@ -1,20 +1,18 @@
-import { brand, config } from "@goauthentik/common/api/config";
 import { EVENT_THEME_CHANGE } from "@goauthentik/common/constants";
-import { UIConfig, uiConfig } from "@goauthentik/common/ui/config";
+import { UIConfig } from "@goauthentik/common/ui/config";
 import { adaptCSS } from "@goauthentik/common/utils";
-import { authentikConfigContext } from "@goauthentik/elements/AuthentikContexts";
+import { ensureCSSStyleSheet } from "@goauthentik/elements/utils/ensureCSSStyleSheet";
 
-import { ContextProvider } from "@lit-labs/context";
 import { localized } from "@lit/localize";
-import { CSSResult, LitElement } from "lit";
-import { state } from "lit/decorators.js";
+import { LitElement } from "lit";
 
 import AKGlobal from "@goauthentik/common/styles/authentik.css";
 import ThemeDark from "@goauthentik/common/styles/theme-dark.css";
-import PFBase from "@patternfly/patternfly/patternfly-base.css";
 
 import { Config, CurrentBrand, UiThemeEnum } from "@goauthentik/api";
 
+import { AdoptedStyleSheetsElement } from "./types";
+
 type AkInterface = HTMLElement & {
     getTheme: () => Promise<UiThemeEnum>;
     brand?: CurrentBrand;
@@ -25,13 +23,6 @@ type AkInterface = HTMLElement & {
 export const rootInterface = <T extends AkInterface>(): T | undefined =>
     (document.body.querySelector("[data-ak-interface-root]") as T) ?? undefined;
 
-export function ensureCSSStyleSheet(css: CSSStyleSheet | CSSResult): CSSStyleSheet {
-    if (css instanceof CSSResult) {
-        return css.styleSheet!;
-    }
-    return css;
-}
-
 let css: Promise<string[]> | undefined;
 function fetchCustomCSS(): Promise<string[]> {
     if (!css) {
@@ -52,10 +43,6 @@ function fetchCustomCSS(): Promise<string[]> {
     return css;
 }
 
-export interface AdoptedStyleSheetsElement {
-    adoptedStyleSheets: readonly CSSStyleSheet[];
-}
-
 const QUERY_MEDIA_COLOR_LIGHT = "(prefers-color-scheme: light)";
 
 @localized()
@@ -175,49 +162,3 @@ export class AKElement extends LitElement {
         this.requestUpdate();
     }
 }
-
-export class Interface extends AKElement implements AkInterface {
-    @state()
-    brand?: CurrentBrand;
-
-    @state()
-    uiConfig?: UIConfig;
-
-    _configContext = new ContextProvider(this, {
-        context: authentikConfigContext,
-        initialValue: undefined,
-    });
-
-    _config?: Config;
-
-    @state()
-    set config(c: Config) {
-        this._config = c;
-        this._configContext.setValue(c);
-        this.requestUpdate();
-    }
-
-    get config(): Config | undefined {
-        return this._config;
-    }
-
-    constructor() {
-        super();
-        document.adoptedStyleSheets = [...document.adoptedStyleSheets, ensureCSSStyleSheet(PFBase)];
-        brand().then((brand) => (this.brand = brand));
-        config().then((config) => (this.config = config));
-        this.dataset.akInterfaceRoot = "true";
-    }
-
-    _activateTheme(root: AdoptedStyleSheetsElement, theme: UiThemeEnum): void {
-        super._activateTheme(root, theme);
-        super._activateTheme(document, theme);
-    }
-
-    async getTheme(): Promise<UiThemeEnum> {
-        if (!this.uiConfig) {
-            this.uiConfig = await uiConfig();
-        }
-        return this.uiConfig.theme?.base || UiThemeEnum.Automatic;
-    }
-}
diff --git a/web/src/elements/Interface/Interface.ts b/web/src/elements/Interface/Interface.ts
new file mode 100644
index 000000000..ed4e57c9a
--- /dev/null
+++ b/web/src/elements/Interface/Interface.ts
@@ -0,0 +1,85 @@
+import { brand, config } from "@goauthentik/common/api/config";
+import { UIConfig, uiConfig } from "@goauthentik/common/ui/config";
+import {
+    authentikBrandContext,
+    authentikConfigContext,
+} from "@goauthentik/elements/AuthentikContexts";
+import type { AdoptedStyleSheetsElement } from "@goauthentik/elements/types";
+import { ensureCSSStyleSheet } from "@goauthentik/elements/utils/ensureCSSStyleSheet";
+
+import { ContextProvider } from "@lit-labs/context";
+import { state } from "lit/decorators.js";
+
+import PFBase from "@patternfly/patternfly/patternfly-base.css";
+
+import { Config, CurrentBrand, UiThemeEnum } from "@goauthentik/api";
+
+import { AKElement } from "../Base";
+
+type AkInterface = HTMLElement & {
+    getTheme: () => Promise<UiThemeEnum>;
+    brand?: CurrentBrand;
+    uiConfig?: UIConfig;
+    config?: Config;
+};
+
+export class Interface extends AKElement implements AkInterface {
+    @state()
+    uiConfig?: UIConfig;
+
+    _configContext = new ContextProvider(this, {
+        context: authentikConfigContext,
+        initialValue: undefined,
+    });
+
+    _config?: Config;
+
+    @state()
+    set config(c: Config) {
+        this._config = c;
+        this._configContext.setValue(c);
+        this.requestUpdate();
+    }
+
+    get config(): Config | undefined {
+        return this._config;
+    }
+
+    _brandContext = new ContextProvider(this, {
+        context: authentikBrandContext,
+        initialValue: undefined,
+    });
+
+    _brand?: CurrentBrand;
+
+    @state()
+    set brand(c: CurrentBrand) {
+        this._brand = c;
+        this._brandContext.setValue(c);
+        this.requestUpdate();
+    }
+
+    get brand(): CurrentBrand | undefined {
+        return this._brand;
+    }
+
+    constructor() {
+        super();
+        document.adoptedStyleSheets = [...document.adoptedStyleSheets, ensureCSSStyleSheet(PFBase)];
+        brand().then((brand) => (this.brand = brand));
+        config().then((config) => (this.config = config));
+        this.dataset.akInterfaceRoot = "true";
+    }
+
+    _activateTheme(root: AdoptedStyleSheetsElement, theme: UiThemeEnum): void {
+        super._activateTheme(root, theme);
+        super._activateTheme(document, theme);
+    }
+
+    async getTheme(): Promise<UiThemeEnum> {
+        if (!this.uiConfig) {
+            this.uiConfig = await uiConfig();
+        }
+        return this.uiConfig.theme?.base || UiThemeEnum.Automatic;
+    }
+}
diff --git a/web/src/elements/Interface/authentikConfigProvider.ts b/web/src/elements/Interface/authentikConfigProvider.ts
new file mode 100644
index 000000000..5b2027fd0
--- /dev/null
+++ b/web/src/elements/Interface/authentikConfigProvider.ts
@@ -0,0 +1,20 @@
+import { authentikConfigContext } from "@goauthentik/elements/AuthentikContexts";
+
+import { consume } from "@lit-labs/context";
+import type { LitElement } from "lit";
+
+import type { Config } from "@goauthentik/api";
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type Constructor<T = object> = new (...args: any[]) => T;
+
+export function WithAuthentikConfig<T extends Constructor<LitElement>>(
+    superclass: T,
+    subscribe = true,
+) {
+    abstract class WithAkConfigProvider extends superclass {
+        @consume({ context: authentikConfigContext, subscribe })
+        public authentikConfig!: Config;
+    }
+    return WithAkConfigProvider;
+}
diff --git a/web/src/elements/Interface/brandProvider.ts b/web/src/elements/Interface/brandProvider.ts
new file mode 100644
index 000000000..242764bf7
--- /dev/null
+++ b/web/src/elements/Interface/brandProvider.ts
@@ -0,0 +1,20 @@
+import { authentikBrandContext } from "@goauthentik/elements/AuthentikContexts";
+
+import { consume } from "@lit-labs/context";
+import type { LitElement } from "lit";
+
+import type { CurrentBrand } from "@goauthentik/api";
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type Constructor<T = object> = abstract new (...args: any[]) => T;
+
+export function WithBrandConfig<T extends Constructor<LitElement>>(
+    superclass: T,
+    subscribe = true,
+) {
+    abstract class WithBrandProvider extends superclass {
+        @consume({ context: authentikBrandContext, subscribe })
+        public brand!: CurrentBrand;
+    }
+    return WithBrandProvider;
+}
diff --git a/web/src/elements/Interface/capabilitiesProvider.ts b/web/src/elements/Interface/capabilitiesProvider.ts
new file mode 100644
index 000000000..402653880
--- /dev/null
+++ b/web/src/elements/Interface/capabilitiesProvider.ts
@@ -0,0 +1,69 @@
+import { authentikConfigContext } from "@goauthentik/elements/AuthentikContexts";
+
+import { consume } from "@lit-labs/context";
+import type { LitElement } from "lit";
+
+import { CapabilitiesEnum } from "@goauthentik/api";
+import { Config } from "@goauthentik/api";
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type Constructor<T = object> = abstract new (...args: any[]) => T;
+
+// Using a unique, lexically scoped, and locally static symbol as the field name for the context
+// means that it's inaccessible to any child class looking for it. It's one of the strongest privacy
+// guarantees in JavaScript.
+
+class WCC {
+    public static readonly capabilitiesConfig: unique symbol = Symbol();
+}
+
+/**
+ * withCapabilitiesContext mixes in a single method to any LitElement, `can()`, which takes a
+ * CapabilitiesEnum and returns true or false.
+ *
+ * Usage:
+ *
+ * After importing, simply mixin this function:
+ *
+ * ```
+ * export class AkMyNiftyNewFeature extends withCapabilitiesContext(AKElement) {
+ * ```
+ *
+ * And then if you need to check on a capability:
+ *
+ * ```
+ * if (this.can(CapabilitiesEnum.IsEnterprise) { ... }
+ * ```
+ *
+ * This code re-exports CapabilitiesEnum, so you won't have to import it on a separate line if you
+ * don't need anything else from the API.
+ *
+ * Passing `true` as the second mixin argument will cause the inheriting class to subscribe to the
+ * configuration context. Should the context be explicitly reset, all active web components that are
+ * currently active and subscribed to the context will automatically have a `requestUpdate()`
+ * triggered with the new configuration.
+ *
+ */
+
+export function WithCapabilitiesConfig<T extends Constructor<LitElement>>(
+    superclass: T,
+    subscribe = true,
+) {
+    abstract class CapabilitiesContext extends superclass {
+        @consume({ context: authentikConfigContext, subscribe })
+        private [WCC.capabilitiesConfig]!: Config;
+
+        can(c: CapabilitiesEnum) {
+            if (!this[WCC.capabilitiesConfig]) {
+                throw new Error(
+                    "ConfigContext: Attempted to access site configuration before initialization.",
+                );
+            }
+            return this[WCC.capabilitiesConfig].capabilities.includes(c);
+        }
+    }
+
+    return CapabilitiesContext;
+}
+
+export { CapabilitiesEnum };
diff --git a/web/src/elements/Interface/index.ts b/web/src/elements/Interface/index.ts
new file mode 100644
index 000000000..e7d946cf6
--- /dev/null
+++ b/web/src/elements/Interface/index.ts
@@ -0,0 +1,4 @@
+import { Interface } from "./Interface";
+
+export { Interface };
+export default Interface;
diff --git a/web/src/elements/PageHeader.ts b/web/src/elements/PageHeader.ts
index 83a783b1d..d7d7df9f0 100644
--- a/web/src/elements/PageHeader.ts
+++ b/web/src/elements/PageHeader.ts
@@ -8,7 +8,8 @@ import {
 } from "@goauthentik/common/constants";
 import { currentInterface } from "@goauthentik/common/sentry";
 import { me } from "@goauthentik/common/users";
-import { AKElement, rootInterface } from "@goauthentik/elements/Base";
+import { AKElement } from "@goauthentik/elements/Base";
+import { WithBrandConfig } from "@goauthentik/elements/Interface/brandProvider";
 import "@patternfly/elements/pf-tooltip/pf-tooltip.js";
 
 import { msg } from "@lit/localize";
@@ -23,7 +24,7 @@ import PFBase from "@patternfly/patternfly/patternfly-base.css";
 import { EventsApi } from "@goauthentik/api";
 
 @customElement("ak-page-header")
-export class PageHeader extends AKElement {
+export class PageHeader extends WithBrandConfig(AKElement) {
     @property()
     icon?: string;
 
@@ -35,9 +36,8 @@ export class PageHeader extends AKElement {
 
     @property()
     set header(value: string) {
-        const brand = rootInterface()?.brand;
         const currentIf = currentInterface();
-        let title = brand?.brandingTitle || TITLE_DEFAULT;
+        let title = this.brand?.brandingTitle || TITLE_DEFAULT;
         if (currentIf === "admin") {
             title = `${msg("Admin")} - ${title}`;
         }
diff --git a/web/src/elements/ak-locale-context/definitions.ts b/web/src/elements/ak-locale-context/definitions.ts
index e920e85b1..018c9e2a1 100644
--- a/web/src/elements/ak-locale-context/definitions.ts
+++ b/web/src/elements/ak-locale-context/definitions.ts
@@ -46,6 +46,8 @@ const LOCALE_TABLE: LocaleRow[] = [
     ["es",      /^es([_-]|$)/i,      () => msg("Spanish"),               async () => await import("@goauthentik/locales/es")],
     ["de",      /^de([_-]|$)/i,      () => msg("German"),                async () => await import("@goauthentik/locales/de")],
     ["fr",      /^fr([_-]|$)/i,      () => msg("French"),                async () => await import("@goauthentik/locales/fr")],
+    ["ko",      /^ko([_-]|$)/i,      () => msg("Korean"),                async () => await import("@goauthentik/locales/ko")],
+    ["nl",      /^nl([_-]|$)/i,      () => msg("Dutch"),                 async () => await import("@goauthentik/locales/nl")],
     ["pl",      /^pl([_-]|$)/i,      () => msg("Polish"),                async () => await import("@goauthentik/locales/pl")],
     ["tr",      /^tr([_-]|$)/i,      () => msg("Turkish"),               async () => await import("@goauthentik/locales/tr")],
     ["zh-Hant", /^zh[_-](HK|Hant)/i, () => msg("Chinese (traditional)"), async () => await import("@goauthentik/locales/zh-Hant")],
diff --git a/web/src/elements/enterprise/EnterpriseStatusBanner.ts b/web/src/elements/enterprise/EnterpriseStatusBanner.ts
index 0ac115457..09d376759 100644
--- a/web/src/elements/enterprise/EnterpriseStatusBanner.ts
+++ b/web/src/elements/enterprise/EnterpriseStatusBanner.ts
@@ -21,10 +21,8 @@ export class EnterpriseStatusBanner extends AKElement {
         return [PFBanner];
     }
 
-    firstUpdated(): void {
-        new EnterpriseApi(DEFAULT_CONFIG).enterpriseLicenseSummaryRetrieve().then((b) => {
-            this.summary = b;
-        });
+    async firstUpdated(): Promise<void> {
+        this.summary = await new EnterpriseApi(DEFAULT_CONFIG).enterpriseLicenseSummaryRetrieve();
     }
 
     renderBanner(): TemplateResult {
diff --git a/web/src/elements/sidebar/SidebarBrand.ts b/web/src/elements/sidebar/SidebarBrand.ts
index daf2c8ba5..a231cb78a 100644
--- a/web/src/elements/sidebar/SidebarBrand.ts
+++ b/web/src/elements/sidebar/SidebarBrand.ts
@@ -1,6 +1,6 @@
 import { EVENT_SIDEBAR_TOGGLE } from "@goauthentik/common/constants";
-import { first } from "@goauthentik/common/utils";
-import { AKElement, rootInterface } from "@goauthentik/elements/Base";
+import { AKElement } from "@goauthentik/elements/Base";
+import { WithBrandConfig } from "@goauthentik/elements/Interface/brandProvider";
 
 import { CSSResult, TemplateResult, css, html } from "lit";
 import { customElement } from "lit/decorators.js";
@@ -27,7 +27,7 @@ export const DefaultBrand: CurrentBrand = {
 };
 
 @customElement("ak-sidebar-brand")
-export class SidebarBrand extends AKElement {
+export class SidebarBrand extends WithBrandConfig(AKElement) {
     static get styles(): CSSResult[] {
         return [
             PFBase,
@@ -85,10 +85,7 @@ export class SidebarBrand extends AKElement {
             <a href="#/" class="pf-c-page__header-brand-link">
                 <div class="pf-c-brand ak-brand">
                     <img
-                        src="${first(
-                            rootInterface()?.brand?.brandingLogo,
-                            DefaultBrand.brandingLogo,
-                        )}"
+                        src=${this.brand?.brandingLogo ?? DefaultBrand.brandingLogo}
                         alt="authentik Logo"
                         loading="lazy"
                     />
diff --git a/web/src/elements/types.ts b/web/src/elements/types.ts
new file mode 100644
index 000000000..4273ab6f9
--- /dev/null
+++ b/web/src/elements/types.ts
@@ -0,0 +1,3 @@
+export interface AdoptedStyleSheetsElement {
+    adoptedStyleSheets: readonly CSSStyleSheet[];
+}
diff --git a/web/src/elements/utils/ensureCSSStyleSheet.ts b/web/src/elements/utils/ensureCSSStyleSheet.ts
new file mode 100644
index 000000000..26f2ff898
--- /dev/null
+++ b/web/src/elements/utils/ensureCSSStyleSheet.ts
@@ -0,0 +1,4 @@
+import { CSSResult } from "lit";
+
+export const ensureCSSStyleSheet = (css: CSSStyleSheet | CSSResult): CSSStyleSheet =>
+    css instanceof CSSResult ? css.styleSheet! : css;
diff --git a/web/src/enterprise/rac/index.ts b/web/src/enterprise/rac/index.ts
index 27a8623e0..9761462e4 100644
--- a/web/src/enterprise/rac/index.ts
+++ b/web/src/enterprise/rac/index.ts
@@ -1,5 +1,5 @@
 import { TITLE_DEFAULT } from "@goauthentik/app/common/constants";
-import { Interface } from "@goauthentik/elements/Base";
+import { Interface } from "@goauthentik/elements/Interface";
 import "@goauthentik/elements/LoadingOverlay";
 import Guacamole from "guacamole-common-js";
 
diff --git a/web/src/flow/FlowExecutor.ts b/web/src/flow/FlowExecutor.ts
index 3d3f1940c..6c444a0a1 100644
--- a/web/src/flow/FlowExecutor.ts
+++ b/web/src/flow/FlowExecutor.ts
@@ -8,7 +8,7 @@ import { globalAK } from "@goauthentik/common/global";
 import { configureSentry } from "@goauthentik/common/sentry";
 import { first } from "@goauthentik/common/utils";
 import { WebsocketClient } from "@goauthentik/common/ws";
-import { Interface } from "@goauthentik/elements/Base";
+import { Interface } from "@goauthentik/elements/Interface";
 import "@goauthentik/elements/LoadingOverlay";
 import "@goauthentik/elements/ak-locale-context";
 import "@goauthentik/flow/sources/apple/AppleLoginInit";
diff --git a/web/src/flow/stages/authenticator_validate/AuthenticatorValidateStage.ts b/web/src/flow/stages/authenticator_validate/AuthenticatorValidateStage.ts
index 8331938db..aecd93087 100644
--- a/web/src/flow/stages/authenticator_validate/AuthenticatorValidateStage.ts
+++ b/web/src/flow/stages/authenticator_validate/AuthenticatorValidateStage.ts
@@ -89,6 +89,9 @@ export class AuthenticatorValidateStage
                 display: flex;
                 align-items: center;
             }
+            :host([theme="dark"]) .authenticator-button {
+                color: var(--ak-dark-foreground) !important;
+            }
             i {
                 font-size: 1.5rem;
                 padding: 1rem 0;
diff --git a/web/src/flow/stages/prompt/PromptStage.ts b/web/src/flow/stages/prompt/PromptStage.ts
index 877d02119..09cc6959e 100644
--- a/web/src/flow/stages/prompt/PromptStage.ts
+++ b/web/src/flow/stages/prompt/PromptStage.ts
@@ -1,6 +1,9 @@
-import { rootInterface } from "@goauthentik/elements/Base";
 import "@goauthentik/elements/Divider";
 import "@goauthentik/elements/EmptyState";
+import {
+    CapabilitiesEnum,
+    WithCapabilitiesConfig,
+} from "@goauthentik/elements/Interface/capabilitiesProvider";
 import { LOCALES } from "@goauthentik/elements/ak-locale-context/definitions";
 import "@goauthentik/elements/forms/FormElement";
 import { BaseStage } from "@goauthentik/flow/stages/base";
@@ -20,7 +23,6 @@ import PFTitle from "@patternfly/patternfly/components/Title/title.css";
 import PFBase from "@patternfly/patternfly/patternfly-base.css";
 
 import {
-    CapabilitiesEnum,
     PromptChallenge,
     PromptChallengeResponseRequest,
     PromptTypeEnum,
@@ -28,7 +30,9 @@ import {
 } from "@goauthentik/api";
 
 @customElement("ak-stage-prompt")
-export class PromptStage extends BaseStage<PromptChallenge, PromptChallengeResponseRequest> {
+export class PromptStage extends WithCapabilitiesConfig(
+    BaseStage<PromptChallenge, PromptChallengeResponseRequest>,
+) {
     static get styles(): CSSResult[] {
         return [
             PFBase,
@@ -193,10 +197,7 @@ ${prompt.initialValue}</textarea
                     </div> `;
                 })}`;
             case PromptTypeEnum.AkLocale: {
-                const inDebug = rootInterface()?.config?.capabilities.includes(
-                    CapabilitiesEnum.CanDebug,
-                );
-                const locales = inDebug
+                const locales = this.can(CapabilitiesEnum.CanDebug)
                     ? LOCALES
                     : LOCALES.filter((locale) => locale.code !== "debug");
                 const options = locales.map(
diff --git a/web/src/locale-codes.ts b/web/src/locale-codes.ts
index 86337dc8d..8b7a36ac1 100644
--- a/web/src/locale-codes.ts
+++ b/web/src/locale-codes.ts
@@ -15,10 +15,13 @@ export const targetLocales = [
   `en`,
   `es`,
   `fr`,
+  `ko`,
+  `nl`,
   `pl`,
   `pseudo-LOCALE`,
   `tr`,
   `zh_TW`,
+  `zh-CN`,
   `zh-Hans`,
   `zh-Hant`,
 ] as const;
@@ -32,10 +35,13 @@ export const allLocales = [
   `en`,
   `es`,
   `fr`,
+  `ko`,
+  `nl`,
   `pl`,
   `pseudo-LOCALE`,
   `tr`,
   `zh_TW`,
+  `zh-CN`,
   `zh-Hans`,
   `zh-Hant`,
 ] as const;
diff --git a/web/src/standalone/api-browser/index.ts b/web/src/standalone/api-browser/index.ts
index b9b973c96..703caed24 100644
--- a/web/src/standalone/api-browser/index.ts
+++ b/web/src/standalone/api-browser/index.ts
@@ -2,7 +2,7 @@ import { CSRFHeaderName } from "@goauthentik/common/api/middleware";
 import { EVENT_THEME_CHANGE } from "@goauthentik/common/constants";
 import { globalAK } from "@goauthentik/common/global";
 import { first, getCookie } from "@goauthentik/common/utils";
-import { Interface } from "@goauthentik/elements/Base";
+import { Interface } from "@goauthentik/elements/Interface";
 import "@goauthentik/elements/ak-locale-context";
 import { DefaultBrand } from "@goauthentik/elements/sidebar/SidebarBrand";
 import "rapidoc";
diff --git a/web/src/standalone/loading/index.ts b/web/src/standalone/loading/index.ts
index 6d22f5ed7..e1d54f323 100644
--- a/web/src/standalone/loading/index.ts
+++ b/web/src/standalone/loading/index.ts
@@ -1,5 +1,5 @@
 import { globalAK } from "@goauthentik/common/global";
-import { Interface } from "@goauthentik/elements/Base";
+import { Interface } from "@goauthentik/elements/Interface";
 
 import { msg } from "@lit/localize";
 import { CSSResult, TemplateResult, css, html } from "lit";
diff --git a/web/src/stories/interface.ts b/web/src/stories/interface.ts
index c4e2dc03d..1eafc6204 100644
--- a/web/src/stories/interface.ts
+++ b/web/src/stories/interface.ts
@@ -1,4 +1,4 @@
-import { Interface } from "@goauthentik/app/elements/Base";
+import { Interface } from "@goauthentik/app/elements/Interface";
 
 import { customElement, property } from "lit/decorators.js";
 
diff --git a/web/src/user/UserInterface.ts b/web/src/user/UserInterface.ts
index bef0aa2c1..be0d7ef9b 100644
--- a/web/src/user/UserInterface.ts
+++ b/web/src/user/UserInterface.ts
@@ -9,7 +9,7 @@ import { UserDisplay } from "@goauthentik/common/ui/config";
 import { me } from "@goauthentik/common/users";
 import { first } from "@goauthentik/common/utils";
 import { WebsocketClient } from "@goauthentik/common/ws";
-import { Interface } from "@goauthentik/elements/Base";
+import { Interface } from "@goauthentik/elements/Interface";
 import "@goauthentik/elements/ak-locale-context";
 import "@goauthentik/elements/buttons/ActionButton";
 import "@goauthentik/elements/enterprise/EnterpriseStatusBanner";
diff --git a/web/src/user/user-settings/details/UserSettingsFlowExecutor.ts b/web/src/user/user-settings/details/UserSettingsFlowExecutor.ts
index 6c78e1bb9..cae5ad800 100644
--- a/web/src/user/user-settings/details/UserSettingsFlowExecutor.ts
+++ b/web/src/user/user-settings/details/UserSettingsFlowExecutor.ts
@@ -2,14 +2,15 @@ import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
 import { EVENT_REFRESH } from "@goauthentik/common/constants";
 import { MessageLevel } from "@goauthentik/common/messages";
 import { refreshMe } from "@goauthentik/common/users";
-import { AKElement, rootInterface } from "@goauthentik/elements/Base";
+import { AKElement } from "@goauthentik/elements/Base";
+import { WithBrandConfig } from "@goauthentik/elements/Interface/brandProvider";
 import { showMessage } from "@goauthentik/elements/messages/MessageContainer";
 import { StageHost } from "@goauthentik/flow/stages/base";
 import "@goauthentik/user/user-settings/details/stages/prompt/PromptStage";
 
 import { msg } from "@lit/localize";
 import { CSSResult, TemplateResult, html } from "lit";
-import { customElement, property, state } from "lit/decorators.js";
+import { customElement, property } from "lit/decorators.js";
 import { unsafeHTML } from "lit/directives/unsafe-html.js";
 
 import PFButton from "@patternfly/patternfly/components/Button/button.css";
@@ -21,7 +22,6 @@ import PFBase from "@patternfly/patternfly/patternfly-base.css";
 import {
     ChallengeChoices,
     ChallengeTypes,
-    CurrentBrand,
     FlowChallengeResponseRequest,
     FlowErrorChallenge,
     FlowsApi,
@@ -31,13 +31,19 @@ import {
 } from "@goauthentik/api";
 
 @customElement("ak-user-settings-flow-executor")
-export class UserSettingsFlowExecutor extends AKElement implements StageHost {
+export class UserSettingsFlowExecutor
+    extends WithBrandConfig(AKElement, true)
+    implements StageHost
+{
     @property()
     flowSlug?: string;
 
+<<<<<<< HEAD
     @state()
     brand?: CurrentBrand;
 
+=======
+>>>>>>> main
     private _challenge?: ChallengeTypes;
 
     @property({ attribute: false })
@@ -87,7 +93,6 @@ export class UserSettingsFlowExecutor extends AKElement implements StageHost {
     }
 
     firstUpdated(): void {
-        this.brand = rootInterface()?.brand;
         this.flowSlug = this.brand?.flowUserSettings;
         if (!this.flowSlug) {
             return;
diff --git a/web/xliff/de.xlf b/web/xliff/de.xlf
index 5d7e39665..07b465224 100644
--- a/web/xliff/de.xlf
+++ b/web/xliff/de.xlf
@@ -6192,6 +6192,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s6dd297c217729828">
   <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
 </trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+</trans-unit>
 <trans-unit id="s744401846fea6e76">
   <source>Brand</source>
 </trans-unit>
@@ -6222,6 +6234,12 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sa9d13ce9e83aac17">
   <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
 </trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
 <trans-unit id="s6709b81e1ed4e39f">
   <source>The current brand must have a recovery flow configured to use a recovery link</source>
 </trans-unit>
diff --git a/web/xliff/en.xlf b/web/xliff/en.xlf
index 003266f4c..64b02ea4b 100644
--- a/web/xliff/en.xlf
+++ b/web/xliff/en.xlf
@@ -6467,6 +6467,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s6dd297c217729828">
   <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
 </trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+</trans-unit>
 <trans-unit id="s744401846fea6e76">
   <source>Brand</source>
 </trans-unit>
@@ -6497,6 +6509,12 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sa9d13ce9e83aac17">
   <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
 </trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
 <trans-unit id="s6709b81e1ed4e39f">
   <source>The current brand must have a recovery flow configured to use a recovery link</source>
 </trans-unit>
diff --git a/web/xliff/es.xlf b/web/xliff/es.xlf
index 0c0e2ba01..3227a22fc 100644
--- a/web/xliff/es.xlf
+++ b/web/xliff/es.xlf
@@ -6108,6 +6108,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s6dd297c217729828">
   <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
 </trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+</trans-unit>
 <trans-unit id="s744401846fea6e76">
   <source>Brand</source>
 </trans-unit>
@@ -6138,6 +6150,12 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sa9d13ce9e83aac17">
   <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
 </trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
 <trans-unit id="s6709b81e1ed4e39f">
   <source>The current brand must have a recovery flow configured to use a recovery link</source>
 </trans-unit>
diff --git a/web/xliff/fr.xlf b/web/xliff/fr.xlf
index 3ca62e1a1..7de6da523 100644
--- a/web/xliff/fr.xlf
+++ b/web/xliff/fr.xlf
@@ -8143,6 +8143,18 @@ Les liaisons avec les groupes/utilisateurs sont vérifiées par rapport à l'uti
   <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
   <target>Détermine combien de temps une session dure avant déconnexion et ré-authorisation.</target>
 </trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+</trans-unit>
 <trans-unit id="s744401846fea6e76">
   <source>Brand</source>
 </trans-unit>
@@ -8173,6 +8185,12 @@ Les liaisons avec les groupes/utilisateurs sont vérifiées par rapport à l'uti
 <trans-unit id="sa9d13ce9e83aac17">
   <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
 </trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
 <trans-unit id="s6709b81e1ed4e39f">
   <source>The current brand must have a recovery flow configured to use a recovery link</source>
 </trans-unit>
diff --git a/web/xliff/ko.xlf b/web/xliff/ko.xlf
index ed1d838d9..2f83fbe37 100644
--- a/web/xliff/ko.xlf
+++ b/web/xliff/ko.xlf
@@ -1,4 +1,4 @@
-<?xml version="1.0" ?><xliff xmlns="urn:oasis:names:tc:xliff:document:1.2" version="1.2">
+<?xml version="1.0"?><xliff xmlns="urn:oasis:names:tc:xliff:document:1.2" version="1.2">
   <file target-language="ko" source-language="en" original="lit-localize-inputs" datatype="plaintext">
     <body>
       <trans-unit id="s4caed5b7a7e5d89b">
@@ -443,11 +443,6 @@
         <source>Client IP</source>
         <target>클라이언트 IP</target>
         
-      </trans-unit>
-      <trans-unit id="s45f9e7ce0897f9e5">
-        <source>Tenant</source>
-        <target>테넌트</target>
-        
       </trans-unit>
       <trans-unit id="s2152f3482784705f">
         <source>Recent events</source>
@@ -612,8 +607,8 @@
         
       </trans-unit>
       <trans-unit id="saa0e2675da69651b">
-        <source>The URL &quot;<x id="0" equiv-text="${this.url}"/>&quot; was not found.</source>
-        <target>URL &quot;<x id="0" equiv-text="${this.url}"/>&quot; 을 찾을 수 없습니다.</target>
+        <source>The URL "<x id="0" equiv-text="${this.url}"/>" was not found.</source>
+        <target>URL "<x id="0" equiv-text="${this.url}"/>" 을 찾을 수 없습니다.</target>
         
       </trans-unit>
       <trans-unit id="s58cd9c2fe836d9c6">
@@ -1054,8 +1049,8 @@
         
       </trans-unit>
       <trans-unit id="sa8384c9c26731f83">
-        <source>To allow any redirect URI, set this value to &quot;.*&quot;. Be aware of the possible security implications this can have.</source>
-        <target>리디렉션 URI를 허용하려면 이 값을 &quot;.*&quot;로 설정합니다. 이로 인해 발생할 수 있는 보안상의 영향에 유의하세요.</target>
+        <source>To allow any redirect URI, set this value to ".*". Be aware of the possible security implications this can have.</source>
+        <target>리디렉션 URI를 허용하려면 이 값을 ".*"로 설정합니다. 이로 인해 발생할 수 있는 보안상의 영향에 유의하세요.</target>
         
       </trans-unit>
       <trans-unit id="s55787f4dfcdce52b">
@@ -1792,8 +1787,8 @@
         
       </trans-unit>
       <trans-unit id="sa90b7809586c35ce">
-        <source>Either input a full URL, a relative path, or use 'fa://fa-test' to use the Font Awesome icon &quot;fa-test&quot;.</source>
-        <target>전체 URL, 상대 경로를 입력하거나, 또는 'fa://fa-test'를 사용하여 Font Awesome 아이콘 &quot;fa-test&quot;를 사용합니다.</target>
+        <source>Either input a full URL, a relative path, or use 'fa://fa-test' to use the Font Awesome icon "fa-test".</source>
+        <target>전체 URL, 상대 경로를 입력하거나, 또는 'fa://fa-test'를 사용하여 Font Awesome 아이콘 "fa-test"를 사용합니다.</target>
         
       </trans-unit>
       <trans-unit id="s0410779cb47de312">
@@ -2972,7 +2967,7 @@ doesn't pass when either or both of the selected options are equal or above the
         
       </trans-unit>
       <trans-unit id="s76768bebabb7d543">
-        <source>Field which contains members of a group. Note that if using the &quot;memberUid&quot; field, the value is assumed to contain a relative distinguished name. e.g. 'memberUid=some-user' instead of 'memberUid=cn=some-user,ou=groups,...'</source>
+        <source>Field which contains members of a group. Note that if using the "memberUid" field, the value is assumed to contain a relative distinguished name. e.g. 'memberUid=some-user' instead of 'memberUid=cn=some-user,ou=groups,...'</source>
         <target>그룹 구성원이 포함된 필드입니다. 'memberUid' 필드를 사용하는 경우 값에 상대적인 고유 이름이 포함된 것으로 가정합니다 (예:'memberUid=some-user' 대신 'memberUid=cn=some-user,ou=groups,...').</target>
         
       </trans-unit>
@@ -3617,16 +3612,6 @@ doesn't pass when either or both of the selected options are equal or above the
         <source>Update Token</source>
         <target>토큰 업데이트</target>
         
-      </trans-unit>
-      <trans-unit id="s0af6301e76e2a2a5">
-        <source>Successfully updated tenant.</source>
-        <target>테넌트를 성공적으로 업데이트했습니다.</target>
-        
-      </trans-unit>
-      <trans-unit id="sf55c7c06dbc2c8c6">
-        <source>Successfully created tenant.</source>
-        <target>테넌트를 성공적으로 만들었습니다.</target>
-        
       </trans-unit>
       <trans-unit id="s41706a202b6c40f1">
         <source>Domain</source>
@@ -3642,11 +3627,6 @@ doesn't pass when either or both of the selected options are equal or above the
         <source>Default</source>
         <target>기본</target>
         
-      </trans-unit>
-      <trans-unit id="se1c85959463f53df">
-        <source>Use this tenant for each domain that doesn't have a dedicated tenant.</source>
-        <target>전용 테넌트가 없는 각 도메인에 이 테넌트를 사용하세요.</target>
-        
       </trans-unit>
       <trans-unit id="sc19838ca8c135c1b">
         <source>Branding settings</source>
@@ -3764,29 +3744,14 @@ doesn't pass when either or both of the selected options are equal or above the
         
       </trans-unit>
       <trans-unit id="s7b1fba26d245cb1c">
-        <source>When using an external logging solution for archiving, this can be set to &quot;minutes=5&quot;.</source>
-        <target>아카이브에 외부 로깅 솔루션을 사용하는 경우, 이 값을 &quot;minutes=5&quot;로 설정할 수 있습니다.</target>
+        <source>When using an external logging solution for archiving, this can be set to "minutes=5".</source>
+        <target>아카이브에 외부 로깅 솔루션을 사용하는 경우, 이 값을 "minutes=5"로 설정할 수 있습니다.</target>
         
       </trans-unit>
       <trans-unit id="s44536d20bb5c8257">
         <source>This setting only affects new Events, as the expiration is saved per-event.</source>
         <target>T만료는 이벤트별로 저장되므로 설정은 새 이벤트에만 영향을 줍니다.</target>
         
-      </trans-unit>
-      <trans-unit id="s3bb51cabb02b997e">
-        <source>Format: &quot;weeks=3;days=2;hours=3,seconds=2&quot;.</source>
-        <target>서식: &quot;weeks=3;days=2;hours=3,seconds=2&quot;.</target>
-        
-      </trans-unit>
-      <trans-unit id="s04bfd02201db5ab8">
-        <source>Set custom attributes using YAML or JSON. Any attributes set here will be inherited by users, if the request is handled by this tenant.</source>
-        <target>YAML 또는 JSON을 사용하여 사용자 지정 속성을 설정합니다. 이 테넌트가 요청을 처리하는 경우 여기에서 설정한 모든 속성은 사용자가 상속받게 됩니다.</target>
-        
-      </trans-unit>
-      <trans-unit id="s7f9e79189a3d19e2">
-        <source>Tenants</source>
-        <target>테넌트</target>
-        
       </trans-unit>
       <trans-unit id="s164be9a7537b99f6">
         <source>Configure visual settings and defaults for different domains.</source>
@@ -3797,21 +3762,6 @@ doesn't pass when either or both of the selected options are equal or above the
         <source>Default?</source>
         <target>기본값?</target>
         
-      </trans-unit>
-      <trans-unit id="s69a56a3022c4be7f">
-        <source>Tenant(s)</source>
-        <target>테넌트</target>
-        
-      </trans-unit>
-      <trans-unit id="s1b606acd76ba2c4c">
-        <source>Update Tenant</source>
-        <target>테넌트 업데이트</target>
-        
-      </trans-unit>
-      <trans-unit id="s773aa6621d7e37b7">
-        <source>Create Tenant</source>
-        <target>테넌트 생성</target>
-        
       </trans-unit>
       <trans-unit id="s8cb7bb82e96d5d77">
         <source>Policies</source>
@@ -3967,8 +3917,8 @@ doesn't pass when either or both of the selected options are equal or above the
         
       </trans-unit>
       <trans-unit id="sa95a538bfbb86111">
-        <source>Are you sure you want to update <x id="0" equiv-text="${this.objectLabel}"/> &quot;<x id="1" equiv-text="${this.obj?.name}"/>&quot;?</source>
-        <target>정말 <x id="0" equiv-text="${this.objectLabel}"/> &quot;<x id="1" equiv-text="${this.obj?.name}"/>&quot; 을(를) 업데이트 하시겠습니까?</target>
+        <source>Are you sure you want to update <x id="0" equiv-text="${this.objectLabel}"/> "<x id="1" equiv-text="${this.obj?.name}"/>"?</source>
+        <target>정말 <x id="0" equiv-text="${this.objectLabel}"/> "<x id="1" equiv-text="${this.obj?.name}"/>" 을(를) 업데이트 하시겠습니까?</target>
         
       </trans-unit>
       <trans-unit id="sc92d7cfb6ee1fec6">
@@ -4081,11 +4031,6 @@ doesn't pass when either or both of the selected options are equal or above the
         <source>Recovery link cannot be emailed, user has no email address saved.</source>
         <target>복구 링크를 이메일로 보낼 수 없습니다. 사용자가 저장한 이메일 주소가 없습니다.</target>
         
-      </trans-unit>
-      <trans-unit id="s63d89a6ae0969c30">
-        <source>To let a user directly reset a their password, configure a recovery flow on the currently active tenant.</source>
-        <target>사용자가 직접 비밀번호를 재설정할 수 있도록 하려면 현재 활성 상태인 테넌트에서 복구 플로우를 구성하세요.</target>
-        
       </trans-unit>
       <trans-unit id="s720594461542943f">
         <source>Add User</source>
@@ -5052,8 +4997,8 @@ doesn't pass when either or both of the selected options are equal or above the
         
       </trans-unit>
       <trans-unit id="sdf1d8edef27236f0">
-        <source>A &quot;roaming&quot; authenticator, like a YubiKey</source>
-        <target>YubiKey 같은 &quot;로밍&quot; 인증기</target>
+        <source>A "roaming" authenticator, like a YubiKey</source>
+        <target>YubiKey 같은 "로밍" 인증기</target>
         
       </trans-unit>
       <trans-unit id="sfffba7b23d8fb40c">
@@ -5387,8 +5332,8 @@ doesn't pass when either or both of the selected options are equal or above the
         
       </trans-unit>
       <trans-unit id="s2d5f69929bb7221d">
-        <source><x id="0" equiv-text="${prompt.name}"/> (&quot;<x id="1" equiv-text="${prompt.fieldKey}"/>&quot;, of type <x id="2" equiv-text="${prompt.type}"/>)</source>
-        <target><x id="0" equiv-text="${prompt.name}"/> (&quot;<x id="1" equiv-text="${prompt.fieldKey}"/>&quot;, of type <x id="2" equiv-text="${prompt.type}"/>)</target>
+        <source><x id="0" equiv-text="${prompt.name}"/> ("<x id="1" equiv-text="${prompt.fieldKey}"/>", of type <x id="2" equiv-text="${prompt.type}"/>)</source>
+        <target><x id="0" equiv-text="${prompt.name}"/> ("<x id="1" equiv-text="${prompt.fieldKey}"/>", of type <x id="2" equiv-text="${prompt.type}"/>)</target>
         
       </trans-unit>
       <trans-unit id="s3b7b519444181264">
@@ -5436,7 +5381,7 @@ doesn't pass when either or both of the selected options are equal or above the
         
       </trans-unit>
       <trans-unit id="s1608b2f94fa0dbd4">
-        <source>If set to a duration above 0, the user will have the option to choose to &quot;stay signed in&quot;, which will extend their session by the time specified here.</source>
+        <source>If set to a duration above 0, the user will have the option to choose to "stay signed in", which will extend their session by the time specified here.</source>
         <target>기간을 0 이상으로 설정하면, 사용자에게 '로그인 상태 유지'를 선택할 수 있는 옵션이 제공되며, 이 경우 세션이 여기에 지정된 시간만큼 연장됩니다.</target>
         
       </trans-unit>
@@ -7813,10 +7758,6 @@ Bindings to groups/users are checked against the user of the event.</source>
   <source>A copy of this recovery link has been placed in your clipboard</source>
   <target>이 복구 링크의 사본이 클립보드에 저장되었습니다.</target>
 </trans-unit>
-<trans-unit id="s5b8ee296ed258568">
-  <source>The current tenant must have a recovery flow configured to use a recovery link</source>
-  <target>현재 테넌트에 복구 링크를 사용하도록 구성된 복구 플로우가 있어야 합니다.</target>
-</trans-unit>
 <trans-unit id="s895514dda9cb9c94">
   <source>Create recovery link</source>
   <target>복구 링크 생성</target>
@@ -7926,8 +7867,8 @@ Bindings to groups/users are checked against the user of the event.</source>
   <target>사용자 생성과 <x id="0" equiv-text="${this.group.name}"/> 그룹 추가에 성공했습니다.</target>
 </trans-unit>
 <trans-unit id="s824e0943a7104668">
-  <source>This user will be added to the group &quot;<x id="0" equiv-text="${this.targetGroup.name}"/>&quot;.</source>
-  <target>이 사용자는 &quot;<x id="0" equiv-text="${this.targetGroup.name}"/>&quot; 그룹에 추가됩니다.</target>
+  <source>This user will be added to the group "<x id="0" equiv-text="${this.targetGroup.name}"/>".</source>
+  <target>이 사용자는 "<x id="0" equiv-text="${this.targetGroup.name}"/>" 그룹에 추가됩니다.</target>
 </trans-unit>
 <trans-unit id="s62e7f6ed7d9cb3ca">
   <source>Pretend user exists</source>
@@ -8004,7 +7945,261 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s047a5f0211fedc72">
   <source>Require Outpost (flow can only be executed from an outpost).</source>
   <target>Outpost필요 (플로우는 Outpost에서만 실행할 수 있음).</target>
+</trans-unit>
+<trans-unit id="s744401846fea6e76">
+  <source>Brand</source>
+</trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+</trans-unit>
+<trans-unit id="sa2ea0fcd3ffa80e0">
+  <source>Connection expiry</source>
+</trans-unit>
+<trans-unit id="s6dd297c217729828">
+  <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
+</trans-unit>
+<trans-unit id="s3271da6c18c25b18">
+  <source>Connection settings.</source>
+</trans-unit>
+<trans-unit id="s2f4ca2148183d692">
+  <source>Successfully updated endpoint.</source>
+</trans-unit>
+<trans-unit id="s5adee855dbe191d9">
+  <source>Successfully created endpoint.</source>
+</trans-unit>
+<trans-unit id="s61e136c0658e27d5">
+  <source>Protocol</source>
+</trans-unit>
+<trans-unit id="sa062b019ff0c8809">
+  <source>RDP</source>
+</trans-unit>
+<trans-unit id="s97f9bf19fa5b57d1">
+  <source>SSH</source>
+</trans-unit>
+<trans-unit id="s7c100119e9ffcc32">
+  <source>VNC</source>
+</trans-unit>
+<trans-unit id="s6b05f9d8801fc14f">
+  <source>Host</source>
+</trans-unit>
+<trans-unit id="sb474f652a2c2fc76">
+  <source>Hostname/IP to connect to.</source>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+</trans-unit>
+<trans-unit id="s8276649077e8715c">
+  <source>Endpoint(s)</source>
+</trans-unit>
+<trans-unit id="sf1dabfe0fe8a75ad">
+  <source>Update Endpoint</source>
+</trans-unit>
+<trans-unit id="s008496c7716b9812">
+  <source>These bindings control which users will have access to this endpoint. Users must also have access to the application.</source>
+</trans-unit>
+<trans-unit id="s38e7cd1a24e70faa">
+  <source>Create Endpoint</source>
+</trans-unit>
+<trans-unit id="s4770c10e5b1c028c">
+  <source>RAC is in preview.</source>
+</trans-unit>
+<trans-unit id="s168565f5ac74a89f">
+  <source>Update RAC Provider</source>
+</trans-unit>
+<trans-unit id="s8465a2caa2d9ea5d">
+  <source>Endpoints</source>
+</trans-unit>
+<trans-unit id="s9857d883d8eb98fc">
+  <source>General settings</source>
+</trans-unit>
+<trans-unit id="sd2066881798a1b96">
+  <source>RDP settings</source>
+</trans-unit>
+<trans-unit id="sb864dc36a463a155">
+  <source>Ignore server certificate</source>
+</trans-unit>
+<trans-unit id="s20366a8d1eaaca54">
+  <source>Enable wallpaper</source>
+</trans-unit>
+<trans-unit id="s1e44c5350ef7598c">
+  <source>Enable font-smoothing</source>
+</trans-unit>
+<trans-unit id="s04ff5d6ae711e6d6">
+  <source>Enable full window dragging</source>
+</trans-unit>
+<trans-unit id="sab21e1f62676b56c">
+  <source>Successfully updated brand.</source>
+</trans-unit>
+<trans-unit id="sa43e43fd3a23e22d">
+  <source>Successfully created brand.</source>
+</trans-unit>
+<trans-unit id="s41b3f9b4c98aabd9">
+  <source>Use this brand for each domain that doesn't have a dedicated brand.</source>
+</trans-unit>
+<trans-unit id="s17260b71484b307f">
+  <source>Set custom attributes using YAML or JSON. Any attributes set here will be inherited by users, if the request is handled by this brand.</source>
+</trans-unit>
+<trans-unit id="s79fc990a2b58f27f">
+  <source>Brands</source>
+</trans-unit>
+<trans-unit id="s02774bc46a167346">
+  <source>Brand(s)</source>
+</trans-unit>
+<trans-unit id="s801bf3d03f4a3ff1">
+  <source>Update Brand</source>
+</trans-unit>
+<trans-unit id="s5c3efec5330e0000">
+  <source>Create Brand</source>
+</trans-unit>
+<trans-unit id="sa9d13ce9e83aac17">
+  <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
+</trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
+<trans-unit id="s6709b81e1ed4e39f">
+  <source>The current brand must have a recovery flow configured to use a recovery link</source>
+</trans-unit>
+<trans-unit id="s663ccbfdf27e8dd0">
+  <source>Network binding</source>
+</trans-unit>
+<trans-unit id="sb108a06693c67753">
+  <source>No binding</source>
+</trans-unit>
+<trans-unit id="s5aab90c74f1233b8">
+  <source>Bind ASN</source>
+</trans-unit>
+<trans-unit id="s488303b048afe83b">
+  <source>Bind ASN and Network</source>
+</trans-unit>
+<trans-unit id="s3268dcfe0c8234dc">
+  <source>Bind ASN, Network and IP</source>
+</trans-unit>
+<trans-unit id="s226381aca231644f">
+  <source>Configure if sessions created by this stage should be bound to the Networks they were created in.</source>
+</trans-unit>
+<trans-unit id="s2555a1f20f3fd93e">
+  <source>GeoIP binding</source>
+</trans-unit>
+<trans-unit id="s3d63c78f93c9a92e">
+  <source>Bind Continent</source>
+</trans-unit>
+<trans-unit id="s395d5863b3a259b5">
+  <source>Bind Continent and Country</source>
+</trans-unit>
+<trans-unit id="s625ea0c32b4b136c">
+  <source>Bind Continent, Country and City</source>
+</trans-unit>
+<trans-unit id="s4bc7a1a88961be90">
+  <source>Configure if sessions created by this stage should be bound to their GeoIP-based location</source>
+</trans-unit>
+<trans-unit id="sa06cd519ff151b6d">
+  <source>RAC</source>
+</trans-unit>
+<trans-unit id="s634e2fd82c397576">
+  <source>Successfully updated settings.</source>
+</trans-unit>
+<trans-unit id="sb8e4edaea6f1d935">
+  <source>Avatars</source>
+</trans-unit>
+<trans-unit id="s945856050217c828">
+  <source>Configure how authentik should show avatars for users. The following values can be set:</source>
+</trans-unit>
+<trans-unit id="sf4ef4c8ce713f775">
+  <source>Disables per-user avatars and just shows a 1x1 pixel transparent picture</source>
+</trans-unit>
+<trans-unit id="s5446842a7e4a963b">
+  <source>Uses gravatar with the user's email address</source>
+</trans-unit>
+<trans-unit id="s35363b9e1cc2abd3">
+  <source>Generated avatars based on the user's name</source>
+</trans-unit>
+<trans-unit id="s48110ca292cad513">
+  <source>Any URL: If you want to use images hosted on another server, you can set any URL. Additionally, these placeholders can be used:</source>
+</trans-unit>
+<trans-unit id="sbe1dfda044bdc93b">
+  <source>The user's username</source>
+</trans-unit>
+<trans-unit id="s653f257c9c2d4dc5">
+  <source>The email address, md5 hashed</source>
+</trans-unit>
+<trans-unit id="s9c9183cd80916b4f">
+  <source>The user's UPN, if set (otherwise an empty string)</source>
+</trans-unit>
+<trans-unit id="h4963ed14d7e239a9">
+  <source>An attribute path like
+                                    <x id="0" equiv-text="&lt;code&gt;"/>attributes.something.avatar<x id="1" equiv-text="&lt;/code&gt;"/>, which can be used in
+                                    combination with the file field to allow users to upload custom
+                                    avatars for themselves.</source>
+</trans-unit>
+<trans-unit id="s4c80c34a67a6f1c9">
+  <source>Multiple values can be set, comma-separated, and authentik will fallback to the next mode when no avatar could be found.</source>
+</trans-unit>
+<trans-unit id="h2fafcc3ebafea2f8">
+  <source>For example, setting this to <x id="0" equiv-text="&lt;code&gt;"/>gravatar,initials<x id="1" equiv-text="&lt;/code&gt;"/> will
+                                attempt to get an avatar from Gravatar, and if the user has not
+                                configured on there, it will fallback to a generated avatar.</source>
+</trans-unit>
+<trans-unit id="sea247dfb18f696d2">
+  <source>Default user change name</source>
+</trans-unit>
+<trans-unit id="s078ffec0257621c0">
+  <source>Enable the ability for users to change their name.</source>
+</trans-unit>
+<trans-unit id="s26ad11b21253152b">
+  <source>Default user change email</source>
+</trans-unit>
+<trans-unit id="s5fc6c14d106f40d3">
+  <source>Enable the ability for users to change their email.</source>
+</trans-unit>
+<trans-unit id="s23564aa839755965">
+  <source>Default user change username</source>
+</trans-unit>
+<trans-unit id="s6d816a95ca43a99d">
+  <source>Enable the ability for users to change their username.</source>
+</trans-unit>
+<trans-unit id="s57b52b60ed5e2bc7">
+  <source>Footer links</source>
+</trans-unit>
+<trans-unit id="s7349802b2f7f99c2">
+  <source>This option configures the footer links on the flow executor pages. It must be a valid JSON list and can be used as follows:</source>
+</trans-unit>
+<trans-unit id="s166b59f3cc5d8ec3">
+  <source>GDPR compliance</source>
+</trans-unit>
+<trans-unit id="sb8b23770f899e5bb">
+  <source>When enabled, all the events caused by a user will be deleted upon the user's deletion.</source>
+</trans-unit>
+<trans-unit id="s29501761df0fe837">
+  <source>Impersonation</source>
+</trans-unit>
+<trans-unit id="s8f503553d8432487">
+  <source>Globally enable/disable impersonation.</source>
+</trans-unit>
+<trans-unit id="see1eb81c1f734079">
+  <source>System settings</source>
+</trans-unit>
+<trans-unit id="s28b99b59541f54ca">
+  <source>Connection failed after <x id="0" equiv-text="${this.connectionAttempt}"/> attempts.</source>
+</trans-unit>
+<trans-unit id="s7c7d956418e1c8c8">
+  <source>Re-connecting in <x id="0" equiv-text="${Math.max(1, delay / 1000)}"/> second(s).</source>
+</trans-unit>
+<trans-unit id="sfc003381f593d943">
+  <source>Connecting...</source>
+</trans-unit>
+<trans-unit id="s31aa94a0b3c7edb2">
+  <source>Select endpoint to connect to</source>
 </trans-unit>
     </body>
   </file>
-</xliff>
\ No newline at end of file
+</xliff>
diff --git a/web/xliff/nl.xlf b/web/xliff/nl.xlf
index f2ceeb89c..224b6ded8 100644
--- a/web/xliff/nl.xlf
+++ b/web/xliff/nl.xlf
@@ -1,4 +1,4 @@
-<?xml version="1.0" ?><xliff xmlns="urn:oasis:names:tc:xliff:document:1.2" version="1.2">
+<?xml version="1.0"?><xliff xmlns="urn:oasis:names:tc:xliff:document:1.2" version="1.2">
   <file target-language="nl" source-language="en" original="lit-localize-inputs" datatype="plaintext">
     <body>
       <trans-unit id="s4caed5b7a7e5d89b">
@@ -190,11 +190,6 @@
         <source>Messages</source>
         <target>Berichten</target>
         
-      </trans-unit>
-      <trans-unit id="sd6edc7752cdf0ef5">
-        <source>New version available!</source>
-        <target>Nieuwe versie beschikbaar!</target>
-        
       </trans-unit>
       <trans-unit id="s0a5401d4419f9958">
         <source>Using source</source>
@@ -445,11 +440,6 @@
         <source>Client IP</source>
         <target>Client-IP</target>
         
-      </trans-unit>
-      <trans-unit id="s45f9e7ce0897f9e5">
-        <source>Tenant</source>
-        <target>Tenant</target>
-        
       </trans-unit>
       <trans-unit id="s2152f3482784705f">
         <source>Recent events</source>
@@ -607,8 +597,8 @@
         
       </trans-unit>
       <trans-unit id="saa0e2675da69651b">
-        <source>The URL &quot;<x id="0" equiv-text="${this.url}"/>&quot; was not found.</source>
-        <target>De URL &quot;<x id="0" equiv-text="${this.url}"/>&quot; is niet gevonden.</target>
+        <source>The URL "<x id="0" equiv-text="${this.url}"/>" was not found.</source>
+        <target>De URL "<x id="0" equiv-text="${this.url}"/>" is niet gevonden.</target>
         
       </trans-unit>
       <trans-unit id="s58cd9c2fe836d9c6">
@@ -650,11 +640,6 @@
         <source>Manage users</source>
         <target>Gebruikers beheren</target>
         
-      </trans-unit>
-      <trans-unit id="s51cda7b1ebcd970f">
-        <source>Check release notes</source>
-        <target>Controleer release-opmerkingen</target>
-        
       </trans-unit>
       <trans-unit id="s8763a33c3d46aaf5">
         <source>Outpost status</source>
@@ -685,11 +670,6 @@
         <source>Objects created</source>
         <target>Gemaakte objecten</target>
         
-      </trans-unit>
-      <trans-unit id="s770baa8560fd8aa1">
-        <source>User statistics</source>
-        <target>Gebruikersstatistieken</target>
-        
       </trans-unit>
       <trans-unit id="sfbadb77fbc61efb8">
         <source>Users created per day in the last month</source>
@@ -1057,8 +1037,8 @@
         
       </trans-unit>
       <trans-unit id="sa8384c9c26731f83">
-        <source>To allow any redirect URI, set this value to &quot;.*&quot;. Be aware of the possible security implications this can have.</source>
-        <target>Om elke doorverwijzings-URI toe te staan, stelt u deze waarde in op &quot;.*&quot;. Wees u bewust van de mogelijke beveiligingsgevolgen hiervan.</target>
+        <source>To allow any redirect URI, set this value to ".*". Be aware of the possible security implications this can have.</source>
+        <target>Om elke doorverwijzings-URI toe te staan, stelt u deze waarde in op ".*". Wees u bewust van de mogelijke beveiligingsgevolgen hiervan.</target>
         
       </trans-unit>
       <trans-unit id="s55787f4dfcdce52b">
@@ -1285,11 +1265,6 @@
         <source>Validate SSL Certificates of upstream servers.</source>
         <target>Valideer SSL-certificaten van upstream-servers.</target>
         
-      </trans-unit>
-      <trans-unit id="s9c73dced379c37a2">
-        <source>Use this provider with nginx's auth_request or traefik's forwardAuth. Each application/domain needs its own provider. Additionally, on each domain, /outpost.goauthentik.io must be routed to the outpost (when using a manged outpost, this is done for you).</source>
-        <target>Gebruik deze provider met nginx's auth_request of traefik's forwardAuth. Elke toepassing/domein heeft zijn eigen provider nodig. Bovendien moet op elk domein /outpost.goauthentik.io worden gerouteerd naar de outpost (wanneer u een beheerde outpost gebruikt, wordt dit voor u gedaan).</target>
-        
       </trans-unit>
       <trans-unit id="s44c90273f08fb718">
         <source>Use this provider with nginx's auth_request or traefik's forwardAuth. Only a single provider is required per root domain. You can't do per-application authorization, but you don't have to create a provider for each application.</source>
@@ -1798,8 +1773,8 @@
         
       </trans-unit>
       <trans-unit id="sa90b7809586c35ce">
-        <source>Either input a full URL, a relative path, or use 'fa://fa-test' to use the Font Awesome icon &quot;fa-test&quot;.</source>
-        <target>Voer een volledige URL, een relatief pad in, of gebruik 'fa://fa-test' om het Font Awesome-pictogram &quot;fa-test&quot; te gebruiken.</target>
+        <source>Either input a full URL, a relative path, or use 'fa://fa-test' to use the Font Awesome icon "fa-test".</source>
+        <target>Voer een volledige URL, een relatief pad in, of gebruik 'fa://fa-test' om het Font Awesome-pictogram "fa-test" te gebruiken.</target>
         
       </trans-unit>
       <trans-unit id="s0410779cb47de312">
@@ -1826,11 +1801,6 @@
         <source>Slug</source>
         <target>Slug</target>
         
-      </trans-unit>
-      <trans-unit id="seb8407fa6607c683">
-        <source>Internal application name, used in URLs.</source>
-        <target>Interne naam van de applicatie, gebruikt in URL's.</target>
-        
       </trans-unit>
       <trans-unit id="sdae55084f6cb2662">
         <source>Optionally enter a group name. Applications with identical groups are shown grouped together.</source>
@@ -1846,11 +1816,6 @@
         <source>Select a provider that this application should use.</source>
         <target>Selecteer een provider die door deze applicatie moet worden gebruikt.</target>
         
-      </trans-unit>
-      <trans-unit id="scd5dff009d1fd847">
-        <source>Backchannel providers</source>
-        <target>Backchannel providers</target>
-        
       </trans-unit>
       <trans-unit id="s4c6534a118f52fdd">
         <source>Select backchannel providers which augment the functionality of the main provider.</source>
@@ -2216,11 +2181,6 @@
         <source>NameID attribute</source>
         <target>NameID-eigenschap</target>
         
-      </trans-unit>
-      <trans-unit id="sf05c693a6e270b79">
-        <source>SCIM provider is in preview.</source>
-        <target>SCIM-provider is in voorbeeldweergave.</target>
-        
       </trans-unit>
       <trans-unit id="s2f0f6691de0b0388">
         <source>Warning: Provider is not assigned to an application as backchannel provider.</source>
@@ -2231,56 +2191,16 @@
         <source>Update SCIM Provider</source>
         <target>SCIM-provider bijwerken</target>
         
-      </trans-unit>
-      <trans-unit id="s7da38af36522ff6a">
-        <source>Sync not run yet.</source>
-        <target>Synchronisatie nog niet uitgevoerd.</target>
-        
       </trans-unit>
       <trans-unit id="sbecf8dc03c978d15">
         <source>Run sync again</source>
         <target>Voer synchronisatie opnieuw uit</target>
         
-      </trans-unit>
-      <trans-unit id="sf6a518045ea398f7">
-        <source>Application details</source>
-        <target>Applicatie details</target>
-        
-      </trans-unit>
-      <trans-unit id="s51b0102a7d31d0bf">
-        <source>Create application</source>
-        <target>Maak applicatie aan</target>
-        
-      </trans-unit>
-      <trans-unit id="sdae3a34cfb38c10f">
-        <source>Additional UI settings</source>
-        <target>Extra UI-instellingen</target>
-        
-      </trans-unit>
-      <trans-unit id="s233d106d13420dd2">
-        <source>OAuth2/OIDC</source>
-        <target>OAuth2/OIDC</target>
-        
       </trans-unit>
       <trans-unit id="sc2cedfb22488ccb2">
         <source>Modern applications, APIs and Single-page applications.</source>
         <target>Moderne applicaties, API's en Single-page applicaties.</target>
         
-      </trans-unit>
-      <trans-unit id="s1d93562422eeac10">
-        <source>SAML</source>
-        <target>SAML</target>
-        
-      </trans-unit>
-      <trans-unit id="s5923f8a2226a414c">
-        <source>XML-based SSO standard. Use this if your application only supports SAML.</source>
-        <target>XML-gebaseerde SSO-standaard. Gebruik dit als uw applicatie alleen SAML ondersteunt.</target>
-        
-      </trans-unit>
-      <trans-unit id="s22f7a7ec3bc2c118">
-        <source>Legacy applications which don't natively support SSO.</source>
-        <target>Verouderde applicaties die SSO niet native ondersteunen.</target>
-        
       </trans-unit>
       <trans-unit id="sc3259eb55cf91e8c">
         <source>LDAP</source>
@@ -2291,176 +2211,16 @@
         <source>Provide an LDAP interface for applications and users to authenticate against.</source>
         <target>Geef een LDAP-interface voor applicaties en gebruikers om tegen te verifiëren.</target>
         
-      </trans-unit>
-      <trans-unit id="s3cf89cb47fdde7e9">
-        <source>Link</source>
-        <target>Koppeling</target>
-        
-      </trans-unit>
-      <trans-unit id="s7ccc013f41f0a2c2">
-        <source>Authentication method</source>
-        <target>Authenticatiemethode</target>
-        
-      </trans-unit>
-      <trans-unit id="sd45fc6453f617152">
-        <source>LDAP details</source>
-        <target>LDAP details</target>
-        
-      </trans-unit>
-      <trans-unit id="scf72690719b7a8a1">
-        <source>Create service account</source>
-        <target>Serviceaccount aanmaken</target>
-        
-      </trans-unit>
-      <trans-unit id="sbda06adbba493976">
-        <source>Create provider</source>
-        <target>Provider aanmaken</target>
-        
-      </trans-unit>
-      <trans-unit id="s12d0cb01d9f6f3b3">
-        <source>Application Link</source>
-        <target>Applicatiekoppeling</target>
-        
-      </trans-unit>
-      <trans-unit id="s54a13196915fd76c">
-        <source>URL which will be opened when a user clicks on the application.</source>
-        <target>URL die wordt geopend wanneer een gebruiker op de applicatie klikt.</target>
-        
-      </trans-unit>
-      <trans-unit id="sa34866db5e891cc6">
-        <source>Method details</source>
-        <target>Methode details</target>
-        
-      </trans-unit>
-      <trans-unit id="saf840955862a8cd0">
-        <source>This configuration can be used to authenticate to authentik with other APIs other otherwise programmatically.</source>
-        <target>Deze configuratie kan worden gebruikt om programmatisch te verifiëren bij authentik met andere API's.</target>
-        
-      </trans-unit>
-      <trans-unit id="sb2f3a45baaa52dfd">
-        <source>By default, all service accounts can authenticate as this application, as long as they have a valid token of the type app-password.</source>
-        <target>Standaard kunnen alle serviceaccounts zich verifiëren als deze applicatie, zolang ze een geldig token van het type app-wachtwoord hebben.</target>
-        
-      </trans-unit>
-      <trans-unit id="se0df976add086ec3">
-        <source>Web application</source>
-        <target>Webapplicatie</target>
-        
-      </trans-unit>
-      <trans-unit id="s042fb9b0f9acc21f">
-        <source>Applications which handle the authentication server-side (for example, Python, Go, Rust, Java, PHP)</source>
-        <target>Applicaties die de authenticatie serverzijde afhandelen (bijvoorbeeld Python, Go, Rust, Java, PHP)</target>
-        
-      </trans-unit>
-      <trans-unit id="sdf4bd51375026222">
-        <source>Single-page applications</source>
-        <target>Single-page applicaties</target>
-        
-      </trans-unit>
-      <trans-unit id="s7fa3c3306b77187d">
-        <source>Single-page applications which handle authentication in the browser (for example, Javascript, Angular, React, Vue)</source>
-        <target>Single-page applicaties die authenticatie in de browser afhandelen (bijvoorbeeld Javascript, Angular, React, Vue)</target>
-        
-      </trans-unit>
-      <trans-unit id="s3db92162f63a12b4">
-        <source>Native application</source>
-        <target>Natieve applicatie</target>
-        
-      </trans-unit>
-      <trans-unit id="s2f43274a59b0d384">
-        <source>Applications which redirect users to a non-web callback (for example, Android, iOS)</source>
-        <target>Applicaties die gebruikers doorverwijzen naar een niet-web callback (bijvoorbeeld Android, iOS)</target>
-        
-      </trans-unit>
-      <trans-unit id="sfa5f0019a09be6a7">
-        <source>API</source>
-        <target>API</target>
-        
-      </trans-unit>
-      <trans-unit id="s4d53cad956dfc4e4">
-        <source>Authentication without user interaction, or machine-to-machine authentication.</source>
-        <target>Authenticatie zonder gebruikersinteractie of machine-tot-machine authenticatie.</target>
-        
-      </trans-unit>
-      <trans-unit id="s134083b4613bcf87">
-        <source>Application type</source>
-        <target>Applicatietype</target>
-        
-      </trans-unit>
-      <trans-unit id="s649e7d74f27635f8">
-        <source>Flow used when users access this application.</source>
-        <target>Flow gebruikt wanneer gebruikers deze applicatie benaderen.</target>
-        
-      </trans-unit>
-      <trans-unit id="s9c1422a7e3d5c619">
-        <source>Proxy details</source>
-        <target>Proxy details</target>
-        
-      </trans-unit>
-      <trans-unit id="s7714fdf13df8b682">
-        <source>External domain</source>
-        <target>Extern domein</target>
-        
-      </trans-unit>
-      <trans-unit id="sf5a280bdcc775c49">
-        <source>External domain you will be accessing the domain from.</source>
-        <target>Extern domein waarvandaan u toegang heeft tot het domein.</target>
-        
-      </trans-unit>
-      <trans-unit id="sb11e750b3de9bb72">
-        <source>Import SAML Metadata</source>
-        <target>Importeer SAML Metadata</target>
-        
-      </trans-unit>
-      <trans-unit id="s0955bd1d1b1dc710">
-        <source>Import the metadata document of the applicaation you want to configure.</source>
-        <target>Importeer het metagegevensdocument van de applicatie die je wilt configureren.</target>
-        
-      </trans-unit>
-      <trans-unit id="s0be509fcae72af45">
-        <source>Manual configuration</source>
-        <target>Handmatige configuratie</target>
-        
-      </trans-unit>
-      <trans-unit id="s485b90ede24fdb19">
-        <source>Manually configure SAML</source>
-        <target>Configureer SAML handmatig</target>
-        
-      </trans-unit>
-      <trans-unit id="se7d73f906d358a46">
-        <source>SAML details</source>
-        <target>SAML details</target>
-        
-      </trans-unit>
-      <trans-unit id="s982a7cdc93aa6fbe">
-        <source>URL that authentik will redirect back to after successful authentication.</source>
-        <target>URL waarnaar authentik zal terugverwijzen na succesvolle authenticatie.</target>
-        
-      </trans-unit>
-      <trans-unit id="sc9e75f44b775aa52">
-        <source>Import SAML metadata</source>
-        <target>Importeer SAML metadata</target>
-        
       </trans-unit>
       <trans-unit id="s0c9670f429e74283">
         <source>New application</source>
         <target>Nieuwe applicatie</target>
         
-      </trans-unit>
-      <trans-unit id="s8e1d308c09d1b400">
-        <source>Create a new application.</source>
-        <target>Creëer een nieuwe applicatie.</target>
-        
       </trans-unit>
       <trans-unit id="s6ba50bb0842ba1e2">
         <source>Applications</source>
         <target>Applicaties</target>
         
-      </trans-unit>
-      <trans-unit id="sb9024c1640c4da12">
-        <source>External Applications which use authentik as Identity-Provider, utilizing protocols like OAuth2 and SAML. All applications are shown here, even ones you cannot access.</source>
-        <target>Externe applicaties die authentik gebruiken als Identity-Provider, met protocollen zoals OAuth2 en SAML. Alle applicaties worden hier getoond, zelfs degene waartoe u geen toegang heeft.</target>
-        
       </trans-unit>
       <trans-unit id="s96b2fefc550e4b1c">
         <source>Provider Type</source>
@@ -2771,31 +2531,6 @@
         <source>If the password's score is less than or equal this value, the policy will fail.</source>
         <target>Als de score van het wachtwoord kleiner is dan of gelijk is aan deze waarde, zal het beleid falen.</target>
         
-      </trans-unit>
-      <trans-unit id="s1bfe7505059d164f">
-        <source>0: Too guessable: risky password. (guesses &lt; 10^3)</source>
-        <target>0: Te voorspelbaar: risicovol wachtwoord. (pogingen &lt; 10^3)</target>
-        
-      </trans-unit>
-      <trans-unit id="s423d1f2477998d0b">
-        <source>1: Very guessable: protection from throttled online attacks. (guesses &lt; 10^6)</source>
-        <target>1: Zeer voorspelbaar: bescherming tegen afgeknepen online aanvallen. (pogingen &lt; 10^6)</target>
-        
-      </trans-unit>
-      <trans-unit id="s33849cc046eb901d">
-        <source>2: Somewhat guessable: protection from unthrottled online attacks. (guesses &lt; 10^8)</source>
-        <target>2: Enigszins voorspelbaar: bescherming tegen niet-afgeknepen online aanvallen. (pogingen &lt; 10^8)</target>
-        
-      </trans-unit>
-      <trans-unit id="s578dcce295718e1b">
-        <source>3: Safely unguessable: moderate protection from offline slow-hash scenario. (guesses &lt; 10^10)</source>
-        <target>3: Veilig onvoorspelbaar: matige bescherming tegen offline scenario met langzame hash. (pogingen &lt; 10^10)</target>
-        
-      </trans-unit>
-      <trans-unit id="s7a46de49f4eba5d7">
-        <source>4: Very unguessable: strong protection from offline slow-hash scenario. (guesses &gt;= 10^10)</source>
-        <target>4: Zeer onvoorspelbaar: sterke bescherming tegen offline scenario met langzame hash. (pogingen &gt;= 10^10)</target>
-        
       </trans-unit>
       <trans-unit id="sd6cd7ce2310a73a4">
         <source>Checks the value from the policy request against several rules, mostly used to ensure password strength.</source>
@@ -3216,12 +2951,12 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
       </trans-unit>
       <trans-unit id="sf325a4adba4d6278">
         <source>Group membership field</source>
-        <target>Veld dat leden van een groep bevat. Let op dat als het veld &quot;memberUid&quot; wordt gebruikt, de waarde wordt verondersteld een relatieve Distinguished Name te bevatten. Bijv. 'memberUid=some-user' in plaats van 'memberUid=cn=some-user,ou=groups,...'</target>
+        <target>Veld dat leden van een groep bevat. Let op dat als het veld "memberUid" wordt gebruikt, de waarde wordt verondersteld een relatieve Distinguished Name te bevatten. Bijv. 'memberUid=some-user' in plaats van 'memberUid=cn=some-user,ou=groups,...'</target>
         
       </trans-unit>
       <trans-unit id="s76768bebabb7d543">
-        <source>Field which contains members of a group. Note that if using the &quot;memberUid&quot; field, the value is assumed to contain a relative distinguished name. e.g. 'memberUid=some-user' instead of 'memberUid=cn=some-user,ou=groups,...'</source>
-        <target>Veld dat leden van een groep bevat. Let op dat als het veld &quot;memberUid&quot; wordt gebruikt, de waarde wordt verondersteld een relatieve Distinguished Name te bevatten. Bijv. 'memberUid=some-user' in plaats van 'memberUid=cn=some-user,ou=groups,...'</target>
+        <source>Field which contains members of a group. Note that if using the "memberUid" field, the value is assumed to contain a relative distinguished name. e.g. 'memberUid=some-user' instead of 'memberUid=cn=some-user,ou=groups,...'</source>
+        <target>Veld dat leden van een groep bevat. Let op dat als het veld "memberUid" wordt gebruikt, de waarde wordt verondersteld een relatieve Distinguished Name te bevatten. Bijv. 'memberUid=some-user' in plaats van 'memberUid=cn=some-user,ou=groups,...'</target>
         
       </trans-unit>
       <trans-unit id="s026555347e589f0e">
@@ -3864,16 +3599,6 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
         <source>Update Token</source>
         <target>Token bijwerken</target>
         
-      </trans-unit>
-      <trans-unit id="s0af6301e76e2a2a5">
-        <source>Successfully updated tenant.</source>
-        <target>Succesvol bijgewerkte tenant.</target>
-        
-      </trans-unit>
-      <trans-unit id="sf55c7c06dbc2c8c6">
-        <source>Successfully created tenant.</source>
-        <target>Succesvol aangemaakte tenant.</target>
-        
       </trans-unit>
       <trans-unit id="s41706a202b6c40f1">
         <source>Domain</source>
@@ -3889,11 +3614,6 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
         <source>Default</source>
         <target>Standaard</target>
         
-      </trans-unit>
-      <trans-unit id="se1c85959463f53df">
-        <source>Use this tenant for each domain that doesn't have a dedicated tenant.</source>
-        <target>Gebruik deze tenant voor elk domein dat geen toegewijde tenant heeft.</target>
-        
       </trans-unit>
       <trans-unit id="sc19838ca8c135c1b">
         <source>Branding settings</source>
@@ -4011,29 +3731,14 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
         
       </trans-unit>
       <trans-unit id="s7b1fba26d245cb1c">
-        <source>When using an external logging solution for archiving, this can be set to &quot;minutes=5&quot;.</source>
-        <target>Als je een externe logoplossing gebruikt voor archivering, kan dit worden ingesteld op &quot;minutes=5&quot;.</target>
+        <source>When using an external logging solution for archiving, this can be set to "minutes=5".</source>
+        <target>Als je een externe logoplossing gebruikt voor archivering, kan dit worden ingesteld op "minutes=5".</target>
         
       </trans-unit>
       <trans-unit id="s44536d20bb5c8257">
         <source>This setting only affects new Events, as the expiration is saved per-event.</source>
         <target>Deze instelling heeft alleen invloed op nieuwe gebeurtenissen, omdat de vervaldatum per gebeurtenis wordt opgeslagen.</target>
         
-      </trans-unit>
-      <trans-unit id="s3bb51cabb02b997e">
-        <source>Format: &quot;weeks=3;days=2;hours=3,seconds=2&quot;.</source>
-        <target>Indeling: &quot;weeks=3;days=2;hours=3,seconds=2&quot;.</target>
-        
-      </trans-unit>
-      <trans-unit id="s04bfd02201db5ab8">
-        <source>Set custom attributes using YAML or JSON. Any attributes set here will be inherited by users, if the request is handled by this tenant.</source>
-        <target>Stel aangepaste eigenschappen in met behulp van YAML of JSON. Alle hier ingestelde eigenschappen worden overgenomen door gebruikers als het verzoek wordt afgehandeld door deze tenant.</target>
-        
-      </trans-unit>
-      <trans-unit id="s7f9e79189a3d19e2">
-        <source>Tenants</source>
-        <target>Tenants</target>
-        
       </trans-unit>
       <trans-unit id="s164be9a7537b99f6">
         <source>Configure visual settings and defaults for different domains.</source>
@@ -4044,21 +3749,6 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
         <source>Default?</source>
         <target>Standaard?</target>
         
-      </trans-unit>
-      <trans-unit id="s69a56a3022c4be7f">
-        <source>Tenant(s)</source>
-        <target>Tenants</target>
-        
-      </trans-unit>
-      <trans-unit id="s1b606acd76ba2c4c">
-        <source>Update Tenant</source>
-        <target>Tenant bijwerken</target>
-        
-      </trans-unit>
-      <trans-unit id="s773aa6621d7e37b7">
-        <source>Create Tenant</source>
-        <target>Tenant aanmaken</target>
-        
       </trans-unit>
       <trans-unit id="s8cb7bb82e96d5d77">
         <source>Policies</source>
@@ -4214,8 +3904,8 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
         
       </trans-unit>
       <trans-unit id="sa95a538bfbb86111">
-        <source>Are you sure you want to update <x id="0" equiv-text="${this.objectLabel}"/> &quot;<x id="1" equiv-text="${this.obj?.name}"/>&quot;?</source>
-        <target>Weet je zeker dat je <x id="0" equiv-text="${this.objectLabel}"/> &quot;<x id="1" equiv-text="${this.obj?.name}"/>&quot; wilt bijwerken?</target>
+        <source>Are you sure you want to update <x id="0" equiv-text="${this.objectLabel}"/> "<x id="1" equiv-text="${this.obj?.name}"/>"?</source>
+        <target>Weet je zeker dat je <x id="0" equiv-text="${this.objectLabel}"/> "<x id="1" equiv-text="${this.obj?.name}"/>" wilt bijwerken?</target>
         
       </trans-unit>
       <trans-unit id="sc92d7cfb6ee1fec6">
@@ -4327,11 +4017,6 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
         <source>Recovery link cannot be emailed, user has no email address saved.</source>
         <target>Herstelkoppeling kan niet per e-mail worden verzonden, gebruiker heeft geen opgeslagen e-mailadres.</target>
         
-      </trans-unit>
-      <trans-unit id="s63d89a6ae0969c30">
-        <source>To let a user directly reset a their password, configure a recovery flow on the currently active tenant.</source>
-        <target>Om een gebruiker rechtstreeks zijn/haar wachtwoord te laten resetten, configureer een herstelflow op de momenteel actieve tenant.</target>
-        
       </trans-unit>
       <trans-unit id="s720594461542943f">
         <source>Add User</source>
@@ -4537,16 +4222,6 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
         <source>User Info</source>
         <target>Gebruikersinformatie</target>
         
-      </trans-unit>
-      <trans-unit id="s06f79477aff0576c">
-        <source>To create a recovery link, the current tenant needs to have a recovery flow configured.</source>
-        <target>Om een herstelkoppeling te maken, moet de huidige tenant een herstelflow geconfigureerd hebben.</target>
-        
-      </trans-unit>
-      <trans-unit id="sed80a99ca1491909">
-        <source>Reset Password</source>
-        <target>Wachtwoord resetten</target>
-        
       </trans-unit>
       <trans-unit id="sc44bae5cde0083fa">
         <source>Actions over the last week (per 8 hours)</source>
@@ -5279,11 +4954,6 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
         <source>When multiple stages are selected, the user can choose which one they want to enroll.</source>
         <target>Als meerdere fases zijn geselecteerd, kan de gebruiker kiezen welke hij wil inschrijven.</target>
         
-      </trans-unit>
-      <trans-unit id="s9a823993c07e5d64">
-        <source>Stage used to configure a WebAutnn authenticator (i.e. Yubikey, FaceID/Windows Hello).</source>
-        <target>Fase gebruikt om een WebAutnn-authenticator te configureren (bijv. Yubikey, FaceID/Windows Hello).</target>
-        
       </trans-unit>
       <trans-unit id="s34b23ebbac9f6ab9">
         <source>User verification</source>
@@ -5294,21 +4964,6 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
         <source>Resident key requirement</source>
         <target>Vereiste residente sleutel</target>
         
-      </trans-unit>
-      <trans-unit id="s437ab6d95ca1ac78">
-        <source>The authenticator should not create a dedicated credential</source>
-        <target>De authenticator mag geen toegewijde referentie maken</target>
-        
-      </trans-unit>
-      <trans-unit id="sf6d55598b52348a5">
-        <source>The authenticator can create and store a dedicated credential, but if it doesn't that's alright too</source>
-        <target>De authenticator kan een toegewijde referentie maken en opslaan, maar dat hoeft niet</target>
-        
-      </trans-unit>
-      <trans-unit id="s81356cab25498851">
-        <source>The authenticator MUST create a dedicated credential. If it cannot, the RP is prepared for an error to occur</source>
-        <target>De authenticator MOET een toegewijde referentie maken. Als dat niet lukt, is de RP voorbereid op een mogelijke fout</target>
-        
       </trans-unit>
       <trans-unit id="s5fbaeb14f42815e5">
         <source>Authenticator Attachment</source>
@@ -5326,8 +4981,8 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
         
       </trans-unit>
       <trans-unit id="sdf1d8edef27236f0">
-        <source>A &quot;roaming&quot; authenticator, like a YubiKey</source>
-        <target>Een &quot;roaming&quot; authenticator, zoals een YubiKey</target>
+        <source>A "roaming" authenticator, like a YubiKey</source>
+        <target>Een "roaming" authenticator, zoals een YubiKey</target>
         
       </trans-unit>
       <trans-unit id="sfffba7b23d8fb40c">
@@ -5412,7 +5067,7 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
       </trans-unit>
       <trans-unit id="s22b10ed263b96194">
         <source>Dummy stage used for testing. Shows a simple continue button and always passes.</source>
-        <target>Dummyfase voor testdoeleinden. Toont een eenvoudige knop &quot;Doorgaan&quot; en slaagt altijd.</target>
+        <target>Dummyfase voor testdoeleinden. Toont een eenvoudige knop "Doorgaan" en slaagt altijd.</target>
         
       </trans-unit>
       <trans-unit id="sdb861d9906f18ac2">
@@ -5661,8 +5316,8 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
         
       </trans-unit>
       <trans-unit id="s2d5f69929bb7221d">
-        <source><x id="0" equiv-text="${prompt.name}"/> (&quot;<x id="1" equiv-text="${prompt.fieldKey}"/>&quot;, of type <x id="2" equiv-text="${prompt.type}"/>)</source>
-        <target><x id="0" equiv-text="${prompt.name}"/> (&quot;<x id="1" equiv-text="${prompt.fieldKey}"/>&quot;, van het type <x id="2" equiv-text="${prompt.type}"/>)</target>
+        <source><x id="0" equiv-text="${prompt.name}"/> ("<x id="1" equiv-text="${prompt.fieldKey}"/>", of type <x id="2" equiv-text="${prompt.type}"/>)</source>
+        <target><x id="0" equiv-text="${prompt.name}"/> ("<x id="1" equiv-text="${prompt.fieldKey}"/>", van het type <x id="2" equiv-text="${prompt.type}"/>)</target>
         
       </trans-unit>
       <trans-unit id="s3b7b519444181264">
@@ -5710,8 +5365,8 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
         
       </trans-unit>
       <trans-unit id="s1608b2f94fa0dbd4">
-        <source>If set to a duration above 0, the user will have the option to choose to &quot;stay signed in&quot;, which will extend their session by the time specified here.</source>
-        <target>Als ingesteld op een duur boven 0, heeft de gebruiker de mogelijkheid om te kiezen voor &quot;ingelogd blijven&quot;, wat hun sessie zal verlengen met de hier opgegeven tijd.</target>
+        <source>If set to a duration above 0, the user will have the option to choose to "stay signed in", which will extend their session by the time specified here.</source>
+        <target>Als ingesteld op een duur boven 0, heeft de gebruiker de mogelijkheid om te kiezen voor "ingelogd blijven", wat hun sessie zal verlengen met de hier opgegeven tijd.</target>
         
       </trans-unit>
       <trans-unit id="s542a71bb8f41e057">
@@ -7710,7 +7365,681 @@ Bindingen naar groepen/gebruikers worden gecontroleerd tegen de gebruiker van de
 <trans-unit id="s1a65ee08832fbfe2">
   <source>Flows and Stages</source>
   <target>Procedures &amp; Fases</target>
+</trans-unit>
+<trans-unit id="s3e99ea082ca5ade9">
+  <source>Failed to fetch</source>
+</trans-unit>
+<trans-unit id="s84fcddede27b8e2a">
+  <source>External</source>
+</trans-unit>
+<trans-unit id="s1a635369edaf4dc3">
+  <source>Service account</source>
+</trans-unit>
+<trans-unit id="sff930bf2834e2201">
+  <source>Service account (internal)</source>
+</trans-unit>
+<trans-unit id="s4ba4473f3d4ec896">
+  <source>New version available</source>
+</trans-unit>
+<trans-unit id="s744401846fea6e76">
+  <source>Brand</source>
+</trans-unit>
+<trans-unit id="s98327528f00365a7">
+  <source>Failed to fetch data.</source>
+</trans-unit>
+<trans-unit id="s66313b45b69cfc88">
+  <source>Check the release notes</source>
+</trans-unit>
+<trans-unit id="sb4d7bae2440d9781">
+  <source>User Statistics</source>
+</trans-unit>
+<trans-unit id="s4a34a6be4c68ec87">
+  <source>Users created</source>
+</trans-unit>
+<trans-unit id="s275c956687e2e656">
+  <source>Failed logins</source>
+</trans-unit>
+<trans-unit id="sb3d4f79d9d8b71e5">
+  <source>Submit</source>
+</trans-unit>
+<trans-unit id="s1cffe58249b04669">
+  <source>Internal application name used in URLs.</source>
+</trans-unit>
+<trans-unit id="se2b29e6cfe59414c">
+  <source>UI Settings</source>
+</trans-unit>
+<trans-unit id="s4498e890d47a8066">
+  <source>OAuth2/OIDC (Open Authorization/OpenID Connect)</source>
+</trans-unit>
+<trans-unit id="s4f2e195d09e2868c">
+  <source>LDAP (Lightweight Directory Access Protocol)</source>
+</trans-unit>
+<trans-unit id="s836148f721d8913b">
+  <source>Transparent Reverse Proxy</source>
+</trans-unit>
+<trans-unit id="s945a6b94361ee45b">
+  <source>For transparent reverse proxies with required authentication</source>
+</trans-unit>
+<trans-unit id="s7f5bb0c9923315ed">
+  <source>Forward Auth (Single Application)</source>
+</trans-unit>
+<trans-unit id="sdc9a6ad1af30572c">
+  <source>For nginx's auth_request or traefik's forwardAuth</source>
+</trans-unit>
+<trans-unit id="sf8008d2d6b064b95">
+  <source>Forward Auth (Domain Level)</source>
+</trans-unit>
+<trans-unit id="sfc31264ef7ff86ef">
+  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
+</trans-unit>
+<trans-unit id="sfa8a1ffa9fee07d3">
+  <source>SAML (Security Assertion Markup Language)</source>
+</trans-unit>
+<trans-unit id="s40830ec037f34626">
+  <source>Configure SAML provider manually</source>
+</trans-unit>
+<trans-unit id="s848a23972e388662">
+  <source>RADIUS (Remote Authentication Dial-In User Service)</source>
+</trans-unit>
+<trans-unit id="sea9fc40dfd1d18b1">
+  <source>Configure RADIUS provider manually</source>
+</trans-unit>
+<trans-unit id="s3e902999ddf7b50e">
+  <source>SCIM (System for Cross-domain Identity Management)</source>
+</trans-unit>
+<trans-unit id="sa1b0052ae095b9b3">
+  <source>Configure SCIM provider manually</source>
+</trans-unit>
+<trans-unit id="s15831fa50a116545">
+  <source>Saving Application...</source>
+</trans-unit>
+<trans-unit id="s823abdb61543a826">
+  <source>Authentik was unable to save this application:</source>
+</trans-unit>
+<trans-unit id="s848288f8c2265aad">
+  <source>Your application has been saved</source>
+</trans-unit>
+<trans-unit id="scda8dc24b561e205">
+  <source>There was an error in the application.</source>
+</trans-unit>
+<trans-unit id="sdaca9c2c0361ed3a">
+  <source>Review the application.</source>
+</trans-unit>
+<trans-unit id="sb50000a8fada5672">
+  <source>There was an error in the provider.</source>
+</trans-unit>
+<trans-unit id="s21f95eaf151d4ce3">
+  <source>Review the provider.</source>
+</trans-unit>
+<trans-unit id="s9fd39a5cb20b4e61">
+  <source>There was an error</source>
+</trans-unit>
+<trans-unit id="s7a6b3453209e1066">
+  <source>There was an error creating the application, but no error message was sent. Please review the server logs.</source>
+</trans-unit>
+<trans-unit id="s1a711c19cda48375">
+  <source>Configure LDAP Provider</source>
+</trans-unit>
+<trans-unit id="s67d858051b34c38b">
+  <source>Method's display Name.</source>
+</trans-unit>
+<trans-unit id="s9368e965b5c292ab">
+  <source>Configure OAuth2/OpenId Provider</source>
+</trans-unit>
+<trans-unit id="sf5cbccdc6254c8dc">
+  <source>Configure Proxy Provider</source>
+</trans-unit>
+<trans-unit id="sf6d46bb442b77e91">
+  <source>AdditionalScopes</source>
+</trans-unit>
+<trans-unit id="h10ef80d434185070">
+  <source>Use this provider with nginx's <x id="0" equiv-text="&lt;code&gt;"/>auth_request<x id="1" equiv-text="&lt;/code&gt;"/> or traefik's
+                    <x id="2" equiv-text="&lt;code&gt;"/>forwardAuth<x id="3" equiv-text="&lt;/code&gt;"/>. Each application/domain needs its own provider.
+                    Additionally, on each domain, <x id="4" equiv-text="&lt;code&gt;"/>/outpost.goauthentik.io<x id="5" equiv-text="&lt;/code&gt;"/> must be
+                    routed to the outpost (when using a managed outpost, this is done for you).</source>
+</trans-unit>
+<trans-unit id="s2c8c6f89089b31d4">
+  <source>Configure Radius Provider</source>
+</trans-unit>
+<trans-unit id="sfe906cde5dddc041">
+  <source>Configure SAML Provider</source>
+</trans-unit>
+<trans-unit id="sb3defbacd01ad972">
+  <source>Property mappings used for user mapping.</source>
+</trans-unit>
+<trans-unit id="s7ccce0ec8d228db6">
+  <source>Configure SCIM Provider</source>
+</trans-unit>
+<trans-unit id="sd7728d2b6e1d25e9">
+  <source>Property mappings used for group creation.</source>
+</trans-unit>
+<trans-unit id="s4bd386db7302bb22">
+  <source>Create With Wizard</source>
+</trans-unit>
+<trans-unit id="s71c5d51d5a357dbd">
+  <source>Don't show this message again.</source>
+</trans-unit>
+<trans-unit id="s070fdfb03034ca9b">
+  <source>One hint, 'New Application Wizard', is currently hidden</source>
+</trans-unit>
+<trans-unit id="sff0ac1ace2d90709">
+  <source>Use this provider with nginx's auth_request or traefik's forwardAuth. Each application/domain needs its own provider. Additionally, on each domain, /outpost.goauthentik.io must be routed to the outpost (when using a managed outpost, this is done for you).</source>
+</trans-unit>
+<trans-unit id="scb58b8a60cad8762">
+  <source>Default relay state</source>
+</trans-unit>
+<trans-unit id="s6827a456c9dfc6ee">
+  <source>When using IDP-initiated logins, the relay state will be set to this value.</source>
+</trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+</trans-unit>
+<trans-unit id="sa2ea0fcd3ffa80e0">
+  <source>Connection expiry</source>
+</trans-unit>
+<trans-unit id="s6dd297c217729828">
+  <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
+</trans-unit>
+<trans-unit id="s3271da6c18c25b18">
+  <source>Connection settings.</source>
+</trans-unit>
+<trans-unit id="sf485014051ad0cf7">
+  <source>Successfully assigned permission.</source>
+</trans-unit>
+<trans-unit id="sca7fed2bef53cb99">
+  <source>Role</source>
+</trans-unit>
+<trans-unit id="sc92c1a54034e21cc">
+  <source>Assign</source>
+</trans-unit>
+<trans-unit id="scd84d10ee9137070">
+  <source>Assign permission to role</source>
+</trans-unit>
+<trans-unit id="s5ee6f1b84e9ebc69">
+  <source>Assign to new role</source>
+</trans-unit>
+<trans-unit id="sb923723d27df40ba">
+  <source>Permission(s)</source>
+</trans-unit>
+<trans-unit id="sc5fb00b25c7f5a02">
+  <source>Permission</source>
+</trans-unit>
+<trans-unit id="s4afb26a8fae257e9">
+  <source>Directly assigned</source>
+</trans-unit>
+<trans-unit id="sd8051c26e155f043">
+  <source>Assign permission to user</source>
+</trans-unit>
+<trans-unit id="sf79f8681e5ffaee2">
+  <source>Assign to new user</source>
+</trans-unit>
+<trans-unit id="sc615309d10a9228c">
+  <source>RBAC is in preview.</source>
+</trans-unit>
+<trans-unit id="saabeb4cab074b0b9">
+  <source>User Object Permissions</source>
+</trans-unit>
+<trans-unit id="s8489d5559dda260c">
+  <source>Role Object Permissions</source>
+</trans-unit>
+<trans-unit id="s2f4ca2148183d692">
+  <source>Successfully updated endpoint.</source>
+</trans-unit>
+<trans-unit id="s5adee855dbe191d9">
+  <source>Successfully created endpoint.</source>
+</trans-unit>
+<trans-unit id="s61e136c0658e27d5">
+  <source>Protocol</source>
+</trans-unit>
+<trans-unit id="sa062b019ff0c8809">
+  <source>RDP</source>
+</trans-unit>
+<trans-unit id="s97f9bf19fa5b57d1">
+  <source>SSH</source>
+</trans-unit>
+<trans-unit id="s7c100119e9ffcc32">
+  <source>VNC</source>
+</trans-unit>
+<trans-unit id="s6b05f9d8801fc14f">
+  <source>Host</source>
+</trans-unit>
+<trans-unit id="sb474f652a2c2fc76">
+  <source>Hostname/IP to connect to.</source>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+</trans-unit>
+<trans-unit id="s6b2beba7ab637e9e">
+  <source>Roles</source>
+</trans-unit>
+<trans-unit id="s96d2bb4be3f5e8aa">
+  <source>Select roles to grant this groups' users' permissions from the selected roles.</source>
+</trans-unit>
+<trans-unit id="s6b1ed7507f26cb4a">
+  <source>Failure result</source>
+</trans-unit>
+<trans-unit id="s2e422519ed38f7d8">
+  <source>Pass</source>
+</trans-unit>
+<trans-unit id="s81a45c4fd11e8e1a">
+  <source>Don't pass</source>
+</trans-unit>
+<trans-unit id="s95b73e0f4e47eb9a">
+  <source>Result used when policy execution fails.</source>
+</trans-unit>
+<trans-unit id="sd94e99af8b41ff54">
+  <source>0: Too guessable: risky password. (guesses &amp;lt; 10^3)</source>
+</trans-unit>
+<trans-unit id="sc926385d1a624c3a">
+  <source>1: Very guessable: protection from throttled online attacks. (guesses &amp;lt; 10^6)</source>
+</trans-unit>
+<trans-unit id="s8aae61c41319602c">
+  <source>2: Somewhat guessable: protection from unthrottled online attacks. (guesses &amp;lt; 10^8)</source>
+</trans-unit>
+<trans-unit id="sc1f4b57e722a89d6">
+  <source>3: Safely unguessable: moderate protection from offline slow-hash scenario. (guesses &amp;lt; 10^10)</source>
+</trans-unit>
+<trans-unit id="sd47f3d3c9741343d">
+  <source>4: Very unguessable: strong protection from offline slow-hash scenario. (guesses &amp;gt;= 10^10)</source>
+</trans-unit>
+<trans-unit id="s3d2a8b86a4f5a810">
+  <source>Successfully created user and added to group <x id="0" equiv-text="${this.group.name}"/></source>
+</trans-unit>
+<trans-unit id="sb37880a2a7288ef0">
+  <source>Update Permissions</source>
+</trans-unit>
+<trans-unit id="s8276649077e8715c">
+  <source>Endpoint(s)</source>
+</trans-unit>
+<trans-unit id="sf1dabfe0fe8a75ad">
+  <source>Update Endpoint</source>
+</trans-unit>
+<trans-unit id="s008496c7716b9812">
+  <source>These bindings control which users will have access to this endpoint. Users must also have access to the application.</source>
+</trans-unit>
+<trans-unit id="s38e7cd1a24e70faa">
+  <source>Create Endpoint</source>
+</trans-unit>
+<trans-unit id="s4770c10e5b1c028c">
+  <source>RAC is in preview.</source>
+</trans-unit>
+<trans-unit id="s168565f5ac74a89f">
+  <source>Update RAC Provider</source>
+</trans-unit>
+<trans-unit id="s8465a2caa2d9ea5d">
+  <source>Endpoints</source>
+</trans-unit>
+<trans-unit id="sadadfe9dfa06d7dd">
+  <source>No sync status.</source>
+</trans-unit>
+<trans-unit id="s2b1c81130a65a55b">
+  <source>Sync currently running.</source>
+</trans-unit>
+<trans-unit id="s61bd841e66966325">
+  <source>External applications that use authentik as an identity provider via protocols like OAuth2 and SAML. All applications are shown here, even ones you cannot access.</source>
+</trans-unit>
+<trans-unit id="sb35c08e3a541188f">
+  <source>Also known as Client ID.</source>
+</trans-unit>
+<trans-unit id="sd46fd9b647cfea10">
+  <source>Also known as Client Secret.</source>
+</trans-unit>
+<trans-unit id="s4476e9c50cfd13f4">
+  <source>Global status</source>
+</trans-unit>
+<trans-unit id="sd21a971eea208533">
+  <source>Vendor</source>
+</trans-unit>
+<trans-unit id="sf36170f71cea38c2">
+  <source>Connectivity</source>
+</trans-unit>
+<trans-unit id="s9857d883d8eb98fc">
+  <source>General settings</source>
+</trans-unit>
+<trans-unit id="sd2066881798a1b96">
+  <source>RDP settings</source>
+</trans-unit>
+<trans-unit id="sb864dc36a463a155">
+  <source>Ignore server certificate</source>
+</trans-unit>
+<trans-unit id="s20366a8d1eaaca54">
+  <source>Enable wallpaper</source>
+</trans-unit>
+<trans-unit id="s1e44c5350ef7598c">
+  <source>Enable font-smoothing</source>
+</trans-unit>
+<trans-unit id="s04ff5d6ae711e6d6">
+  <source>Enable full window dragging</source>
+</trans-unit>
+<trans-unit id="sdc5690be4a342985">
+  <source>The token has been copied to your clipboard</source>
+</trans-unit>
+<trans-unit id="s7f3edfee24690c9f">
+  <source>The token was displayed because authentik does not have permission to write to the clipboard</source>
+</trans-unit>
+<trans-unit id="se9c07cf256774d81">
+  <source>Editing is disabled for managed tokens</source>
+</trans-unit>
+<trans-unit id="sab21e1f62676b56c">
+  <source>Successfully updated brand.</source>
+</trans-unit>
+<trans-unit id="sa43e43fd3a23e22d">
+  <source>Successfully created brand.</source>
+</trans-unit>
+<trans-unit id="s41b3f9b4c98aabd9">
+  <source>Use this brand for each domain that doesn't have a dedicated brand.</source>
+</trans-unit>
+<trans-unit id="s17260b71484b307f">
+  <source>Set custom attributes using YAML or JSON. Any attributes set here will be inherited by users, if the request is handled by this brand.</source>
+</trans-unit>
+<trans-unit id="s79fc990a2b58f27f">
+  <source>Brands</source>
+</trans-unit>
+<trans-unit id="s02774bc46a167346">
+  <source>Brand(s)</source>
+</trans-unit>
+<trans-unit id="s801bf3d03f4a3ff1">
+  <source>Update Brand</source>
+</trans-unit>
+<trans-unit id="s5c3efec5330e0000">
+  <source>Create Brand</source>
+</trans-unit>
+<trans-unit id="sa9d13ce9e83aac17">
+  <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
+</trans-unit>
+<trans-unit id="s824e0943a7104668">
+  <source>This user will be added to the group "<x id="0" equiv-text="${this.targetGroup.name}"/>".</source>
+</trans-unit>
+<trans-unit id="s2da4aa7a9abeb653">
+  <source>Pseudolocale (for testing)</source>
+</trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
+<trans-unit id="saf6097bfa25205b8">
+  <source>A copy of this recovery link has been placed in your clipboard</source>
+</trans-unit>
+<trans-unit id="s6709b81e1ed4e39f">
+  <source>The current brand must have a recovery flow configured to use a recovery link</source>
+</trans-unit>
+<trans-unit id="s0924f51b028233a3">
+  <source>&lt;No name set&gt;</source>
+</trans-unit>
+<trans-unit id="s895514dda9cb9c94">
+  <source>Create recovery link</source>
+</trans-unit>
+<trans-unit id="s78ab26da7f067de8">
+  <source>Select permissions to grant</source>
+</trans-unit>
+<trans-unit id="sdeb90bfd8a80b86b">
+  <source>Permissions to add</source>
+</trans-unit>
+<trans-unit id="s36247910d67421e1">
+  <source>Select permissions</source>
+</trans-unit>
+<trans-unit id="s67e136af8fc1107b">
+  <source>Assign permission</source>
+</trans-unit>
+<trans-unit id="s1455753daa00f1bc">
+  <source>User doesn't have view permission so description cannot be retrieved.</source>
+</trans-unit>
+<trans-unit id="s028d385389b5aac0">
+  <source>Lock the user out of this system</source>
+</trans-unit>
+<trans-unit id="sd2122c514f0778b5">
+  <source>Allow the user to log in and use this system</source>
+</trans-unit>
+<trans-unit id="s43fe853bf219a9b8">
+  <source>Temporarily assume the identity of this user</source>
+</trans-unit>
+<trans-unit id="se28b5f3fcadaeeb1">
+  <source>Enter a new password for this user</source>
+</trans-unit>
+<trans-unit id="s6f5bb31e2733ecd5">
+  <source>Create a link for this user to reset their password</source>
+</trans-unit>
+<trans-unit id="se5c795faf2c07514">
+  <source>Create Recovery Link</source>
+</trans-unit>
+<trans-unit id="sa3a3e09b88ed9791">
+  <source>Assigned permissions</source>
+</trans-unit>
+<trans-unit id="s9cc631505c17b028">
+  <source>Assigned global permissions</source>
+</trans-unit>
+<trans-unit id="s8f85a0e678846080">
+  <source>Assigned object permissions</source>
+</trans-unit>
+<trans-unit id="s9103a949a3963aa9">
+  <source>Successfully updated role.</source>
+</trans-unit>
+<trans-unit id="sdf87c5661b31359e">
+  <source>Successfully created role.</source>
+</trans-unit>
+<trans-unit id="s3484b1e6d0b5335f">
+  <source>Manage roles which grant permissions to objects within authentik.</source>
+</trans-unit>
+<trans-unit id="s259de999919316db">
+  <source>Role(s)</source>
+</trans-unit>
+<trans-unit id="s2ffad156e8332f04">
+  <source>Update Role</source>
+</trans-unit>
+<trans-unit id="sc5f923729564fbf3">
+  <source>Create Role</source>
+</trans-unit>
+<trans-unit id="s14bfa8fd1bec8889">
+  <source>Role doesn't have view permission so description cannot be retrieved.</source>
+</trans-unit>
+<trans-unit id="s7e796fe83982863f">
+  <source>Role <x id="0" equiv-text="${this._role?.name || &quot;&quot;}"/></source>
+</trans-unit>
+<trans-unit id="s526e2c66bd51ff5f">
+  <source>Role Info</source>
+</trans-unit>
+<trans-unit id="sd18b18f91b804c3f">
+  <source>Custom attributes</source>
+</trans-unit>
+<trans-unit id="s24bce955914b1f0a">
+  <source>Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello).</source>
+</trans-unit>
+<trans-unit id="s6a3cf855140b9511">
+  <source>Required: User verification must occur.</source>
+</trans-unit>
+<trans-unit id="sc498a3b05cfe2b08">
+  <source>Preferred: User verification is preferred if available, but not required.</source>
+</trans-unit>
+<trans-unit id="s9d2239d2b0402795">
+  <source>Discouraged: User verification should not occur.</source>
+</trans-unit>
+<trans-unit id="s428b7859907f6db2">
+  <source>Required: The authenticator MUST create a dedicated credential. If it cannot, the RP is prepared for an error to occur</source>
+</trans-unit>
+<trans-unit id="s33e3766d4a02b042">
+  <source>Preferred: The authenticator can create and store a dedicated credential, but if it doesn't that's alright too</source>
+</trans-unit>
+<trans-unit id="sfb852dd507c25c24">
+  <source>Discouraged: The authenticator should not create a dedicated credential</source>
+</trans-unit>
+<trans-unit id="s1cc306d8e28c4464">
+  <source>Deny message</source>
+</trans-unit>
+<trans-unit id="s6985c401e1100122">
+  <source>Message shown when this stage is run.</source>
+</trans-unit>
+<trans-unit id="s62e7f6ed7d9cb3ca">
+  <source>Pretend user exists</source>
+</trans-unit>
+<trans-unit id="s52bdc80690a9a8dc">
+  <source>When enabled, the stage will always accept the given user identifier and continue.</source>
+</trans-unit>
+<trans-unit id="s663ccbfdf27e8dd0">
+  <source>Network binding</source>
+</trans-unit>
+<trans-unit id="sb108a06693c67753">
+  <source>No binding</source>
+</trans-unit>
+<trans-unit id="s5aab90c74f1233b8">
+  <source>Bind ASN</source>
+</trans-unit>
+<trans-unit id="s488303b048afe83b">
+  <source>Bind ASN and Network</source>
+</trans-unit>
+<trans-unit id="s3268dcfe0c8234dc">
+  <source>Bind ASN, Network and IP</source>
+</trans-unit>
+<trans-unit id="s226381aca231644f">
+  <source>Configure if sessions created by this stage should be bound to the Networks they were created in.</source>
+</trans-unit>
+<trans-unit id="s2555a1f20f3fd93e">
+  <source>GeoIP binding</source>
+</trans-unit>
+<trans-unit id="s3d63c78f93c9a92e">
+  <source>Bind Continent</source>
+</trans-unit>
+<trans-unit id="s395d5863b3a259b5">
+  <source>Bind Continent and Country</source>
+</trans-unit>
+<trans-unit id="s625ea0c32b4b136c">
+  <source>Bind Continent, Country and City</source>
+</trans-unit>
+<trans-unit id="s4bc7a1a88961be90">
+  <source>Configure if sessions created by this stage should be bound to their GeoIP-based location</source>
+</trans-unit>
+<trans-unit id="s32babfed740fd3c1">
+  <source>User type used for newly created users.</source>
+</trans-unit>
+<trans-unit id="s047a5f0211fedc72">
+  <source>Require Outpost (flow can only be executed from an outpost).</source>
+</trans-unit>
+<trans-unit id="s01794c0ee3629c1b">
+  <source>Flow Info</source>
+</trans-unit>
+<trans-unit id="s7513372fe60f6387">
+  <source>Event volume</source>
+</trans-unit>
+<trans-unit id="sa06cd519ff151b6d">
+  <source>RAC</source>
+</trans-unit>
+<trans-unit id="s634e2fd82c397576">
+  <source>Successfully updated settings.</source>
+</trans-unit>
+<trans-unit id="sb8e4edaea6f1d935">
+  <source>Avatars</source>
+</trans-unit>
+<trans-unit id="s945856050217c828">
+  <source>Configure how authentik should show avatars for users. The following values can be set:</source>
+</trans-unit>
+<trans-unit id="sf4ef4c8ce713f775">
+  <source>Disables per-user avatars and just shows a 1x1 pixel transparent picture</source>
+</trans-unit>
+<trans-unit id="s5446842a7e4a963b">
+  <source>Uses gravatar with the user's email address</source>
+</trans-unit>
+<trans-unit id="s35363b9e1cc2abd3">
+  <source>Generated avatars based on the user's name</source>
+</trans-unit>
+<trans-unit id="s48110ca292cad513">
+  <source>Any URL: If you want to use images hosted on another server, you can set any URL. Additionally, these placeholders can be used:</source>
+</trans-unit>
+<trans-unit id="sbe1dfda044bdc93b">
+  <source>The user's username</source>
+</trans-unit>
+<trans-unit id="s653f257c9c2d4dc5">
+  <source>The email address, md5 hashed</source>
+</trans-unit>
+<trans-unit id="s9c9183cd80916b4f">
+  <source>The user's UPN, if set (otherwise an empty string)</source>
+</trans-unit>
+<trans-unit id="h4963ed14d7e239a9">
+  <source>An attribute path like
+                                    <x id="0" equiv-text="&lt;code&gt;"/>attributes.something.avatar<x id="1" equiv-text="&lt;/code&gt;"/>, which can be used in
+                                    combination with the file field to allow users to upload custom
+                                    avatars for themselves.</source>
+</trans-unit>
+<trans-unit id="s4c80c34a67a6f1c9">
+  <source>Multiple values can be set, comma-separated, and authentik will fallback to the next mode when no avatar could be found.</source>
+</trans-unit>
+<trans-unit id="h2fafcc3ebafea2f8">
+  <source>For example, setting this to <x id="0" equiv-text="&lt;code&gt;"/>gravatar,initials<x id="1" equiv-text="&lt;/code&gt;"/> will
+                                attempt to get an avatar from Gravatar, and if the user has not
+                                configured on there, it will fallback to a generated avatar.</source>
+</trans-unit>
+<trans-unit id="sea247dfb18f696d2">
+  <source>Default user change name</source>
+</trans-unit>
+<trans-unit id="s078ffec0257621c0">
+  <source>Enable the ability for users to change their name.</source>
+</trans-unit>
+<trans-unit id="s26ad11b21253152b">
+  <source>Default user change email</source>
+</trans-unit>
+<trans-unit id="s5fc6c14d106f40d3">
+  <source>Enable the ability for users to change their email.</source>
+</trans-unit>
+<trans-unit id="s23564aa839755965">
+  <source>Default user change username</source>
+</trans-unit>
+<trans-unit id="s6d816a95ca43a99d">
+  <source>Enable the ability for users to change their username.</source>
+</trans-unit>
+<trans-unit id="s57b52b60ed5e2bc7">
+  <source>Footer links</source>
+</trans-unit>
+<trans-unit id="s7349802b2f7f99c2">
+  <source>This option configures the footer links on the flow executor pages. It must be a valid JSON list and can be used as follows:</source>
+</trans-unit>
+<trans-unit id="s166b59f3cc5d8ec3">
+  <source>GDPR compliance</source>
+</trans-unit>
+<trans-unit id="sb8b23770f899e5bb">
+  <source>When enabled, all the events caused by a user will be deleted upon the user's deletion.</source>
+</trans-unit>
+<trans-unit id="s29501761df0fe837">
+  <source>Impersonation</source>
+</trans-unit>
+<trans-unit id="s8f503553d8432487">
+  <source>Globally enable/disable impersonation.</source>
+</trans-unit>
+<trans-unit id="see1eb81c1f734079">
+  <source>System settings</source>
+</trans-unit>
+<trans-unit id="s67ac11d47f1ce794">
+  <source>WebAuthn requires this page to be accessed via HTTPS.</source>
+</trans-unit>
+<trans-unit id="se9e9e1d6799b86a5">
+  <source>WebAuthn not supported by browser.</source>
+</trans-unit>
+<trans-unit id="s09f0c100d0ad2fec">
+  <source>Open Wizard</source>
+</trans-unit>
+<trans-unit id="sf2ef885f7d0a101d">
+  <source>Demo Wizard</source>
+</trans-unit>
+<trans-unit id="s77505ee5d2e45e53">
+  <source>Run the demo wizard</source>
+</trans-unit>
+<trans-unit id="s28b99b59541f54ca">
+  <source>Connection failed after <x id="0" equiv-text="${this.connectionAttempt}"/> attempts.</source>
+</trans-unit>
+<trans-unit id="s7c7d956418e1c8c8">
+  <source>Re-connecting in <x id="0" equiv-text="${Math.max(1, delay / 1000)}"/> second(s).</source>
+</trans-unit>
+<trans-unit id="sfc003381f593d943">
+  <source>Connecting...</source>
+</trans-unit>
+<trans-unit id="s31aa94a0b3c7edb2">
+  <source>Select endpoint to connect to</source>
 </trans-unit>
     </body>
   </file>
-</xliff>
\ No newline at end of file
+</xliff>
diff --git a/web/xliff/pl.xlf b/web/xliff/pl.xlf
index 1c63dc4f2..20f031b4f 100644
--- a/web/xliff/pl.xlf
+++ b/web/xliff/pl.xlf
@@ -6315,6 +6315,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s6dd297c217729828">
   <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
 </trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+</trans-unit>
 <trans-unit id="s744401846fea6e76">
   <source>Brand</source>
 </trans-unit>
@@ -6345,6 +6357,12 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sa9d13ce9e83aac17">
   <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
 </trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
 <trans-unit id="s6709b81e1ed4e39f">
   <source>The current brand must have a recovery flow configured to use a recovery link</source>
 </trans-unit>
diff --git a/web/xliff/pseudo-LOCALE.xlf b/web/xliff/pseudo-LOCALE.xlf
index c870f2288..1c30e2130 100644
--- a/web/xliff/pseudo-LOCALE.xlf
+++ b/web/xliff/pseudo-LOCALE.xlf
@@ -8040,6 +8040,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s6dd297c217729828">
   <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
 </trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+</trans-unit>
 <trans-unit id="s744401846fea6e76">
   <source>Brand</source>
 </trans-unit>
@@ -8070,6 +8082,12 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sa9d13ce9e83aac17">
   <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
 </trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
 <trans-unit id="s6709b81e1ed4e39f">
   <source>The current brand must have a recovery flow configured to use a recovery link</source>
 </trans-unit>
diff --git a/web/xliff/tr.xlf b/web/xliff/tr.xlf
index 6a5ee1e02..faf738130 100644
--- a/web/xliff/tr.xlf
+++ b/web/xliff/tr.xlf
@@ -6101,6 +6101,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s6dd297c217729828">
   <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
 </trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+</trans-unit>
 <trans-unit id="s744401846fea6e76">
   <source>Brand</source>
 </trans-unit>
@@ -6131,6 +6143,12 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sa9d13ce9e83aac17">
   <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
 </trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
 <trans-unit id="s6709b81e1ed4e39f">
   <source>The current brand must have a recovery flow configured to use a recovery link</source>
 </trans-unit>
diff --git a/web/xliff/zh-CN.xlf b/web/xliff/zh-CN.xlf
new file mode 100644
index 000000000..e0af65466
--- /dev/null
+++ b/web/xliff/zh-CN.xlf
@@ -0,0 +1,5148 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xliff version="1.2" xmlns="urn:oasis:names:tc:xliff:document:1.2">
+<file target-language="zh-CN" source-language="en" original="lit-localize-inputs" datatype="plaintext">
+<body>
+<trans-unit id="saae1c70e168b45b4">
+  <source>Admin</source>
+</trans-unit>
+<trans-unit id="s364c4f177a2f8322">
+  <source>Open API drawer</source>
+</trans-unit>
+<trans-unit id="s9ba989e69344ff29">
+  <source>Open Notification drawer</source>
+</trans-unit>
+<trans-unit id="sfe629863ba1338c2">
+  <source>Connection error, reconnecting...</source>
+</trans-unit>
+<trans-unit id="s49730f3d5751a433">
+  <source>Loading...</source>
+</trans-unit>
+<trans-unit id="sf1e9d421f35b51e5">
+  <source>Application</source>
+</trans-unit>
+<trans-unit id="s310d8757ce319673">
+  <source>Logins</source>
+</trans-unit>
+<trans-unit id="s3e99ea082ca5ade9">
+  <source>Failed to fetch</source>
+</trans-unit>
+<trans-unit id="s09810653c832e935">
+  <source>Click to change value</source>
+</trans-unit>
+<trans-unit id="sfefce784ec55868f">
+  <source>Select an object.</source>
+</trans-unit>
+<trans-unit id="s04ceadb276bbe149">
+  <source>Loading options...</source>
+</trans-unit>
+<trans-unit id="s1cd198d689c66e4b">
+  <source>API Access</source>
+</trans-unit>
+<trans-unit id="sf29883ac9ec43085">
+  <source>App password</source>
+</trans-unit>
+<trans-unit id="s6ac670086eb137c6">
+  <source>Recovery</source>
+</trans-unit>
+<trans-unit id="sfe211545fd02f73e">
+  <source>Verification</source>
+</trans-unit>
+<trans-unit id="sd73b202ec04eefd9">
+  <source>Unknown intent</source>
+</trans-unit>
+<trans-unit id="sc8da3cc71de63832">
+  <source>Login</source>
+</trans-unit>
+<trans-unit id="sb4564c127ab8b921">
+  <source>Failed login</source>
+</trans-unit>
+<trans-unit id="s67749057edb2586b">
+  <source>Logout</source>
+</trans-unit>
+<trans-unit id="s7e537ad68d7c16e1">
+  <source>User was written to</source>
+</trans-unit>
+<trans-unit id="sa0e0bdd7e244416b">
+  <source>Suspicious request</source>
+</trans-unit>
+<trans-unit id="s7bda44013984fc48">
+  <source>Password set</source>
+</trans-unit>
+<trans-unit id="sa1b41e334ad89d94">
+  <source>Secret was viewed</source>
+</trans-unit>
+<trans-unit id="s92ca679592a36b35">
+  <source>Secret was rotated</source>
+</trans-unit>
+<trans-unit id="s8a1d9403ca90989b">
+  <source>Invitation used</source>
+</trans-unit>
+<trans-unit id="s5f496533610103f2">
+  <source>Application authorized</source>
+</trans-unit>
+<trans-unit id="sdc9e222be9612939">
+  <source>Source linked</source>
+</trans-unit>
+<trans-unit id="sb1c91762ae3a9bee">
+  <source>Impersonation started</source>
+</trans-unit>
+<trans-unit id="s9c73bd29b279d26b">
+  <source>Impersonation ended</source>
+</trans-unit>
+<trans-unit id="s1cd264012278c047">
+  <source>Flow execution</source>
+</trans-unit>
+<trans-unit id="s32f04d33924ce8ad">
+  <source>Policy execution</source>
+</trans-unit>
+<trans-unit id="sb6d7128df5978cee">
+  <source>Policy exception</source>
+</trans-unit>
+<trans-unit id="s77f572257f69a8db">
+  <source>Property Mapping exception</source>
+</trans-unit>
+<trans-unit id="s2543cffd6ebb6803">
+  <source>System task execution</source>
+</trans-unit>
+<trans-unit id="se2f258b996f7279c">
+  <source>System task exception</source>
+</trans-unit>
+<trans-unit id="s81eff3409d572a21">
+  <source>General system exception</source>
+</trans-unit>
+<trans-unit id="sf8f49cdbf0036343">
+  <source>Configuration error</source>
+</trans-unit>
+<trans-unit id="s9c6f61dc47bc4f0a">
+  <source>Model created</source>
+</trans-unit>
+<trans-unit id="s47a4983a2c6bb749">
+  <source>Model updated</source>
+</trans-unit>
+<trans-unit id="sc9f69360b58706c7">
+  <source>Model deleted</source>
+</trans-unit>
+<trans-unit id="sa266303caf1bd27f">
+  <source>Email sent</source>
+</trans-unit>
+<trans-unit id="s6c410fedda2a575f">
+  <source>Update available</source>
+</trans-unit>
+<trans-unit id="sf1ec4acb8d744ed9">
+  <source>Alert</source>
+</trans-unit>
+<trans-unit id="s9117fb5195e75151">
+  <source>Notice</source>
+</trans-unit>
+<trans-unit id="s34be76c6b1eadbef">
+  <source>Warning</source>
+</trans-unit>
+<trans-unit id="s02240309358f557c">
+  <source>Unknown severity</source>
+</trans-unit>
+<trans-unit id="s858e7ac4b3cf955f">
+  <source>Static tokens</source>
+</trans-unit>
+<trans-unit id="sfcfcf85a57eea78a">
+  <source>TOTP Device</source>
+</trans-unit>
+<trans-unit id="se2d65e13768468e0">
+  <source>Internal</source>
+</trans-unit>
+<trans-unit id="s84fcddede27b8e2a">
+  <source>External</source>
+</trans-unit>
+<trans-unit id="s1a635369edaf4dc3">
+  <source>Service account</source>
+</trans-unit>
+<trans-unit id="sff930bf2834e2201">
+  <source>Service account (internal)</source>
+</trans-unit>
+<trans-unit id="sa50a6326530d8a0d">
+  <source>Show less</source>
+</trans-unit>
+<trans-unit id="sb2c57b2d347203dd">
+  <source>Show more</source>
+</trans-unit>
+<trans-unit id="s6238f519db67980d">
+  <source>UID</source>
+</trans-unit>
+<trans-unit id="sef49aec68fd1dc66">
+  <source>Name</source>
+</trans-unit>
+<trans-unit id="sf9f2c719a04066ec">
+  <source>App</source>
+</trans-unit>
+<trans-unit id="sda796c87fa97ed4d">
+  <source>Model Name</source>
+</trans-unit>
+<trans-unit id="s79e8cc71a5975b04">
+  <source>Message</source>
+</trans-unit>
+<trans-unit id="sbbc53e0e54d7946f">
+  <source>Subject</source>
+</trans-unit>
+<trans-unit id="sa6ab5184d6315895">
+  <source>From</source>
+</trans-unit>
+<trans-unit id="s09353907b5c79284">
+  <source>To</source>
+</trans-unit>
+<trans-unit id="s63e03c70f67ebf9c">
+  <source>Context</source>
+</trans-unit>
+<trans-unit id="sa48f81f001b893d2">
+  <source>User</source>
+</trans-unit>
+<trans-unit id="s119498d4e4cf59a6">
+  <source>Affected model:</source>
+</trans-unit>
+<trans-unit id="sa3660d505e7011e0">
+  <source>Authorized application:</source>
+</trans-unit>
+<trans-unit id="s95a032ae86881bf5">
+  <source>Using flow</source>
+</trans-unit>
+<trans-unit id="scb5c9a7cc4ccd68d">
+  <source>Email info:</source>
+</trans-unit>
+<trans-unit id="s677f1b675fc21bb1">
+  <source>Secret:</source>
+</trans-unit>
+<trans-unit id="sa6905be242387f36">
+  <source>Exception</source>
+</trans-unit>
+<trans-unit id="sd947d57c9a9b7108">
+  <source>Open issue on GitHub...</source>
+</trans-unit>
+<trans-unit id="s6ab73c998850c5ab">
+  <source>Expression</source>
+</trans-unit>
+<trans-unit id="s50ebe627b4bc7d02">
+  <source>Binding</source>
+</trans-unit>
+<trans-unit id="s3c6de3f257e0c912">
+  <source>Request</source>
+</trans-unit>
+<trans-unit id="s730182ad28374cda">
+  <source>Object</source>
+</trans-unit>
+<trans-unit id="s890e983a7be64da4">
+  <source>Result</source>
+</trans-unit>
+<trans-unit id="sd3a853f63f45dcb0">
+  <source>Passing</source>
+</trans-unit>
+<trans-unit id="sbdeedc1c60306b35">
+  <source>Messages</source>
+</trans-unit>
+<trans-unit id="s4ba4473f3d4ec896">
+  <source>New version available</source>
+</trans-unit>
+<trans-unit id="s0a5401d4419f9958">
+  <source>Using source</source>
+</trans-unit>
+<trans-unit id="s14622ee6de586485">
+  <source>Attempted to log in as <x id="0" equiv-text="${this.event.context.username}"/></source>
+</trans-unit>
+<trans-unit id="sb07bf992e3d00664">
+  <source>No additional data available.</source>
+</trans-unit>
+<trans-unit id="sf45a0d2f00bcc6ff">
+  <source>no tabs defined</source>
+</trans-unit>
+<trans-unit id="s08df8d0a773a3ea0">
+  <source>Remove item</source>
+</trans-unit>
+<trans-unit id="s04c5a637328c9b67">
+  <source><x id="0" equiv-text="${this.pages?.startIndex}"/> - <x id="1" equiv-text="${this.pages?.endIndex}"/> of <x id="2" equiv-text="${this.pages?.count}"/></source>
+</trans-unit>
+<trans-unit id="s6a89bb10338369b4">
+  <source>Go to previous page</source>
+</trans-unit>
+<trans-unit id="s7edad99c6b7bfe88">
+  <source>Go to next page</source>
+</trans-unit>
+<trans-unit id="sffa721bb6aa3128d">
+  <source>Search...</source>
+</trans-unit>
+<trans-unit id="sb59d68ed12d46377">
+  <source>Loading</source>
+</trans-unit>
+<trans-unit id="s7bc8c327f1f7c82c">
+  <source>No objects found.</source>
+</trans-unit>
+<trans-unit id="sfd44ce578f643145">
+  <source>Failed to fetch objects.</source>
+</trans-unit>
+<trans-unit id="s7b7163270e57e8b4">
+  <source>Refresh</source>
+</trans-unit>
+<trans-unit id="s909e876731a8febb">
+  <source>Select all rows</source>
+</trans-unit>
+<trans-unit id="sa442044b586ec8bf">
+  <source>Action</source>
+</trans-unit>
+<trans-unit id="s02839b01844d6ca8">
+  <source>Creation Date</source>
+</trans-unit>
+<trans-unit id="s4d00f1de1c82281b">
+  <source>Client IP</source>
+</trans-unit>
+<trans-unit id="s744401846fea6e76">
+  <source>Brand</source>
+</trans-unit>
+<trans-unit id="s2152f3482784705f">
+  <source>Recent events</source>
+</trans-unit>
+<trans-unit id="sc35581d9c1cd67ff">
+  <source>On behalf of <x id="0" equiv-text="${item.user.on_behalf_of.username}"/></source>
+</trans-unit>
+<trans-unit id="saf63a04c86018698">
+  <source>-</source>
+</trans-unit>
+<trans-unit id="s1b448a4ea79d4eef">
+  <source>No Events found.</source>
+</trans-unit>
+<trans-unit id="s50911ec1c8aee99a">
+  <source>No matching events could be found.</source>
+</trans-unit>
+<trans-unit id="s113c05ef9996ca4b">
+  <source>Embedded outpost is not configured correctly.</source>
+</trans-unit>
+<trans-unit id="seb5ba88f21937c98">
+  <source>Check outposts.</source>
+</trans-unit>
+<trans-unit id="sd0bc94e11935ee5a">
+  <source>HTTPS is not detected correctly</source>
+</trans-unit>
+<trans-unit id="s40bf151b56a64f51">
+  <source>Server and client are further than 5 seconds apart.</source>
+</trans-unit>
+<trans-unit id="s091d3d07b5b3076f">
+  <source>OK</source>
+</trans-unit>
+<trans-unit id="sae486938be80729c">
+  <source>Everything is ok.</source>
+</trans-unit>
+<trans-unit id="sea91c57b3d3969fe">
+  <source>System status</source>
+</trans-unit>
+<trans-unit id="scefe482c547fb3f3">
+  <source>Based on <x id="0" equiv-text="${value.versionCurrent}"/></source>
+</trans-unit>
+<trans-unit id="s68a50b1ee6efee7b">
+  <source><x id="0" equiv-text="${value.versionLatest}"/> is available!</source>
+</trans-unit>
+<trans-unit id="s713d147e1761d0f0">
+  <source>Up-to-date!</source>
+</trans-unit>
+<trans-unit id="sf4122b220926be97">
+  <source>Version</source>
+</trans-unit>
+<trans-unit id="s0a63a8be0b2b422c">
+  <source>Workers</source>
+</trans-unit>
+<trans-unit id="s341ab68d4130de20">
+  <source>No workers connected. Background tasks will not run.</source>
+</trans-unit>
+<trans-unit id="s2ed8eb02525a920a">
+  <source><x id="0" equiv-text="${ago}"/> hour(s) ago</source>
+</trans-unit>
+<trans-unit id="s98327528f00365a7">
+  <source>Failed to fetch data.</source>
+</trans-unit>
+<trans-unit id="s1f1c857c0c4250e4">
+  <source><x id="0" equiv-text="${ago}"/> day(s) ago</source>
+</trans-unit>
+<trans-unit id="s11bc220e8fa9d797">
+  <source>Authorizations</source>
+</trans-unit>
+<trans-unit id="s3ef3c252ada78076">
+  <source>Failed Logins</source>
+</trans-unit>
+<trans-unit id="sc2f1e5dd74c1b7df">
+  <source>Successful Logins</source>
+</trans-unit>
+<trans-unit id="s0382d73823585617">
+  <source><x id="0" equiv-text="${this.errorMessage}"/>: <x id="1" equiv-text="${e.toString()}"/></source>
+</trans-unit>
+<trans-unit id="s2ceb11be2290bb1b">
+  <source>Cancel</source>
+</trans-unit>
+<trans-unit id="se085f35c8a9203a1">
+  <source>LDAP Source</source>
+</trans-unit>
+<trans-unit id="s477de089b505a6ea">
+  <source>SCIM Provider</source>
+</trans-unit>
+<trans-unit id="s8a75e83497a183a2">
+  <source>Healthy</source>
+</trans-unit>
+<trans-unit id="sbf9c5c5a8e5efad4">
+  <source>Failed</source>
+</trans-unit>
+<trans-unit id="se4cd073c125382af">
+  <source>Unsynced / N/A</source>
+</trans-unit>
+<trans-unit id="sfeb82261bcf99edd">
+  <source>Healthy outposts</source>
+</trans-unit>
+<trans-unit id="s21b3058faf874368">
+  <source>Outdated outposts</source>
+</trans-unit>
+<trans-unit id="s51f92b6fa76656ca">
+  <source>Unhealthy outposts</source>
+</trans-unit>
+<trans-unit id="s0a11c2ffb8309d1a">
+  <source>Not found</source>
+</trans-unit>
+<trans-unit id="saa0e2675da69651b">
+  <source>The URL "<x id="0" equiv-text="${this.url}"/>" was not found.</source>
+</trans-unit>
+<trans-unit id="s58cd9c2fe836d9c6">
+  <source>Return home</source>
+</trans-unit>
+<trans-unit id="s41e035c4bb8d15f2">
+  <source>General system status</source>
+</trans-unit>
+<trans-unit id="s6dfd15978586d05f">
+  <source>Welcome, <x id="0" equiv-text="${name}"/>.</source>
+</trans-unit>
+<trans-unit id="sc381422c585b867f">
+  <source>Quick actions</source>
+</trans-unit>
+<trans-unit id="sfd13ca8ebd857c2e">
+  <source>Create a new application</source>
+</trans-unit>
+<trans-unit id="s079d388d3cbfa54f">
+  <source>Check the logs</source>
+</trans-unit>
+<trans-unit id="sed8d4c3fd5f60e1f">
+  <source>Explore integrations</source>
+</trans-unit>
+<trans-unit id="sfffb0d0958bfbc42">
+  <source>Manage users</source>
+</trans-unit>
+<trans-unit id="s66313b45b69cfc88">
+  <source>Check the release notes</source>
+</trans-unit>
+<trans-unit id="s8763a33c3d46aaf5">
+  <source>Outpost status</source>
+</trans-unit>
+<trans-unit id="scc286303aa9c6cb0">
+  <source>Sync status</source>
+</trans-unit>
+<trans-unit id="sbdc4a833de9ca502">
+  <source>Logins and authorizations over the last week (per 8 hours)</source>
+</trans-unit>
+<trans-unit id="s6e09a19aa3952509">
+  <source>Apps with most usage</source>
+</trans-unit>
+<trans-unit id="sda5e1499f93146ad">
+  <source><x id="0" equiv-text="${ago}"/> days ago</source>
+</trans-unit>
+<trans-unit id="s51ea3a244c781b1f">
+  <source>Objects created</source>
+</trans-unit>
+<trans-unit id="sb4d7bae2440d9781">
+  <source>User Statistics</source>
+</trans-unit>
+<trans-unit id="sfbadb77fbc61efb8">
+  <source>Users created per day in the last month</source>
+</trans-unit>
+<trans-unit id="s4a34a6be4c68ec87">
+  <source>Users created</source>
+</trans-unit>
+<trans-unit id="sb0669da3df95837c">
+  <source>Logins per day in the last month</source>
+</trans-unit>
+<trans-unit id="s835da49b4dc83a51">
+  <source>Failed Logins per day in the last month</source>
+</trans-unit>
+<trans-unit id="s275c956687e2e656">
+  <source>Failed logins</source>
+</trans-unit>
+<trans-unit id="s5f4586bc1e2740e6">
+  <source>Clear search</source>
+</trans-unit>
+<trans-unit id="s3b34d9930e33bd46">
+  <source>System Tasks</source>
+</trans-unit>
+<trans-unit id="saaa3abe03c7260f9">
+  <source>Long-running operations which authentik executes in the background.</source>
+</trans-unit>
+<trans-unit id="s7468e87263dfff7e">
+  <source>Identifier</source>
+</trans-unit>
+<trans-unit id="s63d894b1ddb06289">
+  <source>Description</source>
+</trans-unit>
+<trans-unit id="sa9b2a245441557dc">
+  <source>Last run</source>
+</trans-unit>
+<trans-unit id="sad3e3c8146fc920f">
+  <source>Status</source>
+</trans-unit>
+<trans-unit id="s8af61807443f32a4">
+  <source>Actions</source>
+</trans-unit>
+<trans-unit id="sbe9a51f29a4a2c5b">
+  <source>Successful</source>
+</trans-unit>
+<trans-unit id="s5f343a43e7ea9f91">
+  <source>Error</source>
+</trans-unit>
+<trans-unit id="sc592307ea80f16b9">
+  <source>Unknown</source>
+</trans-unit>
+<trans-unit id="s92921878e886e36d">
+  <source>Duration</source>
+</trans-unit>
+<trans-unit id="se7e1ababbc4868b8">
+  <source><x id="0" equiv-text="${item.taskDuration.toFixed(2)}"/> seconds</source>
+</trans-unit>
+<trans-unit id="s14bf17e2a1a2c381">
+  <source>Restart task</source>
+</trans-unit>
+<trans-unit id="s5e8250fb85d64c23">
+  <source>Close</source>
+</trans-unit>
+<trans-unit id="s382a2aa3984474dd">
+  <source>Create</source>
+</trans-unit>
+<trans-unit id="s0fbf6dc6a1966408">
+  <source>Next</source>
+</trans-unit>
+<trans-unit id="sc16e00a7a8b2fde2">
+  <source>Back</source>
+</trans-unit>
+<trans-unit id="sb3d4f79d9d8b71e5">
+  <source>Submit</source>
+</trans-unit>
+<trans-unit id="sd2223afb7d6b100d">
+  <source>Type</source>
+</trans-unit>
+<trans-unit id="s398f6ba74ba8943a">
+  <source>Select providers to add to application</source>
+</trans-unit>
+<trans-unit id="sf9aee319a006c9b4">
+  <source>Add</source>
+</trans-unit>
+<trans-unit id="sa90b7809586c35ce">
+  <source>Either input a full URL, a relative path, or use 'fa://fa-test' to use the Font Awesome icon "fa-test".</source>
+</trans-unit>
+<trans-unit id="s0410779cb47de312">
+  <source>Path template for users created. Use placeholders like `%(slug)s` to insert the source slug.</source>
+</trans-unit>
+<trans-unit id="s67e20cd8018d7e3c">
+  <source>Currently set to:</source>
+</trans-unit>
+<trans-unit id="sd5903cc8de68b3fc">
+  <source>No form found</source>
+</trans-unit>
+<trans-unit id="s45935843b1b5b496">
+  <source>Form didn't return a promise for submitting</source>
+</trans-unit>
+<trans-unit id="s1a0e95458b44d7f8">
+  <source>Any policy must match to grant access</source>
+</trans-unit>
+<trans-unit id="s7fc1ace65486dc25">
+  <source>All policies must match to grant access</source>
+</trans-unit>
+<trans-unit id="s58fd2aafa4261c55">
+  <source>Successfully updated application.</source>
+</trans-unit>
+<trans-unit id="s9222ca30ae7786e4">
+  <source>Successfully created application.</source>
+</trans-unit>
+<trans-unit id="s03907d7a66c6164e">
+  <source>Application's display Name.</source>
+</trans-unit>
+<trans-unit id="s91f70424f5d5d23e">
+  <source>Slug</source>
+</trans-unit>
+<trans-unit id="s1cffe58249b04669">
+  <source>Internal application name used in URLs.</source>
+</trans-unit>
+<trans-unit id="s98b1cb8fb62909ec">
+  <source>Group</source>
+</trans-unit>
+<trans-unit id="sdae55084f6cb2662">
+  <source>Optionally enter a group name. Applications with identical groups are shown grouped together.</source>
+</trans-unit>
+<trans-unit id="s7f5869b3d14d7cbc">
+  <source>Provider</source>
+</trans-unit>
+<trans-unit id="s350a616ff5e145ec">
+  <source>Select a provider that this application should use.</source>
+</trans-unit>
+<trans-unit id="sc92ea8fbf9ba06a7">
+  <source>Backchannel Providers</source>
+</trans-unit>
+<trans-unit id="s4c6534a118f52fdd">
+  <source>Select backchannel providers which augment the functionality of the main provider.</source>
+</trans-unit>
+<trans-unit id="s19409e8712ddd369">
+  <source>Add provider</source>
+</trans-unit>
+<trans-unit id="s0639662111324466">
+  <source>Policy engine mode</source>
+</trans-unit>
+<trans-unit id="s8be4abc7ca71da6c">
+  <source>UI settings</source>
+</trans-unit>
+<trans-unit id="s427f788ff333f45b">
+  <source>Launch URL</source>
+</trans-unit>
+<trans-unit id="s992f8d1a776e763c">
+  <source>If left empty, authentik will try to extract the launch URL based on the selected provider.</source>
+</trans-unit>
+<trans-unit id="s2348f46ebf436671">
+  <source>Open in new tab</source>
+</trans-unit>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s068d4dd16d9106d0">
+  <source>Icon</source>
+</trans-unit>
+<trans-unit id="s80e6d6fe5ad458d3">
+  <source>Clear icon</source>
+</trans-unit>
+<trans-unit id="s485c05d34eb00415">
+  <source>Delete currently set icon.</source>
+</trans-unit>
+<trans-unit id="s6d3b4d0561ba1cff">
+  <source>Publisher</source>
+</trans-unit>
+<trans-unit id="se2b29e6cfe59414c">
+  <source>UI Settings</source>
+</trans-unit>
+<trans-unit id="s4498e890d47a8066">
+  <source>OAuth2/OIDC (Open Authorization/OpenID Connect)</source>
+</trans-unit>
+<trans-unit id="sc2cedfb22488ccb2">
+  <source>Modern applications, APIs and Single-page applications.</source>
+</trans-unit>
+<trans-unit id="s4f2e195d09e2868c">
+  <source>LDAP (Lightweight Directory Access Protocol)</source>
+</trans-unit>
+<trans-unit id="sffd5481034a1bd41">
+  <source>Provide an LDAP interface for applications and users to authenticate against.</source>
+</trans-unit>
+<trans-unit id="s836148f721d8913b">
+  <source>Transparent Reverse Proxy</source>
+</trans-unit>
+<trans-unit id="s945a6b94361ee45b">
+  <source>For transparent reverse proxies with required authentication</source>
+</trans-unit>
+<trans-unit id="s7f5bb0c9923315ed">
+  <source>Forward Auth (Single Application)</source>
+</trans-unit>
+<trans-unit id="sdc9a6ad1af30572c">
+  <source>For nginx's auth_request or traefik's forwardAuth</source>
+</trans-unit>
+<trans-unit id="sf8008d2d6b064b95">
+  <source>Forward Auth (Domain Level)</source>
+</trans-unit>
+<trans-unit id="sfc31264ef7ff86ef">
+  <source>For nginx's auth_request or traefik's forwardAuth per root domain</source>
+</trans-unit>
+<trans-unit id="sfa8a1ffa9fee07d3">
+  <source>SAML (Security Assertion Markup Language)</source>
+</trans-unit>
+<trans-unit id="s40830ec037f34626">
+  <source>Configure SAML provider manually</source>
+</trans-unit>
+<trans-unit id="s848a23972e388662">
+  <source>RADIUS (Remote Authentication Dial-In User Service)</source>
+</trans-unit>
+<trans-unit id="sea9fc40dfd1d18b1">
+  <source>Configure RADIUS provider manually</source>
+</trans-unit>
+<trans-unit id="s3e902999ddf7b50e">
+  <source>SCIM (System for Cross-domain Identity Management)</source>
+</trans-unit>
+<trans-unit id="sa1b0052ae095b9b3">
+  <source>Configure SCIM provider manually</source>
+</trans-unit>
+<trans-unit id="s15831fa50a116545">
+  <source>Saving Application...</source>
+</trans-unit>
+<trans-unit id="s823abdb61543a826">
+  <source>Authentik was unable to save this application:</source>
+</trans-unit>
+<trans-unit id="s848288f8c2265aad">
+  <source>Your application has been saved</source>
+</trans-unit>
+<trans-unit id="scda8dc24b561e205">
+  <source>There was an error in the application.</source>
+</trans-unit>
+<trans-unit id="sdaca9c2c0361ed3a">
+  <source>Review the application.</source>
+</trans-unit>
+<trans-unit id="sb50000a8fada5672">
+  <source>There was an error in the provider.</source>
+</trans-unit>
+<trans-unit id="s21f95eaf151d4ce3">
+  <source>Review the provider.</source>
+</trans-unit>
+<trans-unit id="s9fd39a5cb20b4e61">
+  <source>There was an error</source>
+</trans-unit>
+<trans-unit id="s7a6b3453209e1066">
+  <source>There was an error creating the application, but no error message was sent. Please review the server logs.</source>
+</trans-unit>
+<trans-unit id="sc25edca57df81461">
+  <source>Authentication</source>
+</trans-unit>
+<trans-unit id="s6dfb7283452f78fe">
+  <source>Authorization</source>
+</trans-unit>
+<trans-unit id="sddcfc6ab24e3a6ed">
+  <source>Enrollment</source>
+</trans-unit>
+<trans-unit id="s1fc9c70610c4c67d">
+  <source>Invalidation</source>
+</trans-unit>
+<trans-unit id="sdf22dcf939c27cc7">
+  <source>Stage Configuration</source>
+</trans-unit>
+<trans-unit id="s6d5bce4321f57cda">
+  <source>Unenrollment</source>
+</trans-unit>
+<trans-unit id="sde2bb5418562c5b2">
+  <source>Unknown designation</source>
+</trans-unit>
+<trans-unit id="sb9834316ffd4ae3e">
+  <source>Stacked</source>
+</trans-unit>
+<trans-unit id="s12146091b2b539a3">
+  <source>Content left</source>
+</trans-unit>
+<trans-unit id="sa800871782eba1ac">
+  <source>Content right</source>
+</trans-unit>
+<trans-unit id="sb4e50ca3cffdbc10">
+  <source>Sidebar left</source>
+</trans-unit>
+<trans-unit id="s745a55f9abf9f2e5">
+  <source>Sidebar right</source>
+</trans-unit>
+<trans-unit id="sb3182a87ded1bc91">
+  <source>Unknown layout</source>
+</trans-unit>
+<trans-unit id="s8915e64b8b999bfe">
+  <source>Cached binding</source>
+</trans-unit>
+<trans-unit id="s842d690eb3c11762">
+  <source>Flow is executed and session is cached in memory. Flow is executed when session expires</source>
+</trans-unit>
+<trans-unit id="s6a66759749bf31ed">
+  <source>Direct binding</source>
+</trans-unit>
+<trans-unit id="se0adaf83627104fb">
+  <source>Always execute the configured bind flow to authenticate the user</source>
+</trans-unit>
+<trans-unit id="s9065fcccd837a679">
+  <source>Cached querying</source>
+</trans-unit>
+<trans-unit id="s30d0d0e6c626a234">
+  <source>The outpost holds all users and groups in-memory and will refresh every 5 Minutes</source>
+</trans-unit>
+<trans-unit id="sffc14b8200a9f938">
+  <source>Direct querying</source>
+</trans-unit>
+<trans-unit id="sdce4680288083fe3">
+  <source>Always returns the latest data, but slower than cached querying</source>
+</trans-unit>
+<trans-unit id="s1889ba2eaeec2f1e">
+  <source>When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.</source>
+</trans-unit>
+<trans-unit id="s1c8e9816dcae6d9c">
+  <source>The start for gidNumbers, this number is added to a number generated from the group.Pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber</source>
+</trans-unit>
+<trans-unit id="s4647b2c92638d6fd">
+  <source>The certificate for the above configured Base DN. As a fallback, the provider uses a self-signed certificate.</source>
+</trans-unit>
+<trans-unit id="s2acef4f6ba39bf11">
+  <source>DNS name for which the above configured certificate should be used. The certificate cannot be detected based on the base DN, as the SSL/TLS negotiation happens before such data is exchanged.</source>
+</trans-unit>
+<trans-unit id="s60edbcfac8ed1f90">
+  <source>The start for uidNumbers, this number is added to the user.Pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber</source>
+</trans-unit>
+<trans-unit id="s1a711c19cda48375">
+  <source>Configure LDAP Provider</source>
+</trans-unit>
+<trans-unit id="s67d858051b34c38b">
+  <source>Method's display Name.</source>
+</trans-unit>
+<trans-unit id="sff69c1a637f899a6">
+  <source>Bind flow</source>
+</trans-unit>
+<trans-unit id="s319040353f479853">
+  <source>Flow used for users to authenticate.</source>
+</trans-unit>
+<trans-unit id="sbc80eab557fbf782">
+  <source>Search group</source>
+</trans-unit>
+<trans-unit id="se5973e7c8ba0fc71">
+  <source>Bind mode</source>
+</trans-unit>
+<trans-unit id="scef3f4ad80abbd22">
+  <source>Configure how the outpost authenticates requests.</source>
+</trans-unit>
+<trans-unit id="sbcae51a6f06e53d4">
+  <source>Search mode</source>
+</trans-unit>
+<trans-unit id="s8b87df5664de7eb8">
+  <source>Configure how the outpost queries the core authentik server's users.</source>
+</trans-unit>
+<trans-unit id="s254d527e3a53dbb7">
+  <source>Code-based MFA Support</source>
+</trans-unit>
+<trans-unit id="sfe388f0313f52da2">
+  <source>Protocol settings</source>
+</trans-unit>
+<trans-unit id="s55d731be1ef66efe">
+  <source>Base DN</source>
+</trans-unit>
+<trans-unit id="s0b15ff11a0049cfd">
+  <source>LDAP DN under which bind requests and search requests can be made.</source>
+</trans-unit>
+<trans-unit id="sb157267c85fdff30">
+  <source>Certificate</source>
+</trans-unit>
+<trans-unit id="scd247ffad6e04ac0">
+  <source>TLS Server name</source>
+</trans-unit>
+<trans-unit id="sac43cb9690260b86">
+  <source>UID start number</source>
+</trans-unit>
+<trans-unit id="s5acb607b40356974">
+  <source>GID start number</source>
+</trans-unit>
+<trans-unit id="sdfd22a21660f6002">
+  <source>Successfully updated provider.</source>
+</trans-unit>
+<trans-unit id="s457c639088c547c5">
+  <source>Successfully created provider.</source>
+</trans-unit>
+<trans-unit id="s2236dc563c2dbf76">
+  <source>(Format: hours=-1;minutes=-2;seconds=-3).</source>
+</trans-unit>
+<trans-unit id="sbec40ef4e6f139b7">
+  <source>(Format: hours=1;minutes=2;seconds=3).</source>
+</trans-unit>
+<trans-unit id="sbb8ad22c83d375b1">
+  <source>The following keywords are supported:</source>
+</trans-unit>
+<trans-unit id="s399cc2d67d92e957">
+  <source>Confidential</source>
+</trans-unit>
+<trans-unit id="s95f09b229a0a0bb0">
+  <source>Confidential clients are capable of maintaining the confidentiality of their credentials such as client secrets</source>
+</trans-unit>
+<trans-unit id="sdd1ff479d04ac140">
+  <source>Public</source>
+</trans-unit>
+<trans-unit id="s51c6b8403c2dc5d9">
+  <source>Public clients are incapable of maintaining the confidentiality and should use methods like PKCE. </source>
+</trans-unit>
+<trans-unit id="sccc47f82044453f9">
+  <source>Based on the User's hashed ID</source>
+</trans-unit>
+<trans-unit id="sbd5be4fb7442a34c">
+  <source>Based on the User's ID</source>
+</trans-unit>
+<trans-unit id="sc9cf9ecaf9e5d67e">
+  <source>Based on the User's UUID</source>
+</trans-unit>
+<trans-unit id="s4291727352c4f295">
+  <source>Based on the User's username</source>
+</trans-unit>
+<trans-unit id="sd62cfc27ad4aa33b">
+  <source>Based on the User's Email</source>
+</trans-unit>
+<trans-unit id="s55eb75bedf96be0f">
+  <source>This is recommended over the UPN mode.</source>
+</trans-unit>
+<trans-unit id="sf80e9547166117e6">
+  <source>Based on the User's UPN</source>
+</trans-unit>
+<trans-unit id="sde949d0ef44572eb">
+  <source>Requires the user to have a 'upn' attribute set, and falls back to hashed user ID. Use this mode only if you have different UPN and Mail domains.</source>
+</trans-unit>
+<trans-unit id="sde56783222b527d6">
+  <source>Each provider has a different issuer, based on the application slug</source>
+</trans-unit>
+<trans-unit id="s8d32d7b9e8ca60b1">
+  <source>Same identifier is used for all providers</source>
+</trans-unit>
+<trans-unit id="s7f9eb9c8bd26e8fd">
+  <source>Valid redirect URLs after a successful authorization flow. Also specify any origins here for Implicit flows.</source>
+</trans-unit>
+<trans-unit id="s2a369bc2febb5d55">
+  <source>If no explicit redirect URIs are specified, the first successfully used redirect URI will be saved.</source>
+</trans-unit>
+<trans-unit id="sa8384c9c26731f83">
+  <source>To allow any redirect URI, set this value to ".*". Be aware of the possible security implications this can have.</source>
+</trans-unit>
+<trans-unit id="sbb3243352661428f">
+  <source>Authentication flow</source>
+</trans-unit>
+<trans-unit id="sa72a3bd1e7e89926">
+  <source>Flow used when a user access this provider and is not authenticated.</source>
+</trans-unit>
+<trans-unit id="s62f7c59b0606a8d6">
+  <source>Authorization flow</source>
+</trans-unit>
+<trans-unit id="sfbaeb0de54fbfdbb">
+  <source>Flow used when authorizing this provider.</source>
+</trans-unit>
+<trans-unit id="sc8de93a7dc0d78ba">
+  <source>Client type</source>
+</trans-unit>
+<trans-unit id="s4d00e5de1c8213b7">
+  <source>Client ID</source>
+</trans-unit>
+<trans-unit id="s03fb3fa232f0434a">
+  <source>Client Secret</source>
+</trans-unit>
+<trans-unit id="sde0ad51b14f77cf6">
+  <source>Redirect URIs/Origins (RegEx)</source>
+</trans-unit>
+<trans-unit id="s55787f4dfcdce52b">
+  <source>Signing Key</source>
+</trans-unit>
+<trans-unit id="sc6c57419ad3a01a8">
+  <source>Key used to sign the tokens.</source>
+</trans-unit>
+<trans-unit id="s124f93a61ee772d6">
+  <source>Advanced protocol settings</source>
+</trans-unit>
+<trans-unit id="s926e0ecf124fb01a">
+  <source>Access code validity</source>
+</trans-unit>
+<trans-unit id="sa578033f134a83b6">
+  <source>Configure how long access codes are valid for.</source>
+</trans-unit>
+<trans-unit id="sbea3db12fd799210">
+  <source>Access Token validity</source>
+</trans-unit>
+<trans-unit id="s72559845d38bf688">
+  <source>Configure how long access tokens are valid for.</source>
+</trans-unit>
+<trans-unit id="s821f6014c1a435b9">
+  <source>Refresh Token validity</source>
+</trans-unit>
+<trans-unit id="s00c2db16ea9bc263">
+  <source>Configure how long refresh tokens are valid for.</source>
+</trans-unit>
+<trans-unit id="s2e3ef41a0edd8608">
+  <source>Scopes</source>
+</trans-unit>
+<trans-unit id="s3a3fae99373ce56b">
+  <source>Select which scopes can be used by the client. The client still has to specify the scope to access the data.</source>
+</trans-unit>
+<trans-unit id="sffd2e553143d1b0e">
+  <source>Hold control/command to select multiple items.</source>
+</trans-unit>
+<trans-unit id="s26bf2730430efbea">
+  <source>Subject mode</source>
+</trans-unit>
+<trans-unit id="s9f23ed1799b4d49a">
+  <source>Configure what data should be used as unique User Identifier. For most cases, the default should be fine.</source>
+</trans-unit>
+<trans-unit id="s17d1e337f6c11c1e">
+  <source>Include claims in id_token</source>
+</trans-unit>
+<trans-unit id="sbf41e0db12834133">
+  <source>Include User claims from scopes in the id_token, for applications that don't access the userinfo endpoint.</source>
+</trans-unit>
+<trans-unit id="s850a58c683682809">
+  <source>Issuer mode</source>
+</trans-unit>
+<trans-unit id="s37d9155b9f4cc7bd">
+  <source>Configure how the issuer field of the ID Token should be filled.</source>
+</trans-unit>
+<trans-unit id="se2adaf0371ffcd65">
+  <source>Machine-to-Machine authentication settings</source>
+</trans-unit>
+<trans-unit id="s33318837e6c54a9b">
+  <source>Trusted OIDC Sources</source>
+</trans-unit>
+<trans-unit id="s22e566052f7bec81">
+  <source>JWTs signed by certificates configured in the selected sources can be used to authenticate to this provider.</source>
+</trans-unit>
+<trans-unit id="s9368e965b5c292ab">
+  <source>Configure OAuth2/OpenId Provider</source>
+</trans-unit>
+<trans-unit id="s072c6d12d3d37501">
+  <source>HTTP-Basic Username Key</source>
+</trans-unit>
+<trans-unit id="sb2bb6f93773a4594">
+  <source>User/Group Attribute used for the user part of the HTTP-Basic Header. If not set, the user's Email address is used.</source>
+</trans-unit>
+<trans-unit id="s70f6471de355b98c">
+  <source>HTTP-Basic Password Key</source>
+</trans-unit>
+<trans-unit id="sf4de1644dcdb53d5">
+  <source>User/Group Attribute used for the password part of the HTTP-Basic Header.</source>
+</trans-unit>
+<trans-unit id="sf5cbccdc6254c8dc">
+  <source>Configure Proxy Provider</source>
+</trans-unit>
+<trans-unit id="s7c10976de6411844">
+  <source>Token validity</source>
+</trans-unit>
+<trans-unit id="s3e87ce98ba3c4d80">
+  <source>Configure how long tokens are valid for.</source>
+</trans-unit>
+<trans-unit id="sf6d46bb442b77e91">
+  <source>AdditionalScopes</source>
+</trans-unit>
+<trans-unit id="s8f12575f694e85a2">
+  <source>Additional scope mappings, which are passed to the proxy.</source>
+</trans-unit>
+<trans-unit id="s93cea6ca1f93349d">
+  <source>Unauthenticated URLs</source>
+</trans-unit>
+<trans-unit id="sc4508175bf6b09dd">
+  <source>Unauthenticated Paths</source>
+</trans-unit>
+<trans-unit id="sc9fc206433f67588">
+  <source>Regular expressions for which authentication is not required. Each new line is interpreted as a new expression.</source>
+</trans-unit>
+<trans-unit id="sd503fabef9691134">
+  <source>When using proxy or forward auth (single application) mode, the requested URL Path is checked against the regular expressions. When using forward auth (domain mode), the full requested URL including scheme and host is matched against the regular expressions.</source>
+</trans-unit>
+<trans-unit id="sb488dee0be434f7e">
+  <source>Authentication settings</source>
+</trans-unit>
+<trans-unit id="s23cee624c735f266">
+  <source>Intercept header authentication</source>
+</trans-unit>
+<trans-unit id="sc007cca5af67eae0">
+  <source>When enabled, authentik will intercept the Authorization header to authenticate the request.</source>
+</trans-unit>
+<trans-unit id="s36e630ba56617556">
+  <source>Send HTTP-Basic Authentication</source>
+</trans-unit>
+<trans-unit id="s9d5796a4b9b7560e">
+  <source>Send a custom HTTP-Basic Authentication header based on values from authentik.</source>
+</trans-unit>
+<trans-unit id="s44c90273f08fb718">
+  <source>Use this provider with nginx's auth_request or traefik's forwardAuth. Only a single provider is required per root domain. You can't do per-application authorization, but you don't have to create a provider for each application.</source>
+</trans-unit>
+<trans-unit id="sf55d28d4dff0e41b">
+  <source>An example setup can look like this:</source>
+</trans-unit>
+<trans-unit id="sb4a1d1c19438e929">
+  <source>authentik running on auth.example.com</source>
+</trans-unit>
+<trans-unit id="s68f935c9ca792016">
+  <source>app1 running on app1.example.com</source>
+</trans-unit>
+<trans-unit id="sf813a72d8fadd765">
+  <source>In this case, you'd set the Authentication URL to auth.example.com and Cookie domain to example.com.</source>
+</trans-unit>
+<trans-unit id="sa29b5680cfafacc8">
+  <source>External host</source>
+</trans-unit>
+<trans-unit id="sa03fe48e892df2d8">
+  <source>The external URL you'll authenticate at. The authentik core server should be reachable under this URL.</source>
+</trans-unit>
+<trans-unit id="s7def067ed3ad3ad9">
+  <source>Cookie domain</source>
+</trans-unit>
+<trans-unit id="s211b75e868072162">
+  <source>Set this to the domain you wish the authentication to be valid for. Must be a parent domain of the URL above. If you're running applications as app1.domain.tld, app2.domain.tld, set this to 'domain.tld'.</source>
+</trans-unit>
+<trans-unit id="s93574c03953f25dd">
+  <source>This provider will behave like a transparent reverse-proxy, except requests must be authenticated. If your upstream application uses HTTPS, make sure to connect to the outpost using HTTPS as well.</source>
+</trans-unit>
+<trans-unit id="s764bccb30868bf62">
+  <source>The external URL you'll access the application at. Include any non-standard port.</source>
+</trans-unit>
+<trans-unit id="scb317851cbcc6b12">
+  <source>Internal host</source>
+</trans-unit>
+<trans-unit id="sf05e384059a0a7c1">
+  <source>Upstream host that the requests are forwarded to.</source>
+</trans-unit>
+<trans-unit id="s3d34068a31cab30b">
+  <source>Internal host SSL Validation</source>
+</trans-unit>
+<trans-unit id="s4a26798e1c3c37dd">
+  <source>Validate SSL Certificates of upstream servers.</source>
+</trans-unit>
+<trans-unit id="h10ef80d434185070">
+  <source>Use this provider with nginx's <x id="0" equiv-text="&lt;code&gt;"/>auth_request<x id="1" equiv-text="&lt;/code&gt;"/> or traefik's
+                    <x id="2" equiv-text="&lt;code&gt;"/>forwardAuth<x id="3" equiv-text="&lt;/code&gt;"/>. Each application/domain needs its own provider.
+                    Additionally, on each domain, <x id="4" equiv-text="&lt;code&gt;"/>/outpost.goauthentik.io<x id="5" equiv-text="&lt;/code&gt;"/> must be
+                    routed to the outpost (when using a managed outpost, this is done for you).</source>
+</trans-unit>
+<trans-unit id="s2c8c6f89089b31d4">
+  <source>Configure Radius Provider</source>
+</trans-unit>
+<trans-unit id="sb95baab425322600">
+  <source>Shared secret</source>
+</trans-unit>
+<trans-unit id="s9e9316a6b0c16231">
+  <source>Client Networks</source>
+</trans-unit>
+<trans-unit id="s7f2dcf01f7a8c0b7">
+  <source>List of CIDRs (comma-seperated) that clients can connect from. A more specific
+                            CIDR will match before a looser one. Clients connecting from a non-specified CIDR
+                            will be dropped.</source>
+</trans-unit>
+<trans-unit id="sd8f220c999726151">
+  <source>Redirect</source>
+</trans-unit>
+<trans-unit id="sb357ea19a722d827">
+  <source>Post</source>
+</trans-unit>
+<trans-unit id="sfe906cde5dddc041">
+  <source>Configure SAML Provider</source>
+</trans-unit>
+<trans-unit id="s11204eeb1e27ea8f">
+  <source>ACS URL</source>
+</trans-unit>
+<trans-unit id="sb7a30abc1dcf6c36">
+  <source>Issuer</source>
+</trans-unit>
+<trans-unit id="sf54c562d8a10ce77">
+  <source>Also known as EntityID.</source>
+</trans-unit>
+<trans-unit id="s991b750e2d5c4234">
+  <source>Service Provider Binding</source>
+</trans-unit>
+<trans-unit id="s4e28e2899e08a5f8">
+  <source>Determines how authentik sends the response back to the Service Provider.</source>
+</trans-unit>
+<trans-unit id="sd5a4b41c6c883b03">
+  <source>Audience</source>
+</trans-unit>
+<trans-unit id="sc741d9ebe07ad103">
+  <source>Signing Certificate</source>
+</trans-unit>
+<trans-unit id="sd6c3ddb62de0e8f7">
+  <source>Certificate used to sign outgoing Responses going to the Service Provider.</source>
+</trans-unit>
+<trans-unit id="s5be3b0567172e415">
+  <source>Verification Certificate</source>
+</trans-unit>
+<trans-unit id="s7c27e113f90a89e0">
+  <source>When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.</source>
+</trans-unit>
+<trans-unit id="sce106606ae84d46f">
+  <source>Property Mappings</source>
+</trans-unit>
+<trans-unit id="sb3defbacd01ad972">
+  <source>Property mappings used for user mapping.</source>
+</trans-unit>
+<trans-unit id="s1a2797874b7fe852">
+  <source>NameID Property Mapping</source>
+</trans-unit>
+<trans-unit id="s256b8452664ccae4">
+  <source>Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be respected.</source>
+</trans-unit>
+<trans-unit id="s9f91cc8bcfabb40f">
+  <source>Assertion valid not before</source>
+</trans-unit>
+<trans-unit id="s733f83ff9d50da30">
+  <source>Configure the maximum allowed time drift for an assertion.</source>
+</trans-unit>
+<trans-unit id="s2af5754090898640">
+  <source>Assertion valid not on or after</source>
+</trans-unit>
+<trans-unit id="s43c1f927936f0a02">
+  <source>Assertion not valid on or after current time + this value.</source>
+</trans-unit>
+<trans-unit id="sad8550b8731518d8">
+  <source>Session valid not on or after</source>
+</trans-unit>
+<trans-unit id="s0dd00fbaba08748a">
+  <source>Session not valid on or after current time + this value.</source>
+</trans-unit>
+<trans-unit id="s2a0f60e74b478804">
+  <source>Digest algorithm</source>
+</trans-unit>
+<trans-unit id="s693d975d38ff0214">
+  <source>Signature algorithm</source>
+</trans-unit>
+<trans-unit id="s7ccce0ec8d228db6">
+  <source>Configure SCIM Provider</source>
+</trans-unit>
+<trans-unit id="s61eacb19db252f5e">
+  <source>URL</source>
+</trans-unit>
+<trans-unit id="sb21f33b039c86322">
+  <source>SCIM base url, usually ends in /v2.</source>
+</trans-unit>
+<trans-unit id="se68398e3c2c760b2">
+  <source>Token</source>
+</trans-unit>
+<trans-unit id="s33ed903c210a6209">
+  <source>Token to authenticate with. Currently only bearer authentication is supported.</source>
+</trans-unit>
+<trans-unit id="sfc8bb104e2c05af8">
+  <source>User filtering</source>
+</trans-unit>
+<trans-unit id="sc0d0890fbd46ef62">
+  <source>Exclude service accounts</source>
+</trans-unit>
+<trans-unit id="s23ab136ad85f0ad2">
+  <source>Only sync users within the selected group.</source>
+</trans-unit>
+<trans-unit id="sfdedc3b0b2b7ce3d">
+  <source>Attribute mapping</source>
+</trans-unit>
+<trans-unit id="saf794c74c9ea731e">
+  <source>User Property Mappings</source>
+</trans-unit>
+<trans-unit id="s7cb9aa9ee1783f00">
+  <source>Group Property Mappings</source>
+</trans-unit>
+<trans-unit id="sd7728d2b6e1d25e9">
+  <source>Property mappings used for group creation.</source>
+</trans-unit>
+<trans-unit id="s4bd386db7302bb22">
+  <source>Create With Wizard</source>
+</trans-unit>
+<trans-unit id="s0c9670f429e74283">
+  <source>New application</source>
+</trans-unit>
+<trans-unit id="s71c5d51d5a357dbd">
+  <source>Don't show this message again.</source>
+</trans-unit>
+<trans-unit id="s070fdfb03034ca9b">
+  <source>One hint, 'New Application Wizard', is currently hidden</source>
+</trans-unit>
+<trans-unit id="s04b7f8d6aaef3756">
+  <source>Users in the selected group can do search queries. If no group is selected, no LDAP Searches are allowed.</source>
+</trans-unit>
+<trans-unit id="sb8dd788adf7b907b">
+  <source>Proxy</source>
+</trans-unit>
+<trans-unit id="s7489f76224f8120d">
+  <source>Forward auth (single application)</source>
+</trans-unit>
+<trans-unit id="s25d0cd75377daf75">
+  <source>Forward auth (domain level)</source>
+</trans-unit>
+<trans-unit id="sff0ac1ace2d90709">
+  <source>Use this provider with nginx's auth_request or traefik's forwardAuth. Each application/domain needs its own provider. Additionally, on each domain, /outpost.goauthentik.io must be routed to the outpost (when using a managed outpost, this is done for you).</source>
+</trans-unit>
+<trans-unit id="s31d15c6f16951464">
+  <source>Authentication URL</source>
+</trans-unit>
+<trans-unit id="s2345170f7e272668">
+  <source>Unknown proxy mode</source>
+</trans-unit>
+<trans-unit id="sd539548ca4c71619">
+  <source>Additional scopes</source>
+</trans-unit>
+<trans-unit id="se6d950402810c34f">
+  <source>Property mappings</source>
+</trans-unit>
+<trans-unit id="scb58b8a60cad8762">
+  <source>Default relay state</source>
+</trans-unit>
+<trans-unit id="s6827a456c9dfc6ee">
+  <source>When using IDP-initiated logins, the relay state will be set to this value.</source>
+</trans-unit>
+<trans-unit id="sd1a5560fde6f2271">
+  <source>Successfully imported provider.</source>
+</trans-unit>
+<trans-unit id="s252a52330d32b900">
+  <source>Metadata</source>
+</trans-unit>
+<trans-unit id="s7181a5504472e856">
+  <source>Apply changes</source>
+</trans-unit>
+<trans-unit id="sad59707375956ad2">
+  <source>Finish</source>
+</trans-unit>
+<trans-unit id="s74475586afc1fb0f">
+  <source>Select type</source>
+</trans-unit>
+<trans-unit id="s0b3bf19b31dd6bac">
+  <source>Try the new application wizard</source>
+</trans-unit>
+<trans-unit id="sa18e1c6e0e6f16cc">
+  <source>The new application wizard greatly simplifies the steps required to create applications and providers.</source>
+</trans-unit>
+<trans-unit id="s01ef54f5d7c6ed47">
+  <source>Try it now</source>
+</trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+</trans-unit>
+<trans-unit id="s58d1eb482059da12">
+  <source>New provider</source>
+</trans-unit>
+<trans-unit id="sa661ea7d7a50f2e9">
+  <source>Create a new provider.</source>
+</trans-unit>
+<trans-unit id="s5d6af4c100ad321b">
+  <source>Create <x id="0" equiv-text="${type.name}"/></source>
+</trans-unit>
+<trans-unit id="sa2ea0fcd3ffa80e0">
+  <source>Connection expiry</source>
+</trans-unit>
+<trans-unit id="s6dd297c217729828">
+  <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
+</trans-unit>
+<trans-unit id="s9d8b8aa2b404c2c8">
+  <source>Settings</source>
+</trans-unit>
+<trans-unit id="s3271da6c18c25b18">
+  <source>Connection settings.</source>
+</trans-unit>
+<trans-unit id="s019555b5a442aa00">
+  <source>Property mappings used to user mapping.</source>
+</trans-unit>
+<trans-unit id="sa319e3bf44c85963">
+  <source>Property mappings used to group creation.</source>
+</trans-unit>
+<trans-unit id="se09ab93d69f7f45b">
+  <source>Not used by any other object.</source>
+</trans-unit>
+<trans-unit id="s10922bd0ac765562">
+  <source>object will be DELETED</source>
+</trans-unit>
+<trans-unit id="sf3981f36525b0dbd">
+  <source>connection will be deleted</source>
+</trans-unit>
+<trans-unit id="s93cf77a59db53395">
+  <source>reference will be reset to default value</source>
+</trans-unit>
+<trans-unit id="s3e211d29fa10f843">
+  <source>reference will be set to an empty value</source>
+</trans-unit>
+<trans-unit id="s55fa598b754cc3cc">
+  <source><x id="0" equiv-text="${ub.name}"/> (<x id="1" equiv-text="${consequence}"/>)</source>
+</trans-unit>
+<trans-unit id="s09240e07b5b8d640">
+  <source>ID</source>
+</trans-unit>
+<trans-unit id="se33b158a1ec02a09">
+  <source>Successfully deleted <x id="0" equiv-text="${this.objects.length} ${this.objectLabel}"/></source>
+</trans-unit>
+<trans-unit id="sf6eb148db23d19de">
+  <source>Failed to delete <x id="0" equiv-text="${this.objectLabel}"/>: <x id="1" equiv-text="${e.toString()}"/></source>
+</trans-unit>
+<trans-unit id="s039b6434e8a75560">
+  <source>Delete <x id="0" equiv-text="${this.objectLabel}"/></source>
+</trans-unit>
+<trans-unit id="s5819a49638f6d7cb">
+  <source>Are you sure you want to delete <x id="0" equiv-text="${this.objects.length} ${this.objectLabel}"/>?</source>
+</trans-unit>
+<trans-unit id="sdc673e73b5c13aea">
+  <source>Delete</source>
+</trans-unit>
+<trans-unit id="sb0b86b8ca6ab13bd">
+  <source>Providers</source>
+</trans-unit>
+<trans-unit id="s3ffa320128991a45">
+  <source>Provide support for protocols like SAML and OAuth to assigned applications.</source>
+</trans-unit>
+<trans-unit id="s10929ca568ae10bc">
+  <source>Provider(s)</source>
+</trans-unit>
+<trans-unit id="sb2b3b281954752c4">
+  <source>Assigned to application </source>
+</trans-unit>
+<trans-unit id="sa6c0ba4910c7ad7f">
+  <source>Assigned to application (backchannel) </source>
+</trans-unit>
+<trans-unit id="s97f5e0c138eae172">
+  <source>Warning: Provider not assigned to any application.</source>
+</trans-unit>
+<trans-unit id="s8b0432eecbd8b034">
+  <source>Update</source>
+</trans-unit>
+<trans-unit id="sc9175cb129fdc306">
+  <source>Update <x id="0" equiv-text="${item.verboseName}"/></source>
+</trans-unit>
+<trans-unit id="s64ef2a6c2dd1d3d1">
+  <source>Edit</source>
+</trans-unit>
+<trans-unit id="sa8c45b6b92a8ba1f">
+  <source>Create Application</source>
+</trans-unit>
+<trans-unit id="sf485014051ad0cf7">
+  <source>Successfully assigned permission.</source>
+</trans-unit>
+<trans-unit id="sca7fed2bef53cb99">
+  <source>Role</source>
+</trans-unit>
+<trans-unit id="sc92c1a54034e21cc">
+  <source>Assign</source>
+</trans-unit>
+<trans-unit id="scd84d10ee9137070">
+  <source>Assign permission to role</source>
+</trans-unit>
+<trans-unit id="s5ee6f1b84e9ebc69">
+  <source>Assign to new role</source>
+</trans-unit>
+<trans-unit id="sb923723d27df40ba">
+  <source>Permission(s)</source>
+</trans-unit>
+<trans-unit id="sc5fb00b25c7f5a02">
+  <source>Permission</source>
+</trans-unit>
+<trans-unit id="s4afb26a8fae257e9">
+  <source>Directly assigned</source>
+</trans-unit>
+<trans-unit id="sd8051c26e155f043">
+  <source>Assign permission to user</source>
+</trans-unit>
+<trans-unit id="sf79f8681e5ffaee2">
+  <source>Assign to new user</source>
+</trans-unit>
+<trans-unit id="s9fb28be12e2c6317">
+  <source>Superuser</source>
+</trans-unit>
+<trans-unit id="sc615309d10a9228c">
+  <source>RBAC is in preview.</source>
+</trans-unit>
+<trans-unit id="sa1db89262360550b">
+  <source>Send us feedback!</source>
+</trans-unit>
+<trans-unit id="saabeb4cab074b0b9">
+  <source>User Object Permissions</source>
+</trans-unit>
+<trans-unit id="s8489d5559dda260c">
+  <source>Role Object Permissions</source>
+</trans-unit>
+<trans-unit id="s3d197283cb019b5a">
+  <source>Overview</source>
+</trans-unit>
+<trans-unit id="s6c3daaac4eed12f9">
+  <source>Changelog</source>
+</trans-unit>
+<trans-unit id="se8dca0132c66ae03">
+  <source>Permissions</source>
+</trans-unit>
+<trans-unit id="s05e395ff60af047b">
+  <source>Warning: Provider is not used by any Outpost.</source>
+</trans-unit>
+<trans-unit id="sccbfc4dec0c8d80c">
+  <source>Assigned to application</source>
+</trans-unit>
+<trans-unit id="s2d46e3a9ee8e0e7e">
+  <source>Update LDAP Provider</source>
+</trans-unit>
+<trans-unit id="saf24e253b3b006d4">
+  <source>How to connect</source>
+</trans-unit>
+<trans-unit id="s02b3fade1795d03f">
+  <source>Connect to the LDAP Server on port 389:</source>
+</trans-unit>
+<trans-unit id="sa00cf67b54c44c71">
+  <source>Check the IP of the Kubernetes service, or</source>
+</trans-unit>
+<trans-unit id="s28f270859c5f4d51">
+  <source>The Host IP of the docker host</source>
+</trans-unit>
+<trans-unit id="sb7794c2910b1a9ec">
+  <source>Bind DN</source>
+</trans-unit>
+<trans-unit id="s5694f9421c428227">
+  <source>Bind Password</source>
+</trans-unit>
+<trans-unit id="s086e1bbe7c97ea16">
+  <source>Search base</source>
+</trans-unit>
+<trans-unit id="s417b90913e05bc17">
+  <source>Preview</source>
+</trans-unit>
+<trans-unit id="s17f3eaf3b07ece26">
+  <source>Warning: Provider is not used by an Application.</source>
+</trans-unit>
+<trans-unit id="s56806e9f63efa298">
+  <source>Redirect URIs</source>
+</trans-unit>
+<trans-unit id="sdbc08adee233f180">
+  <source>Update OAuth2 Provider</source>
+</trans-unit>
+<trans-unit id="s9d96eb5ca93e6473">
+  <source>OpenID Configuration URL</source>
+</trans-unit>
+<trans-unit id="s74f809a69e030351">
+  <source>OpenID Configuration Issuer</source>
+</trans-unit>
+<trans-unit id="s028be8989873f001">
+  <source>Authorize URL</source>
+</trans-unit>
+<trans-unit id="sebda1d54a3f9f967">
+  <source>Token URL</source>
+</trans-unit>
+<trans-unit id="s2fc3eb68c7ced3af">
+  <source>Userinfo URL</source>
+</trans-unit>
+<trans-unit id="s145483489b87a622">
+  <source>Logout URL</source>
+</trans-unit>
+<trans-unit id="s59f5eda30a904b75">
+  <source>JWKS URL</source>
+</trans-unit>
+<trans-unit id="s453b0c150a7ca58e">
+  <source>Example JWT payload (for currently authenticated user)</source>
+</trans-unit>
+<trans-unit id="scb489a1a173ac3f0">
+  <source>Yes</source>
+</trans-unit>
+<trans-unit id="s09205907b5b56cda">
+  <source>No</source>
+</trans-unit>
+<trans-unit id="sc6e8a34361c7c272">
+  <source>Forward auth (domain-level)</source>
+</trans-unit>
+<trans-unit id="s6df42b3072a2d7e9">
+  <source>Nginx (Ingress)</source>
+</trans-unit>
+<trans-unit id="s8e01a852c1db8d29">
+  <source>Nginx (Proxy Manager)</source>
+</trans-unit>
+<trans-unit id="sabebdc7fa6a5bddb">
+  <source>Nginx (standalone)</source>
+</trans-unit>
+<trans-unit id="s5d9f93f1fe1c19d3">
+  <source>Traefik (Ingress)</source>
+</trans-unit>
+<trans-unit id="se2b62f7e9017965e">
+  <source>Traefik (Compose)</source>
+</trans-unit>
+<trans-unit id="s4c4c504a48c3b7bd">
+  <source>Traefik (Standalone)</source>
+</trans-unit>
+<trans-unit id="s7ba9677d069e5f02">
+  <source>Caddy (Standalone)</source>
+</trans-unit>
+<trans-unit id="s4a1e774ab25aa232">
+  <source>Internal Host</source>
+</trans-unit>
+<trans-unit id="sc9c3578cce3cf7a8">
+  <source>External Host</source>
+</trans-unit>
+<trans-unit id="s7a141f1b61074fbe">
+  <source>Basic-Auth</source>
+</trans-unit>
+<trans-unit id="s37cbecaec58e2192">
+  <source>Mode</source>
+</trans-unit>
+<trans-unit id="s4e474b9e2e737dd1">
+  <source>Update Proxy Provider</source>
+</trans-unit>
+<trans-unit id="s37eb2f1b6e3c19c2">
+  <source>Protocol Settings</source>
+</trans-unit>
+<trans-unit id="s5116b89f7db1fbec">
+  <source>Allowed Redirect URIs</source>
+</trans-unit>
+<trans-unit id="saeff3596e1ac31b6">
+  <source>Setup</source>
+</trans-unit>
+<trans-unit id="s1b783856ab4aaaf3">
+  <source>No additional setup is required.</source>
+</trans-unit>
+<trans-unit id="s2f4ca2148183d692">
+  <source>Successfully updated endpoint.</source>
+</trans-unit>
+<trans-unit id="s5adee855dbe191d9">
+  <source>Successfully created endpoint.</source>
+</trans-unit>
+<trans-unit id="s61e136c0658e27d5">
+  <source>Protocol</source>
+</trans-unit>
+<trans-unit id="sa062b019ff0c8809">
+  <source>RDP</source>
+</trans-unit>
+<trans-unit id="s97f9bf19fa5b57d1">
+  <source>SSH</source>
+</trans-unit>
+<trans-unit id="s7c100119e9ffcc32">
+  <source>VNC</source>
+</trans-unit>
+<trans-unit id="s6b05f9d8801fc14f">
+  <source>Host</source>
+</trans-unit>
+<trans-unit id="sb474f652a2c2fc76">
+  <source>Hostname/IP to connect to.</source>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+</trans-unit>
+<trans-unit id="scb6620fcd5bff04c">
+  <source>Advanced settings</source>
+</trans-unit>
+<trans-unit id="sa45a194b58837e4f">
+  <source>Active</source>
+</trans-unit>
+<trans-unit id="s58c867aac77b9158">
+  <source>Last login</source>
+</trans-unit>
+<trans-unit id="s3e3bb9e7cb1de4fd">
+  <source>Select users to add</source>
+</trans-unit>
+<trans-unit id="s75d5ff5dd8d3c6d2">
+  <source>Successfully updated group.</source>
+</trans-unit>
+<trans-unit id="s3079ca1184e77573">
+  <source>Successfully created group.</source>
+</trans-unit>
+<trans-unit id="s63cb05541b294335">
+  <source>Is superuser</source>
+</trans-unit>
+<trans-unit id="s29315e374008d0c5">
+  <source>Users added to this group will be superusers.</source>
+</trans-unit>
+<trans-unit id="s4eb514ebcb80553d">
+  <source>Parent</source>
+</trans-unit>
+<trans-unit id="s6b2beba7ab637e9e">
+  <source>Roles</source>
+</trans-unit>
+<trans-unit id="s96d2bb4be3f5e8aa">
+  <source>Select roles to grant this groups' users' permissions from the selected roles.</source>
+</trans-unit>
+<trans-unit id="s16b9446e3a70e1f4">
+  <source>Attributes</source>
+</trans-unit>
+<trans-unit id="sec97cdaf7af8648b">
+  <source>Set custom attributes using YAML or JSON.</source>
+</trans-unit>
+<trans-unit id="s1e36813d3504ed48">
+  <source>Successfully updated binding.</source>
+</trans-unit>
+<trans-unit id="s1bf56ee106e9e711">
+  <source>Successfully created binding.</source>
+</trans-unit>
+<trans-unit id="s042baf59902a711f">
+  <source>Policy</source>
+</trans-unit>
+<trans-unit id="s5f5bf4ef2bd93c04">
+  <source>Group mappings can only be checked if a user is already logged in when trying to access this source.</source>
+</trans-unit>
+<trans-unit id="s6c607d74bdfe9f36">
+  <source>User mappings can only be checked if a user is already logged in when trying to access this source.</source>
+</trans-unit>
+<trans-unit id="s965c503c3e42fdfe">
+  <source>Enabled</source>
+</trans-unit>
+<trans-unit id="s6b85380416964890">
+  <source>Negate result</source>
+</trans-unit>
+<trans-unit id="s3bfa0258999fb629">
+  <source>Negates the outcome of the binding. Messages are unaffected.</source>
+</trans-unit>
+<trans-unit id="s2ba5f4d8f3bd7c57">
+  <source>Order</source>
+</trans-unit>
+<trans-unit id="se1e040b55319a0e8">
+  <source>Timeout</source>
+</trans-unit>
+<trans-unit id="s6b1ed7507f26cb4a">
+  <source>Failure result</source>
+</trans-unit>
+<trans-unit id="s2e422519ed38f7d8">
+  <source>Pass</source>
+</trans-unit>
+<trans-unit id="s81a45c4fd11e8e1a">
+  <source>Don't pass</source>
+</trans-unit>
+<trans-unit id="s95b73e0f4e47eb9a">
+  <source>Result used when policy execution fails.</source>
+</trans-unit>
+<trans-unit id="s29ec5e7889f4787f">
+  <source>Successfully updated policy.</source>
+</trans-unit>
+<trans-unit id="sfc400b2d71e49d28">
+  <source>Successfully created policy.</source>
+</trans-unit>
+<trans-unit id="safc0e0656d572f4e">
+  <source>A policy used for testing. Always returns the same result as specified below after waiting a random duration.</source>
+</trans-unit>
+<trans-unit id="s9ffa1ac03ce6fd20">
+  <source>Execution logging</source>
+</trans-unit>
+<trans-unit id="saf31b3c610036ed6">
+  <source>When this option is enabled, all executions of this policy will be logged. By default, only execution errors are logged.</source>
+</trans-unit>
+<trans-unit id="sa879d5ce584875cf">
+  <source>Policy-specific settings</source>
+</trans-unit>
+<trans-unit id="s838418d1a0815157">
+  <source>Pass policy?</source>
+</trans-unit>
+<trans-unit id="sd8c5339b82b71507">
+  <source>Wait (min)</source>
+</trans-unit>
+<trans-unit id="sda4e78c19f5b6f35">
+  <source>The policy takes a random time to execute. This controls the minimum time it will take.</source>
+</trans-unit>
+<trans-unit id="s1d30ff9ba938e68d">
+  <source>Wait (max)</source>
+</trans-unit>
+<trans-unit id="s303b5e552246e613">
+  <source>Matches an event against a set of criteria. If any of the configured values match, the policy passes.</source>
+</trans-unit>
+<trans-unit id="s890810efbe103cbc">
+  <source>Match created events with this action type. When left empty, all action types will be matched.</source>
+</trans-unit>
+<trans-unit id="sfab527528ea64618">
+  <source>Matches Event's Client IP (strict matching, for network matching use an Expression Policy.</source>
+</trans-unit>
+<trans-unit id="s5a15a8f39c699273">
+  <source>Match events created by selected application. When left empty, all applications are matched.</source>
+</trans-unit>
+<trans-unit id="s5da52af9b083c29a">
+  <source>Model</source>
+</trans-unit>
+<trans-unit id="s3ba9b8aeb686d9f7">
+  <source>Match events created by selected model. When left empty, all models are matched.</source>
+</trans-unit>
+<trans-unit id="s5a13f4bbe004503f">
+  <source>Checks if the request's user's password has been changed in the last x days, and denys based on settings.</source>
+</trans-unit>
+<trans-unit id="sfad8af8ce38104a3">
+  <source>Maximum age (in days)</source>
+</trans-unit>
+<trans-unit id="s9307f3dbb07a73b5">
+  <source>Only fail the policy, don't invalidate user's password</source>
+</trans-unit>
+<trans-unit id="scea1f16238093e35">
+  <source>Executes the python snippet to determine whether to allow or deny a request.</source>
+</trans-unit>
+<trans-unit id="sabd1bc9fb7da71e7">
+  <source>Expression using Python.</source>
+</trans-unit>
+<trans-unit id="s8d08843f397d9e81">
+  <source>See documentation for a list of all variables.</source>
+</trans-unit>
+<trans-unit id="se2cc93bd2647baec">
+  <source>Static rules</source>
+</trans-unit>
+<trans-unit id="sc96dd9d2e7b05fc5">
+  <source>Minimum length</source>
+</trans-unit>
+<trans-unit id="s33d48fb745f4d4ae">
+  <source>Minimum amount of Uppercase Characters</source>
+</trans-unit>
+<trans-unit id="s883b544e2b4aa3b5">
+  <source>Minimum amount of Lowercase Characters</source>
+</trans-unit>
+<trans-unit id="s43be3ce2439ffe9c">
+  <source>Minimum amount of Digits</source>
+</trans-unit>
+<trans-unit id="sb3651834cca86735">
+  <source>Minimum amount of Symbols Characters</source>
+</trans-unit>
+<trans-unit id="sc2f116c0ea77d58a">
+  <source>Error message</source>
+</trans-unit>
+<trans-unit id="s21d0e290c51a8ef9">
+  <source>Symbol charset</source>
+</trans-unit>
+<trans-unit id="s545d99afa61e4095">
+  <source>Characters which are considered as symbols.</source>
+</trans-unit>
+<trans-unit id="s1293ad87acc7a609">
+  <source>HaveIBeenPwned settings</source>
+</trans-unit>
+<trans-unit id="sdf4e1c6a2f072600">
+  <source>Allowed count</source>
+</trans-unit>
+<trans-unit id="scd8062ff5e1326d8">
+  <source>Allow up to N occurrences in the HIBP database.</source>
+</trans-unit>
+<trans-unit id="s3fd219b045193507">
+  <source>zxcvbn settings</source>
+</trans-unit>
+<trans-unit id="s28d84abfbaf555ea">
+  <source>Score threshold</source>
+</trans-unit>
+<trans-unit id="s7b3148ffba9f4527">
+  <source>If the password's score is less than or equal this value, the policy will fail.</source>
+</trans-unit>
+<trans-unit id="sd94e99af8b41ff54">
+  <source>0: Too guessable: risky password. (guesses &amp;lt; 10^3)</source>
+</trans-unit>
+<trans-unit id="sc926385d1a624c3a">
+  <source>1: Very guessable: protection from throttled online attacks. (guesses &amp;lt; 10^6)</source>
+</trans-unit>
+<trans-unit id="s8aae61c41319602c">
+  <source>2: Somewhat guessable: protection from unthrottled online attacks. (guesses &amp;lt; 10^8)</source>
+</trans-unit>
+<trans-unit id="sc1f4b57e722a89d6">
+  <source>3: Safely unguessable: moderate protection from offline slow-hash scenario. (guesses &amp;lt; 10^10)</source>
+</trans-unit>
+<trans-unit id="sd47f3d3c9741343d">
+  <source>4: Very unguessable: strong protection from offline slow-hash scenario. (guesses &amp;gt;= 10^10)</source>
+</trans-unit>
+<trans-unit id="sd6cd7ce2310a73a4">
+  <source>Checks the value from the policy request against several rules, mostly used to ensure password strength.</source>
+</trans-unit>
+<trans-unit id="s2a957e843960b604">
+  <source>Password field</source>
+</trans-unit>
+<trans-unit id="se8a81c75b6e30a33">
+  <source>Field key to check, field keys defined in Prompt stages are available.</source>
+</trans-unit>
+<trans-unit id="s2f8c4cf12350a36c">
+  <source>Check static rules</source>
+</trans-unit>
+<trans-unit id="sd75a9a71309fb387">
+  <source>Check haveibeenpwned.com</source>
+</trans-unit>
+<trans-unit id="se5cb18408df3284e">
+  <source>For more info see:</source>
+</trans-unit>
+<trans-unit id="scef7abb8456b06d6">
+  <source>Check zxcvbn</source>
+</trans-unit>
+<trans-unit id="sdfdb58cd232b363d">
+  <source>Password strength estimator created by Dropbox, see:</source>
+</trans-unit>
+<trans-unit id="s40b034801fcb843b">
+  <source>Allows/denys requests based on the users and/or the IPs reputation.</source>
+</trans-unit>
+<trans-unit id="scf4afecb0f1e69b2">
+  <source>Invalid login attempts will decrease the score for the client's IP, and the
+username they are attempting to login as, by one.</source>
+</trans-unit>
+<trans-unit id="s8323a9af28e10502">
+  <source>The policy passes when the reputation score is below the threshold, and
+doesn't pass when either or both of the selected options are equal or above the threshold.</source>
+</trans-unit>
+<trans-unit id="s1828fbfc2c56379c">
+  <source>Check IP</source>
+</trans-unit>
+<trans-unit id="s4751df77cfd8a5f9">
+  <source>Check Username</source>
+</trans-unit>
+<trans-unit id="se19cc57dd8675498">
+  <source>Threshold</source>
+</trans-unit>
+<trans-unit id="sdbccb39a658f0e45">
+  <source>New policy</source>
+</trans-unit>
+<trans-unit id="sf693300708a40d2c">
+  <source>Create a new policy.</source>
+</trans-unit>
+<trans-unit id="s5b1fb0d4c0daeba8">
+  <source>Create Binding</source>
+</trans-unit>
+<trans-unit id="s9f5a5f23312798f0">
+  <source>Members</source>
+</trans-unit>
+<trans-unit id="s7eb3d239e0b491ab">
+  <source>Select groups to add user to</source>
+</trans-unit>
+<trans-unit id="sec5cdfa358f9dbf7">
+  <source>Warning: Adding the user to the selected group(s) will give them superuser permissions.</source>
+</trans-unit>
+<trans-unit id="scab2900019953050">
+  <source>Successfully updated user.</source>
+</trans-unit>
+<trans-unit id="s3d2a8b86a4f5a810">
+  <source>Successfully created user and added to group <x id="0" equiv-text="${this.group.name}"/></source>
+</trans-unit>
+<trans-unit id="s9c3c272944dcfca3">
+  <source>Successfully created user.</source>
+</trans-unit>
+<trans-unit id="s03f42eea72154959">
+  <source>Username</source>
+</trans-unit>
+<trans-unit id="s5a802e46a033c8af">
+  <source>User's primary identifier. 150 characters or fewer.</source>
+</trans-unit>
+<trans-unit id="sd34be0d0fcb39971">
+  <source>User's display name.</source>
+</trans-unit>
+<trans-unit id="s9f9492d30a96b9c6">
+  <source>User type</source>
+</trans-unit>
+<trans-unit id="scef2eb6a2bfe3110">
+  <source>Internal users might be users such as company employees, which will get access to the full Enterprise feature set.</source>
+</trans-unit>
+<trans-unit id="sf66389b04fcc219c">
+  <source>External users might be external consultants or B2C customers. These users don't get access to enterprise features.</source>
+</trans-unit>
+<trans-unit id="s77e8668a27dbc402">
+  <source>Service accounts should be used for machine-to-machine authentication or other automations.</source>
+</trans-unit>
+<trans-unit id="sd1f44f1a8bc20e67">
+  <source>Email</source>
+</trans-unit>
+<trans-unit id="sbe3b416a356f1c91">
+  <source>Is active</source>
+</trans-unit>
+<trans-unit id="s35fac2e5677d55cd">
+  <source>Designates whether this user should be treated as active. Unselect this instead of deleting accounts.</source>
+</trans-unit>
+<trans-unit id="s2e532e19ed477a56">
+  <source>Path</source>
+</trans-unit>
+<trans-unit id="s67560d7e37d984c3">
+  <source>Policy / User / Group</source>
+</trans-unit>
+<trans-unit id="s030ac0829bb50a49">
+  <source>Policy <x id="0" equiv-text="${item.policyObj?.name}"/></source>
+</trans-unit>
+<trans-unit id="s2a64d2dca3da9b0e">
+  <source>Group <x id="0" equiv-text="${item.groupObj?.name}"/></source>
+</trans-unit>
+<trans-unit id="se5dc026819a32ff8">
+  <source>User <x id="0" equiv-text="${item.userObj?.name}"/></source>
+</trans-unit>
+<trans-unit id="s50c312bea93b6925">
+  <source>Edit Policy</source>
+</trans-unit>
+<trans-unit id="s0b55a57f473ab8af">
+  <source>Update Group</source>
+</trans-unit>
+<trans-unit id="s494e1ed913d9351a">
+  <source>Edit Group</source>
+</trans-unit>
+<trans-unit id="sad130c2d925fb7bf">
+  <source>Update User</source>
+</trans-unit>
+<trans-unit id="s5cd31f4a88adf180">
+  <source>Edit User</source>
+</trans-unit>
+<trans-unit id="se291dfd2a59d7842">
+  <source>Policy binding(s)</source>
+</trans-unit>
+<trans-unit id="s7e87ab366c199345">
+  <source>Update Binding</source>
+</trans-unit>
+<trans-unit id="s40b80eb4cc1f0e0c">
+  <source>Edit Binding</source>
+</trans-unit>
+<trans-unit id="sbad5b96fb855ef36">
+  <source>No Policies bound.</source>
+</trans-unit>
+<trans-unit id="sc15d60377cc8aaac">
+  <source>No policies are currently bound to this object.</source>
+</trans-unit>
+<trans-unit id="s911a27022aba349f">
+  <source>Create and bind Policy</source>
+</trans-unit>
+<trans-unit id="sddb040c47daae56b">
+  <source>Bind existing policy</source>
+</trans-unit>
+<trans-unit id="sb37880a2a7288ef0">
+  <source>Update Permissions</source>
+</trans-unit>
+<trans-unit id="s8276649077e8715c">
+  <source>Endpoint(s)</source>
+</trans-unit>
+<trans-unit id="sf1dabfe0fe8a75ad">
+  <source>Update Endpoint</source>
+</trans-unit>
+<trans-unit id="s008496c7716b9812">
+  <source>These bindings control which users will have access to this endpoint. Users must also have access to the application.</source>
+</trans-unit>
+<trans-unit id="s38e7cd1a24e70faa">
+  <source>Create Endpoint</source>
+</trans-unit>
+<trans-unit id="s4770c10e5b1c028c">
+  <source>RAC is in preview.</source>
+</trans-unit>
+<trans-unit id="s168565f5ac74a89f">
+  <source>Update RAC Provider</source>
+</trans-unit>
+<trans-unit id="s8465a2caa2d9ea5d">
+  <source>Endpoints</source>
+</trans-unit>
+<trans-unit id="s09b671b120443043">
+  <source>Update Radius Provider</source>
+</trans-unit>
+<trans-unit id="sd3386a2ef42e80b9">
+  <source>Download</source>
+</trans-unit>
+<trans-unit id="sf417c13d7a0f7995">
+  <source>Copy download URL</source>
+</trans-unit>
+<trans-unit id="sc1cfce89ebcf1bf9">
+  <source>Download signing certificate</source>
+</trans-unit>
+<trans-unit id="s2c0de3d35a7bc784">
+  <source>Related objects</source>
+</trans-unit>
+<trans-unit id="s803b0621006085be">
+  <source>Update SAML Provider</source>
+</trans-unit>
+<trans-unit id="s44b1f042790cd1a2">
+  <source>SAML Configuration</source>
+</trans-unit>
+<trans-unit id="sba999428083abce3">
+  <source>EntityID/Issuer</source>
+</trans-unit>
+<trans-unit id="scd2984ee5552643a">
+  <source>SSO URL (Post)</source>
+</trans-unit>
+<trans-unit id="saa79b47f60c66458">
+  <source>SSO URL (Redirect)</source>
+</trans-unit>
+<trans-unit id="s2da51a6287118ba8">
+  <source>SSO URL (IdP-initiated Login)</source>
+</trans-unit>
+<trans-unit id="s0a57e911e457302b">
+  <source>SLO URL (Post)</source>
+</trans-unit>
+<trans-unit id="s1e7308bb1ca323e1">
+  <source>SLO URL (Redirect)</source>
+</trans-unit>
+<trans-unit id="sd2c58d7c6dddc515">
+  <source>SAML Metadata</source>
+</trans-unit>
+<trans-unit id="s382b702673776873">
+  <source>Example SAML attributes</source>
+</trans-unit>
+<trans-unit id="sea3bfc143ced73db">
+  <source>NameID attribute</source>
+</trans-unit>
+<trans-unit id="sadadfe9dfa06d7dd">
+  <source>No sync status.</source>
+</trans-unit>
+<trans-unit id="s2b1c81130a65a55b">
+  <source>Sync currently running.</source>
+</trans-unit>
+<trans-unit id="s31a2d43bc1cf1790">
+  <source>Not synced yet.</source>
+</trans-unit>
+<trans-unit id="s388ee787bbf2271b">
+  <source>Task finished with warnings</source>
+</trans-unit>
+<trans-unit id="s949826fad0fe0909">
+  <source>Task finished with errors</source>
+</trans-unit>
+<trans-unit id="sbedb77365a066648">
+  <source>Last sync: <x id="0" equiv-text="${task.taskFinishTimestamp.toLocaleString()}"/></source>
+</trans-unit>
+<trans-unit id="s2f0f6691de0b0388">
+  <source>Warning: Provider is not assigned to an application as backchannel provider.</source>
+</trans-unit>
+<trans-unit id="sc6c575c5ff64cdb1">
+  <source>Update SCIM Provider</source>
+</trans-unit>
+<trans-unit id="sbecf8dc03c978d15">
+  <source>Run sync again</source>
+</trans-unit>
+<trans-unit id="sb564f81eb057342e">
+  <source>Application Icon</source>
+</trans-unit>
+<trans-unit id="s6ba50bb0842ba1e2">
+  <source>Applications</source>
+</trans-unit>
+<trans-unit id="s61bd841e66966325">
+  <source>External applications that use authentik as an identity provider via protocols like OAuth2 and SAML. All applications are shown here, even ones you cannot access.</source>
+</trans-unit>
+<trans-unit id="s96b2fefc550e4b1c">
+  <source>Provider Type</source>
+</trans-unit>
+<trans-unit id="sd20f6cd02c90867f">
+  <source>Application(s)</source>
+</trans-unit>
+<trans-unit id="sa347e31efbb60be2">
+  <source>Update Application</source>
+</trans-unit>
+<trans-unit id="s1f7698c061c208c9">
+  <source>Open</source>
+</trans-unit>
+<trans-unit id="sd9b556a84ae25690">
+  <source>Successfully sent test-request.</source>
+</trans-unit>
+<trans-unit id="s5deac600e329de1b">
+  <source>Log messages</source>
+</trans-unit>
+<trans-unit id="s3feea7b49673bef2">
+  <source>No log messages.</source>
+</trans-unit>
+<trans-unit id="saa855c61e0403fe6">
+  <source>Warning: Application is not used by any Outpost.</source>
+</trans-unit>
+<trans-unit id="sb6cbd4f92ebaf5d8">
+  <source>Related</source>
+</trans-unit>
+<trans-unit id="sd71081c23d1cd38b">
+  <source>Check access</source>
+</trans-unit>
+<trans-unit id="s42cbd8dca939a9c7">
+  <source>Check</source>
+</trans-unit>
+<trans-unit id="sf22f7f8a9309b4ed">
+  <source>Check Application access</source>
+</trans-unit>
+<trans-unit id="s2474e7fb1aec9f05">
+  <source>Test</source>
+</trans-unit>
+<trans-unit id="s512957aa09384646">
+  <source>Launch</source>
+</trans-unit>
+<trans-unit id="sed02f831e653deb3">
+  <source>Logins over the last week (per 8 hours)</source>
+</trans-unit>
+<trans-unit id="s2b1bc31276c4c477">
+  <source>Policy / Group / User Bindings</source>
+</trans-unit>
+<trans-unit id="s473f0143efa3f706">
+  <source>These policies control which users can access this application.</source>
+</trans-unit>
+<trans-unit id="s24875d5475e82526">
+  <source>Successfully updated source.</source>
+</trans-unit>
+<trans-unit id="s60d891ed3ee9ebc5">
+  <source>Successfully created source.</source>
+</trans-unit>
+<trans-unit id="s8af7239354f7e7b6">
+  <source>Sync users</source>
+</trans-unit>
+<trans-unit id="sd80b0b8aeae3abe3">
+  <source>User password writeback</source>
+</trans-unit>
+<trans-unit id="s2b952e9dc99cbded">
+  <source>Login password is synced from LDAP into authentik automatically. Enable this option only to write password changes in authentik back to LDAP.</source>
+</trans-unit>
+<trans-unit id="saf7ce4165a1025f6">
+  <source>Sync groups</source>
+</trans-unit>
+<trans-unit id="s2035f889f576bca6">
+  <source>Connection settings</source>
+</trans-unit>
+<trans-unit id="s0a72e65aef45b1e8">
+  <source>Server URI</source>
+</trans-unit>
+<trans-unit id="sa599dbe5776897ad">
+  <source>Specify multiple server URIs by separating them with a comma.</source>
+</trans-unit>
+<trans-unit id="se36b55dfcf5dc80b">
+  <source>Enable StartTLS</source>
+</trans-unit>
+<trans-unit id="s33683c3b1dbaf264">
+  <source>To use SSL instead, use 'ldaps://' and disable this option.</source>
+</trans-unit>
+<trans-unit id="s1024166475850a65">
+  <source>Use Server URI for SNI verification</source>
+</trans-unit>
+<trans-unit id="se65beb94fffc3c4b">
+  <source>Required for servers using TLS 1.3+</source>
+</trans-unit>
+<trans-unit id="s2221fef80f4753a2">
+  <source>TLS Verification Certificate</source>
+</trans-unit>
+<trans-unit id="sb8c13bd58191cea2">
+  <source>When connecting to an LDAP Server with TLS, certificates are not checked by default. Specify a keypair to validate the remote certificate.</source>
+</trans-unit>
+<trans-unit id="s000ee3e634868b3c">
+  <source>TLS Client authentication certificate</source>
+</trans-unit>
+<trans-unit id="s5506b35a1bceb141">
+  <source>Client certificate keypair to authenticate against the LDAP Server's Certificate.</source>
+</trans-unit>
+<trans-unit id="sb7684e2910a33a1f">
+  <source>Bind CN</source>
+</trans-unit>
+<trans-unit id="s3de6db803012016a">
+  <source>LDAP Attribute mapping</source>
+</trans-unit>
+<trans-unit id="s7c05ee41d634aa45">
+  <source>Property mappings used to user creation.</source>
+</trans-unit>
+<trans-unit id="s94333971a07803b9">
+  <source>Additional settings</source>
+</trans-unit>
+<trans-unit id="sd14a19a19d507f9e">
+  <source>Parent group for all the groups imported from LDAP.</source>
+</trans-unit>
+<trans-unit id="sfbc59ff17a73503d">
+  <source>User path</source>
+</trans-unit>
+<trans-unit id="sd18170637295bace">
+  <source>Addition User DN</source>
+</trans-unit>
+<trans-unit id="s9ae089fd248e72db">
+  <source>Additional user DN, prepended to the Base DN.</source>
+</trans-unit>
+<trans-unit id="s5944355d69db1fb8">
+  <source>Addition Group DN</source>
+</trans-unit>
+<trans-unit id="sfae9f4ea5749a36b">
+  <source>Additional group DN, prepended to the Base DN.</source>
+</trans-unit>
+<trans-unit id="s66ffc06300964849">
+  <source>User object filter</source>
+</trans-unit>
+<trans-unit id="s1c2a173db0e1ec61">
+  <source>Consider Objects matching this filter to be Users.</source>
+</trans-unit>
+<trans-unit id="s2ec94a7c7f5bcd1b">
+  <source>Group object filter</source>
+</trans-unit>
+<trans-unit id="saf5eb7596b3a355b">
+  <source>Consider Objects matching this filter to be Groups.</source>
+</trans-unit>
+<trans-unit id="sf325a4adba4d6278">
+  <source>Group membership field</source>
+</trans-unit>
+<trans-unit id="s76768bebabb7d543">
+  <source>Field which contains members of a group. Note that if using the "memberUid" field, the value is assumed to contain a relative distinguished name. e.g. 'memberUid=some-user' instead of 'memberUid=cn=some-user,ou=groups,...'</source>
+</trans-unit>
+<trans-unit id="s026555347e589f0e">
+  <source>Object uniqueness field</source>
+</trans-unit>
+<trans-unit id="s24211f319e5b7e98">
+  <source>Field which contains a unique Identifier.</source>
+</trans-unit>
+<trans-unit id="s900b0d85b872d134">
+  <source>Link users on unique identifier</source>
+</trans-unit>
+<trans-unit id="s6c70a73265e14521">
+  <source>Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses</source>
+</trans-unit>
+<trans-unit id="s995535e7af30d754">
+  <source>Use the user's email address, but deny enrollment when the email address already exists</source>
+</trans-unit>
+<trans-unit id="s542ecb4130f6cea5">
+  <source>Link to a user with identical username. Can have security implications when a username is used with another source</source>
+</trans-unit>
+<trans-unit id="s2a1debf34e5aeba4">
+  <source>Use the user's username, but deny enrollment when the username already exists</source>
+</trans-unit>
+<trans-unit id="s81ce0d54727f42d2">
+  <source>Unknown user matching mode</source>
+</trans-unit>
+<trans-unit id="sd04376c4216c921f">
+  <source>URL settings</source>
+</trans-unit>
+<trans-unit id="s872d0e88ab34ed83">
+  <source>Authorization URL</source>
+</trans-unit>
+<trans-unit id="see3ff55262fd6500">
+  <source>URL the user is redirect to to consent the authorization.</source>
+</trans-unit>
+<trans-unit id="sb932dead79567c7b">
+  <source>Access token URL</source>
+</trans-unit>
+<trans-unit id="s88b8a2892635a2fc">
+  <source>URL used by authentik to retrieve tokens.</source>
+</trans-unit>
+<trans-unit id="s69bd313dd12fc2f3">
+  <source>Profile URL</source>
+</trans-unit>
+<trans-unit id="sa8d83cd8023e8e4d">
+  <source>URL used by authentik to get user information.</source>
+</trans-unit>
+<trans-unit id="sc7707b3ba3a2a7ca">
+  <source>Request token URL</source>
+</trans-unit>
+<trans-unit id="s3926da5b20cdf3b6">
+  <source>URL used to request the initial token. This URL is only required for OAuth 1.</source>
+</trans-unit>
+<trans-unit id="s199b55513a739f43">
+  <source>OIDC Well-known URL</source>
+</trans-unit>
+<trans-unit id="s8b149b30b5b523ef">
+  <source>OIDC well-known configuration URL. Can be used to automatically configure the URLs above.</source>
+</trans-unit>
+<trans-unit id="s9db2c836ade1339c">
+  <source>OIDC JWKS URL</source>
+</trans-unit>
+<trans-unit id="s4b2a1b657c160f5b">
+  <source>JSON Web Key URL. Keys from the URL will be used to validate JWTs from this source.</source>
+</trans-unit>
+<trans-unit id="s2df0b65125600de9">
+  <source>OIDC JWKS</source>
+</trans-unit>
+<trans-unit id="s02de8d9e8583b480">
+  <source>Raw JWKS data.</source>
+</trans-unit>
+<trans-unit id="s81a87652ade099e4">
+  <source>User matching mode</source>
+</trans-unit>
+<trans-unit id="se8987bdfb35e46b2">
+  <source>Consumer key</source>
+</trans-unit>
+<trans-unit id="sb35c08e3a541188f">
+  <source>Also known as Client ID.</source>
+</trans-unit>
+<trans-unit id="sabaf0061f7e41b0b">
+  <source>Consumer secret</source>
+</trans-unit>
+<trans-unit id="sd46fd9b647cfea10">
+  <source>Also known as Client Secret.</source>
+</trans-unit>
+<trans-unit id="sa61966cd83b4924c">
+  <source>Additional scopes to be passed to the OAuth Provider, separated by space. To replace existing scopes, prefix with *.</source>
+</trans-unit>
+<trans-unit id="s1cc0e66dbd2b5502">
+  <source>Flow settings</source>
+</trans-unit>
+<trans-unit id="sfe6977a3aea3ee6e">
+  <source>Flow to use when authenticating existing users.</source>
+</trans-unit>
+<trans-unit id="s2801a48ceac691b3">
+  <source>Enrollment flow</source>
+</trans-unit>
+<trans-unit id="s5d0a14d29ebad561">
+  <source>Flow to use when enrolling new users.</source>
+</trans-unit>
+<trans-unit id="s91f389c796720a81">
+  <source>Load servers</source>
+</trans-unit>
+<trans-unit id="s24f405197ede5ebb">
+  <source>Re-authenticate with plex</source>
+</trans-unit>
+<trans-unit id="sc297b2e13c28ecf9">
+  <source>Allow friends to authenticate via Plex, even if you don't share any servers</source>
+</trans-unit>
+<trans-unit id="sfee91e08b8b47477">
+  <source>Allowed servers</source>
+</trans-unit>
+<trans-unit id="s216eb300543edd91">
+  <source>Select which server a user has to be a member of to be allowed to authenticate.</source>
+</trans-unit>
+<trans-unit id="s31d7f3ba04d306a5">
+  <source>SSO URL</source>
+</trans-unit>
+<trans-unit id="s1d9d6c5b424fdc1f">
+  <source>URL that the initial Login request is sent to.</source>
+</trans-unit>
+<trans-unit id="sd94db2b8c85d10a6">
+  <source>SLO URL</source>
+</trans-unit>
+<trans-unit id="sc764ddf60b5149de">
+  <source>Optional URL if the IDP supports Single-Logout.</source>
+</trans-unit>
+<trans-unit id="se7430794fa89005a">
+  <source>Also known as Entity ID. Defaults the Metadata URL.</source>
+</trans-unit>
+<trans-unit id="s5615bb595ad6ded6">
+  <source>Binding Type</source>
+</trans-unit>
+<trans-unit id="sa2e4d6830226d3ec">
+  <source>Redirect binding</source>
+</trans-unit>
+<trans-unit id="s6f96a78d81ef277c">
+  <source>Post-auto binding</source>
+</trans-unit>
+<trans-unit id="sc2c70fd56f5d0b48">
+  <source>Post binding but the request is automatically sent and the user doesn't have to confirm.</source>
+</trans-unit>
+<trans-unit id="s968c90258dcf7562">
+  <source>Post binding</source>
+</trans-unit>
+<trans-unit id="se10bbf4cf861c81b">
+  <source>Signing keypair</source>
+</trans-unit>
+<trans-unit id="s838ed611b533b19e">
+  <source>Keypair which is used to sign outgoing requests. Leave empty to disable signing.</source>
+</trans-unit>
+<trans-unit id="s39c8c0bf4d927c9f">
+  <source> Allow IDP-initiated logins</source>
+</trans-unit>
+<trans-unit id="s65d507f1513c2f03">
+  <source>Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done.</source>
+</trans-unit>
+<trans-unit id="s297a2075bd7e40db">
+  <source>NameID Policy</source>
+</trans-unit>
+<trans-unit id="s004e9a2c90f23900">
+  <source>Persistent</source>
+</trans-unit>
+<trans-unit id="s38887b94b3320533">
+  <source>Email address</source>
+</trans-unit>
+<trans-unit id="s2d34c87f67f66c6a">
+  <source>Windows</source>
+</trans-unit>
+<trans-unit id="s1665454e31e14941">
+  <source>X509 Subject</source>
+</trans-unit>
+<trans-unit id="s0c3ac7f9383a8cfd">
+  <source>Transient</source>
+</trans-unit>
+<trans-unit id="s20a0ce62823bfa97">
+  <source>Delete temporary users after</source>
+</trans-unit>
+<trans-unit id="s3198c384c2f68b08">
+  <source>Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually.</source>
+</trans-unit>
+<trans-unit id="sb32e9c1faa0b8673">
+  <source>Pre-authentication flow</source>
+</trans-unit>
+<trans-unit id="sa3c1f6ac5e63a70f">
+  <source>Flow used before authentication.</source>
+</trans-unit>
+<trans-unit id="se12969ade44cd2b6">
+  <source>New source</source>
+</trans-unit>
+<trans-unit id="s19b09f4fc72175d1">
+  <source>Create a new source.</source>
+</trans-unit>
+<trans-unit id="sb1a4e9b288e2f005">
+  <source>Federation and Social login</source>
+</trans-unit>
+<trans-unit id="s6152026c364ad974">
+  <source>Sources of identities, which can either be synced into authentik's database, or can be used by users to authenticate and enroll themselves.</source>
+</trans-unit>
+<trans-unit id="s0a0ca63b967f1630">
+  <source>Source(s)</source>
+</trans-unit>
+<trans-unit id="s66722bc2ea775e05">
+  <source>Disabled</source>
+</trans-unit>
+<trans-unit id="s4ff2c202b4e5bdc5">
+  <source>Built-in</source>
+</trans-unit>
+<trans-unit id="s4476e9c50cfd13f4">
+  <source>Global status</source>
+</trans-unit>
+<trans-unit id="sd21a971eea208533">
+  <source>Vendor</source>
+</trans-unit>
+<trans-unit id="s52b500138a2d2b8a">
+  <source>Update LDAP Source</source>
+</trans-unit>
+<trans-unit id="sf36170f71cea38c2">
+  <source>Connectivity</source>
+</trans-unit>
+<trans-unit id="sf3fec8353106ac2f">
+  <source>OAuth Source <x id="0" equiv-text="${this.source.name}"/></source>
+</trans-unit>
+<trans-unit id="se09d055771f3a11d">
+  <source>Generic OpenID Connect</source>
+</trans-unit>
+<trans-unit id="s5c1dc164c89ac13e">
+  <source>Unknown provider type</source>
+</trans-unit>
+<trans-unit id="s355b21b89ce5d9c5">
+  <source>Details</source>
+</trans-unit>
+<trans-unit id="s01088b6625d2443b">
+  <source>Callback URL</source>
+</trans-unit>
+<trans-unit id="sb6d5146d5efb3058">
+  <source>Access Key</source>
+</trans-unit>
+<trans-unit id="s065604a41e9d1584">
+  <source>Update OAuth Source</source>
+</trans-unit>
+<trans-unit id="s7b576aa71acb36a6">
+  <source>Diagram</source>
+</trans-unit>
+<trans-unit id="s587ba266269297ab">
+  <source>Policy Bindings</source>
+</trans-unit>
+<trans-unit id="s2feae323f46479f8">
+  <source>These bindings control which users can access this source.
+            You can only use policies here as access is checked before the user is authenticated.</source>
+</trans-unit>
+<trans-unit id="se17fcb1f159ee382">
+  <source>Update Plex Source</source>
+</trans-unit>
+<trans-unit id="saa10777250a6deca">
+  <source>Update SAML Source</source>
+</trans-unit>
+<trans-unit id="s643d8f2e5e5e930d">
+  <source>Successfully updated mapping.</source>
+</trans-unit>
+<trans-unit id="sffeef5b119d8625c">
+  <source>Successfully created mapping.</source>
+</trans-unit>
+<trans-unit id="s1c33d22492029aba">
+  <source>Object field</source>
+</trans-unit>
+<trans-unit id="s06df3c3b6a503da8">
+  <source>Field of the user object this value is written to.</source>
+</trans-unit>
+<trans-unit id="s9857d883d8eb98fc">
+  <source>General settings</source>
+</trans-unit>
+<trans-unit id="sf6e1665c7022a1f8">
+  <source>Password</source>
+</trans-unit>
+<trans-unit id="sd2066881798a1b96">
+  <source>RDP settings</source>
+</trans-unit>
+<trans-unit id="sb864dc36a463a155">
+  <source>Ignore server certificate</source>
+</trans-unit>
+<trans-unit id="s20366a8d1eaaca54">
+  <source>Enable wallpaper</source>
+</trans-unit>
+<trans-unit id="s1e44c5350ef7598c">
+  <source>Enable font-smoothing</source>
+</trans-unit>
+<trans-unit id="s04ff5d6ae711e6d6">
+  <source>Enable full window dragging</source>
+</trans-unit>
+<trans-unit id="sd39c5e998efecf93">
+  <source>SAML Attribute Name</source>
+</trans-unit>
+<trans-unit id="scf2790cf3ad89283">
+  <source>Attribute name used for SAML Assertions. Can be a URN OID, a schema reference, or a any other string. If this property mapping is used for NameID Property, this field is discarded.</source>
+</trans-unit>
+<trans-unit id="sab6d24c5ec8dc361">
+  <source>Friendly Name</source>
+</trans-unit>
+<trans-unit id="s9f8aac89fe318acc">
+  <source>Optionally set the 'FriendlyName' value of the Assertion attribute.</source>
+</trans-unit>
+<trans-unit id="s851c108679653d2a">
+  <source>Scope name</source>
+</trans-unit>
+<trans-unit id="s23fd4411419fca06">
+  <source>Scope which the client can specify to access these properties.</source>
+</trans-unit>
+<trans-unit id="s7754f0e34f27fb6e">
+  <source>Description shown to the user when consenting. If left empty, the user won't be informed.</source>
+</trans-unit>
+<trans-unit id="sb6c3bf5489d7556e">
+  <source>Example context data</source>
+</trans-unit>
+<trans-unit id="s4a697f0b36c4fe83">
+  <source>Active Directory User</source>
+</trans-unit>
+<trans-unit id="s9277b90db38e1983">
+  <source>Active Directory Group</source>
+</trans-unit>
+<trans-unit id="sc2e03590269d5a10">
+  <source>New property mapping</source>
+</trans-unit>
+<trans-unit id="s713e8666ed70f8b3">
+  <source>Create a new property mapping.</source>
+</trans-unit>
+<trans-unit id="s271a7e04ff9865b1">
+  <source>Control how authentik exposes and interprets information.</source>
+</trans-unit>
+<trans-unit id="s59dc0eda07f9e2b6">
+  <source>Property Mapping(s)</source>
+</trans-unit>
+<trans-unit id="sa57c393736e2732c">
+  <source>Test Property Mapping</source>
+</trans-unit>
+<trans-unit id="sc39fb3ff3753d5ab">
+  <source>Hide managed mappings</source>
+</trans-unit>
+<trans-unit id="s476ffc07e6d66f18">
+  <source>Successfully updated token.</source>
+</trans-unit>
+<trans-unit id="s93c1e5fbe8184895">
+  <source>Successfully created token.</source>
+</trans-unit>
+<trans-unit id="s4165cd175bc4c0c4">
+  <source>Expires on</source>
+</trans-unit>
+<trans-unit id="s5fc4269c2addee61">
+  <source>Unique identifier the token is referenced by.</source>
+</trans-unit>
+<trans-unit id="sb8bc2b8376c96a6b">
+  <source>Intent</source>
+</trans-unit>
+<trans-unit id="sbd34d118bcb1aaf2">
+  <source>API Token</source>
+</trans-unit>
+<trans-unit id="se31d92bea7f3a186">
+  <source>Used to access the API programmatically</source>
+</trans-unit>
+<trans-unit id="sfd586951c75eb291">
+  <source>App password.</source>
+</trans-unit>
+<trans-unit id="s59bf194136d0d13a">
+  <source>Used to login using a flow executor</source>
+</trans-unit>
+<trans-unit id="s1b14062c44e5ef45">
+  <source>Expiring</source>
+</trans-unit>
+<trans-unit id="safcc54b2aedb1a17">
+  <source>If this is selected, the token will expire. Upon expiration, the token will be rotated.</source>
+</trans-unit>
+<trans-unit id="sdc5690be4a342985">
+  <source>The token has been copied to your clipboard</source>
+</trans-unit>
+<trans-unit id="s7f3edfee24690c9f">
+  <source>The token was displayed because authentik does not have permission to write to the clipboard</source>
+</trans-unit>
+<trans-unit id="s78fd8c03f8c967f3">
+  <source>Tokens</source>
+</trans-unit>
+<trans-unit id="sdcc7b2c109ce9775">
+  <source>Tokens are used throughout authentik for Email validation stages, Recovery keys and API access.</source>
+</trans-unit>
+<trans-unit id="sf71dba2c30283a54">
+  <source>Expires?</source>
+</trans-unit>
+<trans-unit id="sc7be80a7f8ec597e">
+  <source>Expiry date</source>
+</trans-unit>
+<trans-unit id="s71dcd9cf808449aa">
+  <source>Token(s)</source>
+</trans-unit>
+<trans-unit id="sb15e8daacf26bdfc">
+  <source>Create Token</source>
+</trans-unit>
+<trans-unit id="s8d7ecd944ebe834b">
+  <source>Token is managed by authentik.</source>
+</trans-unit>
+<trans-unit id="sd1288ca57e221cf9">
+  <source>Update Token</source>
+</trans-unit>
+<trans-unit id="se9c07cf256774d81">
+  <source>Editing is disabled for managed tokens</source>
+</trans-unit>
+<trans-unit id="scc3487e74c5a3e89">
+  <source>Copy token</source>
+</trans-unit>
+<trans-unit id="sab21e1f62676b56c">
+  <source>Successfully updated brand.</source>
+</trans-unit>
+<trans-unit id="sa43e43fd3a23e22d">
+  <source>Successfully created brand.</source>
+</trans-unit>
+<trans-unit id="s41706a202b6c40f1">
+  <source>Domain</source>
+</trans-unit>
+<trans-unit id="se74ce42d41e392ba">
+  <source>Matching is done based on domain suffix, so if you enter domain.tld, foo.domain.tld will still match.</source>
+</trans-unit>
+<trans-unit id="s11326fd2590f4e5e">
+  <source>Default</source>
+</trans-unit>
+<trans-unit id="s41b3f9b4c98aabd9">
+  <source>Use this brand for each domain that doesn't have a dedicated brand.</source>
+</trans-unit>
+<trans-unit id="sc19838ca8c135c1b">
+  <source>Branding settings</source>
+</trans-unit>
+<trans-unit id="s99f110d27e30b289">
+  <source>Title</source>
+</trans-unit>
+<trans-unit id="sab6bad52985c6676">
+  <source>Branding shown in page title and several other places.</source>
+</trans-unit>
+<trans-unit id="s4f1af2b48a5e249a">
+  <source>Logo</source>
+</trans-unit>
+<trans-unit id="sd6b8b4156f7df696">
+  <source>Icon shown in sidebar/header and flow executor.</source>
+</trans-unit>
+<trans-unit id="s3626433940124897">
+  <source>Favicon</source>
+</trans-unit>
+<trans-unit id="se99efc0873031976">
+  <source>Icon shown in the browser tab.</source>
+</trans-unit>
+<trans-unit id="s10356fd921037fbf">
+  <source>Default flows</source>
+</trans-unit>
+<trans-unit id="sd216b08bafb297ee">
+  <source>Flow used to authenticate users. If left empty, the first applicable flow sorted by the slug is used.</source>
+</trans-unit>
+<trans-unit id="s35e6e60e83a8c003">
+  <source>Invalidation flow</source>
+</trans-unit>
+<trans-unit id="s7989db5f4819af89">
+  <source>Flow used to logout. If left empty, the first applicable flow sorted by the slug is used.</source>
+</trans-unit>
+<trans-unit id="sfeb779d4ccbc5a0e">
+  <source>Recovery flow</source>
+</trans-unit>
+<trans-unit id="s1c2fd8097e14a608">
+  <source>Recovery flow. If left empty, the first applicable flow sorted by the slug is used.</source>
+</trans-unit>
+<trans-unit id="s836aa192b30c21da">
+  <source>Unenrollment flow</source>
+</trans-unit>
+<trans-unit id="s081d3c4b47a6ff83">
+  <source>If set, users are able to unenroll themselves using this flow. If no flow is set, option is not shown.</source>
+</trans-unit>
+<trans-unit id="secbfd13bdae95a59">
+  <source>User settings flow</source>
+</trans-unit>
+<trans-unit id="s523160b433311521">
+  <source>If set, users are able to configure details of their profile.</source>
+</trans-unit>
+<trans-unit id="s134177568525dbc8">
+  <source>Device code flow</source>
+</trans-unit>
+<trans-unit id="s7b298427bdea81ae">
+  <source>If set, the OAuth Device Code profile can be used, and the selected flow will be used to enter the code.</source>
+</trans-unit>
+<trans-unit id="s7f4e4054fbe132e1">
+  <source>Other global settings</source>
+</trans-unit>
+<trans-unit id="sbadde673052efc02">
+  <source>Web Certificate</source>
+</trans-unit>
+<trans-unit id="s17260b71484b307f">
+  <source>Set custom attributes using YAML or JSON. Any attributes set here will be inherited by users, if the request is handled by this brand.</source>
+</trans-unit>
+<trans-unit id="s79fc990a2b58f27f">
+  <source>Brands</source>
+</trans-unit>
+<trans-unit id="s164be9a7537b99f6">
+  <source>Configure visual settings and defaults for different domains.</source>
+</trans-unit>
+<trans-unit id="s4802636d55022ed3">
+  <source>Default?</source>
+</trans-unit>
+<trans-unit id="s02774bc46a167346">
+  <source>Brand(s)</source>
+</trans-unit>
+<trans-unit id="s801bf3d03f4a3ff1">
+  <source>Update Brand</source>
+</trans-unit>
+<trans-unit id="s5c3efec5330e0000">
+  <source>Create Brand</source>
+</trans-unit>
+<trans-unit id="s8cb7bb82e96d5d77">
+  <source>Policies</source>
+</trans-unit>
+<trans-unit id="sec1808532fe107b9">
+  <source>Allow users to use Applications based on properties, enforce Password Criteria and selectively apply Stages.</source>
+</trans-unit>
+<trans-unit id="se16ac750b81fa93d">
+  <source>Assigned to <x id="0" equiv-text="${item.boundTo}"/> object(s).</source>
+</trans-unit>
+<trans-unit id="s5a48d5171e1a1522">
+  <source>Warning: Policy is not assigned.</source>
+</trans-unit>
+<trans-unit id="s544142ce35050751">
+  <source>Test Policy</source>
+</trans-unit>
+<trans-unit id="s00c8354318addfa0">
+  <source>Policy / Policies</source>
+</trans-unit>
+<trans-unit id="s76da2c978dcc5ef4">
+  <source>Successfully cleared policy cache</source>
+</trans-unit>
+<trans-unit id="sa717841a602fe7d8">
+  <source>Failed to delete policy cache</source>
+</trans-unit>
+<trans-unit id="s3ed5607ad78d4224">
+  <source>Clear cache</source>
+</trans-unit>
+<trans-unit id="s1b07757762cda372">
+  <source>Clear Policy cache</source>
+</trans-unit>
+<trans-unit id="s15b46b78edebb20a">
+  <source>Are you sure you want to clear the policy cache? This will cause all policies to be re-evaluated on their next usage.</source>
+</trans-unit>
+<trans-unit id="s62ddcbaaa91d120d">
+  <source>Reputation scores</source>
+</trans-unit>
+<trans-unit id="sd080b2370aa82967">
+  <source>Reputation for IP and user identifiers. Scores are decreased for each failed login and increased for each successful login.</source>
+</trans-unit>
+<trans-unit id="s09242207b5b8f83c">
+  <source>IP</source>
+</trans-unit>
+<trans-unit id="s7d684b6257284e55">
+  <source>Score</source>
+</trans-unit>
+<trans-unit id="s10d2dbc4613397f0">
+  <source>Updated</source>
+</trans-unit>
+<trans-unit id="sa33d061d2ade20aa">
+  <source>Reputation</source>
+</trans-unit>
+<trans-unit id="s9f26843287bb592d">
+  <source>Groups</source>
+</trans-unit>
+<trans-unit id="s4dcb9288f7e9e4d7">
+  <source>Group users together and give them permissions based on the membership.</source>
+</trans-unit>
+<trans-unit id="s62f93cfcb45d5a06">
+  <source>Superuser privileges?</source>
+</trans-unit>
+<trans-unit id="s9fdda7ea4642306c">
+  <source>Group(s)</source>
+</trans-unit>
+<trans-unit id="s416a540b16275f2e">
+  <source>Create Group</source>
+</trans-unit>
+<trans-unit id="s7c5774fad9d050ce">
+  <source>Create group</source>
+</trans-unit>
+<trans-unit id="s2a12e0b5527ff99a">
+  <source>Enabling this toggle will create a group named after the user, with the user as member.</source>
+</trans-unit>
+<trans-unit id="s6b6e6eb037aef7da">
+  <source>Use the username and password below to authenticate. The password can be retrieved later on the Tokens page.</source>
+</trans-unit>
+<trans-unit id="sbb57cd8a3ed12915">
+  <source>Valid for 360 days, after which the password will automatically rotate. You can copy the password from the Token List.</source>
+</trans-unit>
+<trans-unit id="s4414164d120de61a">
+  <source>The following objects use <x id="0" equiv-text="${objName}"/></source>
+</trans-unit>
+<trans-unit id="s92e241c9f3c101a2">
+  <source>connecting object will be deleted</source>
+</trans-unit>
+<trans-unit id="se6a13beff646557b">
+  <source>Successfully updated <x id="0" equiv-text="${this.objectLabel} ${this.obj?.name}"/></source>
+</trans-unit>
+<trans-unit id="s14401ff4a0cba208">
+  <source>Failed to update <x id="0" equiv-text="${this.objectLabel}"/>: <x id="1" equiv-text="${e.toString()}"/></source>
+</trans-unit>
+<trans-unit id="sa95a538bfbb86111">
+  <source>Are you sure you want to update <x id="0" equiv-text="${this.objectLabel}"/> "<x id="1" equiv-text="${this.obj?.name}"/>"?</source>
+</trans-unit>
+<trans-unit id="sc92d7cfb6ee1fec6">
+  <source>Successfully updated password.</source>
+</trans-unit>
+<trans-unit id="se5498954255620b4">
+  <source>Successfully sent email.</source>
+</trans-unit>
+<trans-unit id="s44ea4e9a81ce730d">
+  <source>Email stage</source>
+</trans-unit>
+<trans-unit id="sdb53ccdd6174e6e3">
+  <source>Successfully added user(s).</source>
+</trans-unit>
+<trans-unit id="s306a35df5d0d38bb">
+  <source>Users to add</source>
+</trans-unit>
+<trans-unit id="s424f57afae0caac4">
+  <source>Add users</source>
+</trans-unit>
+<trans-unit id="s7d499be3b781a3ca">
+  <source>User(s)</source>
+</trans-unit>
+<trans-unit id="s7220fcf4fec4e0df">
+  <source>Remove Users(s)</source>
+</trans-unit>
+<trans-unit id="s5d7748b1d2363478">
+  <source>Are you sure you want to remove the selected users from the group <x id="0" equiv-text="${this.targetGroup?.name}"/>?</source>
+</trans-unit>
+<trans-unit id="sea4f08110bb8f15d">
+  <source>Remove</source>
+</trans-unit>
+<trans-unit id="sf466142da6a65052">
+  <source>Impersonate</source>
+</trans-unit>
+<trans-unit id="s58888ef1ee9b5bb8">
+  <source>User status</source>
+</trans-unit>
+<trans-unit id="s4409ada9c5c2a7f8">
+  <source>Inactive</source>
+</trans-unit>
+<trans-unit id="s7ec7036b249f4f22">
+  <source>Regular user</source>
+</trans-unit>
+<trans-unit id="sf9e61f4f8e90f0f1">
+  <source>Change status</source>
+</trans-unit>
+<trans-unit id="sf56998949bdf6b33">
+  <source>Deactivate</source>
+</trans-unit>
+<trans-unit id="s27976e94b05c6970">
+  <source>Activate</source>
+</trans-unit>
+<trans-unit id="s3794c596ee7964ad">
+  <source>Update password</source>
+</trans-unit>
+<trans-unit id="sce8d867ca5f35304">
+  <source>Set password</source>
+</trans-unit>
+<trans-unit id="s0ae3395d8f48e624">
+  <source>Successfully generated recovery link</source>
+</trans-unit>
+<trans-unit id="s8ca0dbaec5d48563">
+  <source>No recovery flow is configured.</source>
+</trans-unit>
+<trans-unit id="sb69119c9f0547bed">
+  <source>Copy recovery link</source>
+</trans-unit>
+<trans-unit id="s7fa236d26b798301">
+  <source>Send link</source>
+</trans-unit>
+<trans-unit id="sa9dbe2fb284e26fe">
+  <source>Send recovery link to user</source>
+</trans-unit>
+<trans-unit id="s03fd2c252ad7972a">
+  <source>Email recovery link</source>
+</trans-unit>
+<trans-unit id="sd7fa99e4d82b374a">
+  <source>Recovery link cannot be emailed, user has no email address saved.</source>
+</trans-unit>
+<trans-unit id="sa9d13ce9e83aac17">
+  <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
+</trans-unit>
+<trans-unit id="s720594461542943f">
+  <source>Add User</source>
+</trans-unit>
+<trans-unit id="s4c41f3f4c23e8eaa">
+  <source>Warning: This group is configured with superuser access. Added users will have superuser access.</source>
+</trans-unit>
+<trans-unit id="scee721983b1c28d0">
+  <source>Add existing user</source>
+</trans-unit>
+<trans-unit id="sd600334ec2c39b74">
+  <source>Create user</source>
+</trans-unit>
+<trans-unit id="s53ad3455d9523b54">
+  <source>Create User</source>
+</trans-unit>
+<trans-unit id="s824e0943a7104668">
+  <source>This user will be added to the group "<x id="0" equiv-text="${this.targetGroup.name}"/>".</source>
+</trans-unit>
+<trans-unit id="s06c163334767a381">
+  <source>Create Service account</source>
+</trans-unit>
+<trans-unit id="sc744f3691efe310d">
+  <source>Hide service-accounts</source>
+</trans-unit>
+<trans-unit id="secdb4b4c4e66aa38">
+  <source>Group Info</source>
+</trans-unit>
+<trans-unit id="s005053d82b712e0a">
+  <source>Notes</source>
+</trans-unit>
+<trans-unit id="s634448e4942cf452">
+  <source>Edit the notes attribute of this group to add notes here.</source>
+</trans-unit>
+<trans-unit id="s586d6bd2eca2da93">
+  <source>Users</source>
+</trans-unit>
+<trans-unit id="s2da4aa7a9abeb653">
+  <source>Pseudolocale (for testing)</source>
+</trans-unit>
+<trans-unit id="s4caed5b7a7e5d89b">
+  <source>English</source>
+</trans-unit>
+<trans-unit id="sf1868dc19e3917bb">
+  <source>Spanish</source>
+</trans-unit>
+<trans-unit id="s63e71d20d1eaca93">
+  <source>German</source>
+</trans-unit>
+<trans-unit id="s75a27f43413e02c5">
+  <source>French</source>
+</trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
+<trans-unit id="s03f49e598ffb11cc">
+  <source>Polish</source>
+</trans-unit>
+<trans-unit id="s9d2d00982edafabb">
+  <source>Turkish</source>
+</trans-unit>
+<trans-unit id="se3e6af2ce24d80e8">
+  <source>Chinese (traditional)</source>
+</trans-unit>
+<trans-unit id="s4660da32fb311ac0">
+  <source>Taiwanese Mandarin</source>
+</trans-unit>
+<trans-unit id="s354e0a9f146d2869">
+  <source>Chinese (simplified)</source>
+</trans-unit>
+<trans-unit id="s7df5b92a3f93544f">
+  <source>Warning: The current user count has exceeded the configured licenses.</source>
+</trans-unit>
+<trans-unit id="s0141f42936495787">
+  <source>Click here for more info.</source>
+</trans-unit>
+<trans-unit id="s32a3efa23718e713">
+  <source>API Requests</source>
+</trans-unit>
+<trans-unit id="sddb3b0176f437721">
+  <source>Open API Browser</source>
+</trans-unit>
+<trans-unit id="s3b3c333481944862">
+  <source>Show details</source>
+</trans-unit>
+<trans-unit id="s5be3c6d61cd9182f">
+  <source>Notifications</source>
+</trans-unit>
+<trans-unit id="sa3438c7bb4e9cce8">
+  <source><x id="0" equiv-text="${this.unread}"/> unread</source>
+</trans-unit>
+<trans-unit id="s6e6e737601f44b2c">
+  <source>Successfully cleared notifications</source>
+</trans-unit>
+<trans-unit id="s8cda828dac449ea5">
+  <source>Clear all</source>
+</trans-unit>
+<trans-unit id="s7031e6928c44cedd">
+  <source>User interface</source>
+</trans-unit>
+<trans-unit id="s8849ece8c65e3a18">
+  <source>Dashboards</source>
+</trans-unit>
+<trans-unit id="s5e169e1bac20b4a6">
+  <source>Outposts</source>
+</trans-unit>
+<trans-unit id="sc265a3e29e1206e4">
+  <source>Events</source>
+</trans-unit>
+<trans-unit id="s4f1ad6b48a5df506">
+  <source>Logs</source>
+</trans-unit>
+<trans-unit id="s98c3bdf4fd5cdf65">
+  <source>Notification Rules</source>
+</trans-unit>
+<trans-unit id="s819509c33a7534ac">
+  <source>Notification Transports</source>
+</trans-unit>
+<trans-unit id="s1823625e6f831d73">
+  <source>Customisation</source>
+</trans-unit>
+<trans-unit id="saab79cd956ee56a9">
+  <source>Blueprints</source>
+</trans-unit>
+<trans-unit id="s1a65ee08832fbfe2">
+  <source>Flows and Stages</source>
+</trans-unit>
+<trans-unit id="sb69a4b0acd0895f2">
+  <source>Flows</source>
+</trans-unit>
+<trans-unit id="s41b105819b67ee7a">
+  <source>Stages</source>
+</trans-unit>
+<trans-unit id="s2be6121210e2a2f8">
+  <source>Prompts</source>
+</trans-unit>
+<trans-unit id="sc0829ee663ced008">
+  <source>Directory</source>
+</trans-unit>
+<trans-unit id="sc6b4ebd37b7a91c7">
+  <source>Tokens and App passwords</source>
+</trans-unit>
+<trans-unit id="s8226f48cb1a80997">
+  <source>Invitations</source>
+</trans-unit>
+<trans-unit id="sa81e2cdaf6921adc">
+  <source>System</source>
+</trans-unit>
+<trans-unit id="s5515a897ae98bed9">
+  <source>Certificates</source>
+</trans-unit>
+<trans-unit id="s6b79e73ca77148a0">
+  <source>Outpost Integrations</source>
+</trans-unit>
+<trans-unit id="s4207178ba0b99418">
+  <source>A newer version of the frontend is available.</source>
+</trans-unit>
+<trans-unit id="s96b3cddf33e1c853">
+  <source>You're currently impersonating <x id="0" equiv-text="${this.impersonation}"/>. Click to stop.</source>
+</trans-unit>
+<trans-unit id="s7be2df39f727faa2">
+  <source>Enterprise</source>
+</trans-unit>
+<trans-unit id="s2e109263b73c12d5">
+  <source>Licenses</source>
+</trans-unit>
+<trans-unit id="sca7cfe2bef51b2a5">
+  <source>Root</source>
+</trans-unit>
+<trans-unit id="saf6097bfa25205b8">
+  <source>A copy of this recovery link has been placed in your clipboard</source>
+</trans-unit>
+<trans-unit id="s6709b81e1ed4e39f">
+  <source>The current brand must have a recovery flow configured to use a recovery link</source>
+</trans-unit>
+<trans-unit id="s3616cc78631f5893">
+  <source>Warning: You're about to delete the user you're logged in as (<x id="0" equiv-text="${shouldShowWarning.username}"/>). Proceed at your own risk.</source>
+</trans-unit>
+<trans-unit id="s510c7add9e24c306">
+  <source>Hide deactivated user</source>
+</trans-unit>
+<trans-unit id="s0924f51b028233a3">
+  <source>&lt;No name set&gt;</source>
+</trans-unit>
+<trans-unit id="s895514dda9cb9c94">
+  <source>Create recovery link</source>
+</trans-unit>
+<trans-unit id="s94055b4eb957dc8f">
+  <source>User folders</source>
+</trans-unit>
+<trans-unit id="sa982875b258fea07">
+  <source>Successfully added user to group(s).</source>
+</trans-unit>
+<trans-unit id="s1bd5920d8adf2bd5">
+  <source>Groups to add</source>
+</trans-unit>
+<trans-unit id="sd9f67fbf3f86efcf">
+  <source>Add group</source>
+</trans-unit>
+<trans-unit id="s5f71fa3c53828e30">
+  <source>Remove from Group(s)</source>
+</trans-unit>
+<trans-unit id="sb4c9ed2a487b238f">
+  <source>Are you sure you want to remove user <x id="0" equiv-text="${this.targetUser?.username}"/> from the following groups?</source>
+</trans-unit>
+<trans-unit id="s964f6725aeb7662f">
+  <source>Add Group</source>
+</trans-unit>
+<trans-unit id="s65ca2f256ea09c11">
+  <source>Add to existing group</source>
+</trans-unit>
+<trans-unit id="s505fbbdcbc6aa921">
+  <source>Add new group</source>
+</trans-unit>
+<trans-unit id="s506beb486fa41241">
+  <source>Application authorizations</source>
+</trans-unit>
+<trans-unit id="s78ab26da7f067de8">
+  <source>Select permissions to grant</source>
+</trans-unit>
+<trans-unit id="sdeb90bfd8a80b86b">
+  <source>Permissions to add</source>
+</trans-unit>
+<trans-unit id="s36247910d67421e1">
+  <source>Select permissions</source>
+</trans-unit>
+<trans-unit id="s67e136af8fc1107b">
+  <source>Assign permission</source>
+</trans-unit>
+<trans-unit id="s1455753daa00f1bc">
+  <source>User doesn't have view permission so description cannot be retrieved.</source>
+</trans-unit>
+<trans-unit id="s7301a7069b7bc83e">
+  <source>Revoked?</source>
+</trans-unit>
+<trans-unit id="sd924045605feea63">
+  <source>Expires</source>
+</trans-unit>
+<trans-unit id="s1c8916418c334935">
+  <source>ID Token</source>
+</trans-unit>
+<trans-unit id="s90760e5e02e95dfe">
+  <source>Refresh Tokens(s)</source>
+</trans-unit>
+<trans-unit id="s1b88fa3df4423292">
+  <source>Last IP</source>
+</trans-unit>
+<trans-unit id="se63f9d833700af49">
+  <source>Session(s)</source>
+</trans-unit>
+<trans-unit id="sf679b7a62808287e">
+  <source>Expiry</source>
+</trans-unit>
+<trans-unit id="sde1907073fd96017">
+  <source>(Current session)</source>
+</trans-unit>
+<trans-unit id="s76881c01b6a3a8c7">
+  <source>Consent(s)</source>
+</trans-unit>
+<trans-unit id="sf05c700a1250824e">
+  <source>Confirmed</source>
+</trans-unit>
+<trans-unit id="sa0b01f479f40c52d">
+  <source>Device(s)</source>
+</trans-unit>
+<trans-unit id="s64a33dcdaf90af26">
+  <source>User Info</source>
+</trans-unit>
+<trans-unit id="s028d385389b5aac0">
+  <source>Lock the user out of this system</source>
+</trans-unit>
+<trans-unit id="sd2122c514f0778b5">
+  <source>Allow the user to log in and use this system</source>
+</trans-unit>
+<trans-unit id="s43fe853bf219a9b8">
+  <source>Temporarily assume the identity of this user</source>
+</trans-unit>
+<trans-unit id="se28b5f3fcadaeeb1">
+  <source>Enter a new password for this user</source>
+</trans-unit>
+<trans-unit id="s6f5bb31e2733ecd5">
+  <source>Create a link for this user to reset their password</source>
+</trans-unit>
+<trans-unit id="se5c795faf2c07514">
+  <source>Create Recovery Link</source>
+</trans-unit>
+<trans-unit id="sc44bae5cde0083fa">
+  <source>Actions over the last week (per 8 hours)</source>
+</trans-unit>
+<trans-unit id="sb57dbcda1929c642">
+  <source>Edit the notes attribute of this user to add notes here.</source>
+</trans-unit>
+<trans-unit id="s5c18cae48b93138c">
+  <source>Sessions</source>
+</trans-unit>
+<trans-unit id="s27586544c447d9e3">
+  <source>User events</source>
+</trans-unit>
+<trans-unit id="s4d31797d81e9cea3">
+  <source>Explicit Consent</source>
+</trans-unit>
+<trans-unit id="sb6770fa90be6d8b3">
+  <source>OAuth Refresh Tokens</source>
+</trans-unit>
+<trans-unit id="s28b3de1561da72b3">
+  <source>MFA Authenticators</source>
+</trans-unit>
+<trans-unit id="sa3a3e09b88ed9791">
+  <source>Assigned permissions</source>
+</trans-unit>
+<trans-unit id="s9cc631505c17b028">
+  <source>Assigned global permissions</source>
+</trans-unit>
+<trans-unit id="s8f85a0e678846080">
+  <source>Assigned object permissions</source>
+</trans-unit>
+<trans-unit id="s9103a949a3963aa9">
+  <source>Successfully updated role.</source>
+</trans-unit>
+<trans-unit id="sdf87c5661b31359e">
+  <source>Successfully created role.</source>
+</trans-unit>
+<trans-unit id="s3484b1e6d0b5335f">
+  <source>Manage roles which grant permissions to objects within authentik.</source>
+</trans-unit>
+<trans-unit id="s259de999919316db">
+  <source>Role(s)</source>
+</trans-unit>
+<trans-unit id="s2ffad156e8332f04">
+  <source>Update Role</source>
+</trans-unit>
+<trans-unit id="sc5f923729564fbf3">
+  <source>Create Role</source>
+</trans-unit>
+<trans-unit id="s14bfa8fd1bec8889">
+  <source>Role doesn't have view permission so description cannot be retrieved.</source>
+</trans-unit>
+<trans-unit id="s7e796fe83982863f">
+  <source>Role <x id="0" equiv-text="${this._role?.name || &quot;&quot;}"/></source>
+</trans-unit>
+<trans-unit id="s526e2c66bd51ff5f">
+  <source>Role Info</source>
+</trans-unit>
+<trans-unit id="s7a322c89298dd27c">
+  <source>Successfully updated invitation.</source>
+</trans-unit>
+<trans-unit id="sc554339ffc7b04e7">
+  <source>Successfully created invitation.</source>
+</trans-unit>
+<trans-unit id="sfcebd18506f1e535">
+  <source>Flow</source>
+</trans-unit>
+<trans-unit id="sa84a7fd11ba85e88">
+  <source>When selected, the invite will only be usable with the flow. By default the invite is accepted on all flows with invitation stages.</source>
+</trans-unit>
+<trans-unit id="sd18b18f91b804c3f">
+  <source>Custom attributes</source>
+</trans-unit>
+<trans-unit id="s7520286c8419a266">
+  <source>Optional data which is loaded into the flow's 'prompt_data' context variable. YAML or JSON.</source>
+</trans-unit>
+<trans-unit id="sb8795b799c70776a">
+  <source>Single use</source>
+</trans-unit>
+<trans-unit id="sf232d42142eacc23">
+  <source>When enabled, the invitation will be deleted after usage.</source>
+</trans-unit>
+<trans-unit id="sa4a8086275475714">
+  <source>Select an enrollment flow</source>
+</trans-unit>
+<trans-unit id="s839cb09cb2193da9">
+  <source>Link to use the invitation.</source>
+</trans-unit>
+<trans-unit id="s57448f10eb973100">
+  <source>Create Invitation Links to enroll Users, and optionally force specific attributes of their account.</source>
+</trans-unit>
+<trans-unit id="s4aee34a672e5cfc0">
+  <source>Created by</source>
+</trans-unit>
+<trans-unit id="sd5ba2d61ee4796fe">
+  <source>Invitation(s)</source>
+</trans-unit>
+<trans-unit id="s96dcf7ec8342c335">
+  <source>Invitation not limited to any flow, and can be used with any enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s1b42b49e7b392013">
+  <source>Update Invitation</source>
+</trans-unit>
+<trans-unit id="s38c72e1cf120b8d8">
+  <source>Create Invitation</source>
+</trans-unit>
+<trans-unit id="s802826db4e2c852e">
+  <source>Warning: No invitation stage is bound to any flow. Invitations will not work as expected.</source>
+</trans-unit>
+<trans-unit id="s2f995efbb1e46b18">
+  <source>Auto-detect (based on your browser)</source>
+</trans-unit>
+<trans-unit id="s296fbffaaa7c910a">
+  <source>Required.</source>
+</trans-unit>
+<trans-unit id="s81ecf2d4386b8e84">
+  <source>Continue</source>
+</trans-unit>
+<trans-unit id="s8b2b2a43fcf688a3">
+  <source>Successfully updated prompt.</source>
+</trans-unit>
+<trans-unit id="s5572ac4d2208f5ec">
+  <source>Successfully created prompt.</source>
+</trans-unit>
+<trans-unit id="s54e7a23a95d99649">
+  <source>Text: Simple Text input</source>
+</trans-unit>
+<trans-unit id="s63e54b86e2a2cc43">
+  <source>Text Area: Multiline text input</source>
+</trans-unit>
+<trans-unit id="s12de1c06a1e18cc5">
+  <source>Text (read-only): Simple Text input, but cannot be edited.</source>
+</trans-unit>
+<trans-unit id="s4e5646b23e41231f">
+  <source>Text Area (read-only): Multiline text input, but cannot be edited.</source>
+</trans-unit>
+<trans-unit id="s1e4c3de6e12cd87b">
+  <source>Username: Same as Text input, but checks for and prevents duplicate usernames.</source>
+</trans-unit>
+<trans-unit id="s5462c7f56ed65e6c">
+  <source>Email: Text field with Email type.</source>
+</trans-unit>
+<trans-unit id="s1c5574968b29ab1c">
+  <source>Password: Masked input, multiple inputs of this type on the same prompt need to be identical.</source>
+</trans-unit>
+<trans-unit id="sbbb97b1c63507dc0">
+  <source>Number</source>
+</trans-unit>
+<trans-unit id="sdae649fae731e838">
+  <source>Checkbox</source>
+</trans-unit>
+<trans-unit id="s34edeb18f887161d">
+  <source>Radio Button Group (fixed choice)</source>
+</trans-unit>
+<trans-unit id="s57730b6870e8916c">
+  <source>Dropdown (fixed choice)</source>
+</trans-unit>
+<trans-unit id="sac8252732f2edb19">
+  <source>Date</source>
+</trans-unit>
+<trans-unit id="s45960273852a61b2">
+  <source>Date Time</source>
+</trans-unit>
+<trans-unit id="sd1f81284eeb7b503">
+  <source>File</source>
+</trans-unit>
+<trans-unit id="s21e3c227cc2c5873">
+  <source>Separator: Static Separator Line</source>
+</trans-unit>
+<trans-unit id="s706af57c1af42c6d">
+  <source>Hidden: Hidden field, can be used to insert data into form.</source>
+</trans-unit>
+<trans-unit id="s40e2c72dae905a50">
+  <source>Static: Static value, displayed as-is.</source>
+</trans-unit>
+<trans-unit id="sdd4bd4224c4e943d">
+  <source>authentik: Locale: Displays a list of locales authentik supports.</source>
+</trans-unit>
+<trans-unit id="saf84e7732a9e1336">
+  <source>Preview errors</source>
+</trans-unit>
+<trans-unit id="sb71ace8e9b35c749">
+  <source>Data preview</source>
+</trans-unit>
+<trans-unit id="s4d53f4b7ff33bedd">
+  <source>Unique name of this field, used for selecting fields in prompt stages.</source>
+</trans-unit>
+<trans-unit id="s3b58f8d2155ae90c">
+  <source>Field Key</source>
+</trans-unit>
+<trans-unit id="s2b088ba65eb69b7e">
+  <source>Name of the form field, also used to store the value.</source>
+</trans-unit>
+<trans-unit id="s662fcb3761ad9df7">
+  <source>When used in conjunction with a User Write stage, use attributes.foo to write attributes.</source>
+</trans-unit>
+<trans-unit id="s5590dbf7e425789d">
+  <source>Label</source>
+</trans-unit>
+<trans-unit id="s0c135eba6017d94f">
+  <source>Label shown next to/above the prompt.</source>
+</trans-unit>
+<trans-unit id="sae5d87e99fe081e0">
+  <source>Required</source>
+</trans-unit>
+<trans-unit id="s37dbfe2133b74d2d">
+  <source>Interpret placeholder as expression</source>
+</trans-unit>
+<trans-unit id="s4a953e6234cb4808">
+  <source>When checked, the placeholder will be evaluated in the same way a property mapping is.
+            If the evaluation fails, the placeholder itself is returned.</source>
+</trans-unit>
+<trans-unit id="sf90be97cb08f3d5a">
+  <source>Placeholder</source>
+</trans-unit>
+<trans-unit id="sf76ead4c4708dd06">
+  <source>Optionally provide a short hint that describes the expected input value.
+            When creating a fixed choice field, enable interpreting as expression and return a
+        list to return multiple choices.</source>
+</trans-unit>
+<trans-unit id="saa7ba2057bd524a1">
+  <source>Interpret initial value as expression</source>
+</trans-unit>
+<trans-unit id="sd60415c7666859f0">
+  <source>When checked, the initial value will be evaluated in the same way a property mapping is.
+            If the evaluation fails, the initial value itself is returned.</source>
+</trans-unit>
+<trans-unit id="sa9c7044d9fd1f3e6">
+  <source>Initial value</source>
+</trans-unit>
+<trans-unit id="seab35681cbf36755">
+  <source>Optionally pre-fill the input with an initial value.
+            When creating a fixed choice field, enable interpreting as expression and
+        return a list to return multiple default choices.</source>
+</trans-unit>
+<trans-unit id="s72c1c17a9bdc76ad">
+  <source>Help text</source>
+</trans-unit>
+<trans-unit id="s584d1c38ad20d560">
+  <source>Any HTML can be used.</source>
+</trans-unit>
+<trans-unit id="s42fc6f4b64eff5d9">
+  <source>Single Prompts that can be used for Prompt Stages.</source>
+</trans-unit>
+<trans-unit id="s42a1ebe17efda727">
+  <source>Field</source>
+</trans-unit>
+<trans-unit id="sec7443a45fd141e5">
+  <source>Prompt(s)</source>
+</trans-unit>
+<trans-unit id="scc733ba98740038a">
+  <source>Update Prompt</source>
+</trans-unit>
+<trans-unit id="s61b6f3e6bc59c6dd">
+  <source>Create Prompt</source>
+</trans-unit>
+<trans-unit id="sff5bb7742c2896c8">
+  <source>Target</source>
+</trans-unit>
+<trans-unit id="sae5da213b7f896ed">
+  <source>Stage</source>
+</trans-unit>
+<trans-unit id="s0a61796c1956d32c">
+  <source>Evaluate when flow is planned</source>
+</trans-unit>
+<trans-unit id="sf533f13321fee530">
+  <source>Evaluate policies during the Flow planning process.</source>
+</trans-unit>
+<trans-unit id="s6336fa345e96dde9">
+  <source>Evaluate when stage is run</source>
+</trans-unit>
+<trans-unit id="sff3b708e23bb96b2">
+  <source>Evaluate policies before the Stage is present to the user.</source>
+</trans-unit>
+<trans-unit id="s0dc46deb8f181baf">
+  <source>Invalid response behavior</source>
+</trans-unit>
+<trans-unit id="seb0805249661d15b">
+  <source>Returns the error message and a similar challenge to the executor</source>
+</trans-unit>
+<trans-unit id="sd891d8463d0ebace">
+  <source>Restarts the flow from the beginning</source>
+</trans-unit>
+<trans-unit id="s6b9a1dd402750a8a">
+  <source>Restarts the flow from the beginning, while keeping the flow context</source>
+</trans-unit>
+<trans-unit id="sbc88fb27a4c3b894">
+  <source>Configure how the flow executor should handle an invalid response to a challenge given by this bound stage.</source>
+</trans-unit>
+<trans-unit id="s916b32ac64ea2b05">
+  <source>Successfully updated stage.</source>
+</trans-unit>
+<trans-unit id="s14c8f36e180d6bbc">
+  <source>Successfully created stage.</source>
+</trans-unit>
+<trans-unit id="sf22a28f83cc45fcc">
+  <source>Stage used to configure a duo-based authenticator. This stage should be used for configuration flows.</source>
+</trans-unit>
+<trans-unit id="s5adafce329aaa853">
+  <source>Authenticator type name</source>
+</trans-unit>
+<trans-unit id="s23e6a57201fba25e">
+  <source>Display name of this authenticator, used by users when they enroll an authenticator.</source>
+</trans-unit>
+<trans-unit id="s276d751eb7a186cc">
+  <source>API Hostname</source>
+</trans-unit>
+<trans-unit id="s5b6b6e2cb884d59f">
+  <source>Duo Auth API</source>
+</trans-unit>
+<trans-unit id="s240ff02ce3a53dee">
+  <source>Integration key</source>
+</trans-unit>
+<trans-unit id="s56fd9ed596c724fa">
+  <source>Secret key</source>
+</trans-unit>
+<trans-unit id="s88870d7e499e848b">
+  <source>Duo Admin API (optional)</source>
+</trans-unit>
+<trans-unit id="s7f13f4a2d0370cf6">
+  <source>When using a Duo MFA, Access or Beyond plan, an Admin API application can be created.
+            This will allow authentik to import devices automatically.</source>
+</trans-unit>
+<trans-unit id="s9a34d1520e320465">
+  <source>Stage-specific settings</source>
+</trans-unit>
+<trans-unit id="s0dfc6838c9d07677">
+  <source>Configuration flow</source>
+</trans-unit>
+<trans-unit id="sebf44d2471b608ad">
+  <source>Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage.</source>
+</trans-unit>
+<trans-unit id="s3baf512851453712">
+  <source>Twilio Account SID</source>
+</trans-unit>
+<trans-unit id="sa738ce390bc24875">
+  <source>Get this value from https://console.twilio.com</source>
+</trans-unit>
+<trans-unit id="sa7b56a80ab1801f0">
+  <source>Twilio Auth Token</source>
+</trans-unit>
+<trans-unit id="sfe99a8caa70232ab">
+  <source>Authentication Type</source>
+</trans-unit>
+<trans-unit id="safd0363143a46a91">
+  <source>Basic Auth</source>
+</trans-unit>
+<trans-unit id="sd06b47084fec0ec5">
+  <source>Bearer Token</source>
+</trans-unit>
+<trans-unit id="sb1751a1411d6874f">
+  <source>External API URL</source>
+</trans-unit>
+<trans-unit id="sbdc1176ff9f93da2">
+  <source>This is the full endpoint to send POST requests to.</source>
+</trans-unit>
+<trans-unit id="s51da4de00984fe51">
+  <source>API Auth Username</source>
+</trans-unit>
+<trans-unit id="s293ab4331c1dd387">
+  <source>This is the username to be used with basic auth or the token when used with bearer token</source>
+</trans-unit>
+<trans-unit id="s634d041fd954ab20">
+  <source>API Auth password</source>
+</trans-unit>
+<trans-unit id="sb635ad3c2e357d3c">
+  <source>This is the password to be used with basic auth</source>
+</trans-unit>
+<trans-unit id="sa92398dba8b12d85">
+  <source>Mapping</source>
+</trans-unit>
+<trans-unit id="s38162f615710c7b4">
+  <source>Modify the payload sent to the custom provider.</source>
+</trans-unit>
+<trans-unit id="s5e830ae7688d1219">
+  <source>Stage used to configure an SMS-based TOTP authenticator.</source>
+</trans-unit>
+<trans-unit id="s0d5d05bf3d122ced">
+  <source>Twilio</source>
+</trans-unit>
+<trans-unit id="sc3c74f5273df459a">
+  <source>Generic</source>
+</trans-unit>
+<trans-unit id="sbbb2180b6aed196e">
+  <source>From number</source>
+</trans-unit>
+<trans-unit id="sc647dcb91f6958dd">
+  <source>Number the SMS will be sent from.</source>
+</trans-unit>
+<trans-unit id="s0ae0072614320ae2">
+  <source>Hash phone number</source>
+</trans-unit>
+<trans-unit id="s9ca3310e1999fd5b">
+  <source>If enabled, only a hash of the phone number will be saved. This can be done for data-protection reasons. Devices created from a stage with this enabled cannot be used with the authenticator validation stage.</source>
+</trans-unit>
+<trans-unit id="s128e7f5f34bfa155">
+  <source>Stage used to configure a static authenticator (i.e. static tokens). This stage should be used for configuration flows.</source>
+</trans-unit>
+<trans-unit id="sabf67834e35dede5">
+  <source>Token count</source>
+</trans-unit>
+<trans-unit id="s7caa8f7edb920909">
+  <source>The number of tokens generated whenever this stage is used. Every token generated per stage execution will be attached to a single static device.</source>
+</trans-unit>
+<trans-unit id="s4aacc4e0277c1042">
+  <source>Token length</source>
+</trans-unit>
+<trans-unit id="s6931695c4f563bc4">
+  <source>The length of the individual generated tokens. Can be increased to improve security.</source>
+</trans-unit>
+<trans-unit id="sc5a4711395ffb043">
+  <source>Stage used to configure a TOTP authenticator (i.e. Authy/Google Authenticator).</source>
+</trans-unit>
+<trans-unit id="s9d8ad4b85287131f">
+  <source>Digits</source>
+</trans-unit>
+<trans-unit id="sc04e92d753742189">
+  <source>6 digits, widely compatible</source>
+</trans-unit>
+<trans-unit id="sdc70195469e83e3f">
+  <source>8 digits, not compatible with apps like Google Authenticator</source>
+</trans-unit>
+<trans-unit id="s0e15f678445dfc45">
+  <source>Stage used to validate any authenticator. This stage should be used during authentication or authorization flows.</source>
+</trans-unit>
+<trans-unit id="s73c13e5a6f5e38a3">
+  <source>Device classes</source>
+</trans-unit>
+<trans-unit id="s97d1b0070f50c07f">
+  <source>Static Tokens</source>
+</trans-unit>
+<trans-unit id="sb8168ae309c66abc">
+  <source>TOTP Authenticators</source>
+</trans-unit>
+<trans-unit id="sde47e4d8b9b21b59">
+  <source>WebAuthn Authenticators</source>
+</trans-unit>
+<trans-unit id="s8da88a8a5750bce1">
+  <source>Duo Authenticators</source>
+</trans-unit>
+<trans-unit id="s4d182bae8a578010">
+  <source>SMS-based Authenticators</source>
+</trans-unit>
+<trans-unit id="sd8d9451f86502d1a">
+  <source>Device classes which can be used to authenticate.</source>
+</trans-unit>
+<trans-unit id="se2e9f5a32c93e5f7">
+  <source>Last validation threshold</source>
+</trans-unit>
+<trans-unit id="s951281efc92b03fc">
+  <source>If any of the devices user of the types selected above have been used within this duration, this stage will be skipped.</source>
+</trans-unit>
+<trans-unit id="s681074b6c1f19c08">
+  <source>Not configured action</source>
+</trans-unit>
+<trans-unit id="sa2c29dc5ed47b26d">
+  <source>Force the user to configure an authenticator</source>
+</trans-unit>
+<trans-unit id="sa30c58514a3dc0fb">
+  <source>Deny the user access</source>
+</trans-unit>
+<trans-unit id="s1e0de9c4f66dc371">
+  <source>WebAuthn User verification</source>
+</trans-unit>
+<trans-unit id="sdb7b2173869822bc">
+  <source>User verification must occur.</source>
+</trans-unit>
+<trans-unit id="s7683363cdf78cf31">
+  <source>User verification is preferred if available, but not required.</source>
+</trans-unit>
+<trans-unit id="scb43f5faeb6a7ca9">
+  <source>User verification should not occur.</source>
+</trans-unit>
+<trans-unit id="scae166352a31032c">
+  <source>Configuration stages</source>
+</trans-unit>
+<trans-unit id="s6941a67f0038ba4c">
+  <source>Stages used to configure Authenticator when user doesn't have any compatible devices. After this configuration Stage passes, the user is not prompted again.</source>
+</trans-unit>
+<trans-unit id="s7e5af9c6ba6f5cc6">
+  <source>When multiple stages are selected, the user can choose which one they want to enroll.</source>
+</trans-unit>
+<trans-unit id="s24bce955914b1f0a">
+  <source>Stage used to configure a WebAuthn authenticator (i.e. Yubikey, FaceID/Windows Hello).</source>
+</trans-unit>
+<trans-unit id="s34b23ebbac9f6ab9">
+  <source>User verification</source>
+</trans-unit>
+<trans-unit id="s6a3cf855140b9511">
+  <source>Required: User verification must occur.</source>
+</trans-unit>
+<trans-unit id="sc498a3b05cfe2b08">
+  <source>Preferred: User verification is preferred if available, but not required.</source>
+</trans-unit>
+<trans-unit id="s9d2239d2b0402795">
+  <source>Discouraged: User verification should not occur.</source>
+</trans-unit>
+<trans-unit id="s9ea472b555374771">
+  <source>Resident key requirement</source>
+</trans-unit>
+<trans-unit id="s428b7859907f6db2">
+  <source>Required: The authenticator MUST create a dedicated credential. If it cannot, the RP is prepared for an error to occur</source>
+</trans-unit>
+<trans-unit id="s33e3766d4a02b042">
+  <source>Preferred: The authenticator can create and store a dedicated credential, but if it doesn't that's alright too</source>
+</trans-unit>
+<trans-unit id="sfb852dd507c25c24">
+  <source>Discouraged: The authenticator should not create a dedicated credential</source>
+</trans-unit>
+<trans-unit id="s5fbaeb14f42815e5">
+  <source>Authenticator Attachment</source>
+</trans-unit>
+<trans-unit id="s502d2473587032e1">
+  <source>No preference is sent</source>
+</trans-unit>
+<trans-unit id="s60cc554fde2676cb">
+  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
+</trans-unit>
+<trans-unit id="sdf1d8edef27236f0">
+  <source>A "roaming" authenticator, like a YubiKey</source>
+</trans-unit>
+<trans-unit id="sfffba7b23d8fb40c">
+  <source>This stage checks the user's current session against the Google reCaptcha (or compatible) service.</source>
+</trans-unit>
+<trans-unit id="sfd1af96798dd8a5f">
+  <source>Public Key</source>
+</trans-unit>
+<trans-unit id="sf339673f0f76a8bd">
+  <source>Public key, acquired from https://www.google.com/recaptcha/intro/v3.html.</source>
+</trans-unit>
+<trans-unit id="s83d0f62ad1731a03">
+  <source>Private Key</source>
+</trans-unit>
+<trans-unit id="s892d2731a6f22e59">
+  <source>Private key, acquired from https://www.google.com/recaptcha/intro/v3.html.</source>
+</trans-unit>
+<trans-unit id="s39e436de1dc4df4f">
+  <source>JS URL</source>
+</trans-unit>
+<trans-unit id="s170b705c55ecb2ae">
+  <source>URL to fetch JavaScript from, defaults to recaptcha. Can be replaced with any compatible alternative.</source>
+</trans-unit>
+<trans-unit id="s275021658614ce9e">
+  <source>API URL</source>
+</trans-unit>
+<trans-unit id="sc8a79fddea3ab4a9">
+  <source>URL used to validate captcha response, defaults to recaptcha. Can be replaced with any compatible alternative.</source>
+</trans-unit>
+<trans-unit id="s1cd617e7bbe278d0">
+  <source>Prompt for the user's consent. The consent can either be permanent or expire in a defined amount of time.</source>
+</trans-unit>
+<trans-unit id="s26513c9dd154f041">
+  <source>Always require consent</source>
+</trans-unit>
+<trans-unit id="s8ce8bdc9cc9c8604">
+  <source>Consent given last indefinitely</source>
+</trans-unit>
+<trans-unit id="sb986f15fa9b17805">
+  <source>Consent expires.</source>
+</trans-unit>
+<trans-unit id="s6f328f2d8382d998">
+  <source>Consent expires in</source>
+</trans-unit>
+<trans-unit id="se0c660020d9cf5b7">
+  <source>Offset after which consent expires.</source>
+</trans-unit>
+<trans-unit id="s7f68101a50f526ee">
+  <source>Statically deny the flow. To use this stage effectively, disable *Evaluate when flow is planned* on the respective binding.</source>
+</trans-unit>
+<trans-unit id="s1cc306d8e28c4464">
+  <source>Deny message</source>
+</trans-unit>
+<trans-unit id="s6985c401e1100122">
+  <source>Message shown when this stage is run.</source>
+</trans-unit>
+<trans-unit id="s22b10ed263b96194">
+  <source>Dummy stage used for testing. Shows a simple continue button and always passes.</source>
+</trans-unit>
+<trans-unit id="sdb861d9906f18ac2">
+  <source>Throw error?</source>
+</trans-unit>
+<trans-unit id="s31ebc5431d677f5d">
+  <source>SMTP Host</source>
+</trans-unit>
+<trans-unit id="s289fce7e694b98ac">
+  <source>SMTP Port</source>
+</trans-unit>
+<trans-unit id="se4a9da0295597e73">
+  <source>SMTP Username</source>
+</trans-unit>
+<trans-unit id="s593db2c00d6516a2">
+  <source>SMTP Password</source>
+</trans-unit>
+<trans-unit id="s0d4268408182491d">
+  <source>Use TLS</source>
+</trans-unit>
+<trans-unit id="s480c6c40a248f7d2">
+  <source>Use SSL</source>
+</trans-unit>
+<trans-unit id="sc1feadd25659c94d">
+  <source>From address</source>
+</trans-unit>
+<trans-unit id="sa248e1021d2c27b5">
+  <source>Verify the user's email address by sending them a one-time-link. Can also be used for recovery to verify the user's authenticity.</source>
+</trans-unit>
+<trans-unit id="s87b7e3bc944c728c">
+  <source>Activate pending user on success</source>
+</trans-unit>
+<trans-unit id="s9e9c8d99f4c26baf">
+  <source>When a user returns from the email successfully, their account will be activated.</source>
+</trans-unit>
+<trans-unit id="s618d4e53f455c834">
+  <source>Use global settings</source>
+</trans-unit>
+<trans-unit id="sae1e1a59d22609c4">
+  <source>When enabled, global Email connection settings will be used and connection settings below will be ignored.</source>
+</trans-unit>
+<trans-unit id="sb1fe947f9ad27b9d">
+  <source>Token expiry</source>
+</trans-unit>
+<trans-unit id="s1c6ba8d100453392">
+  <source>Time in minutes the token sent is valid.</source>
+</trans-unit>
+<trans-unit id="se47baf2fd16b9d2b">
+  <source>Template</source>
+</trans-unit>
+<trans-unit id="s4af8a3ce5a600855">
+  <source>Let the user identify themselves with their username or Email address.</source>
+</trans-unit>
+<trans-unit id="s592ab7d2bc1b8973">
+  <source>User fields</source>
+</trans-unit>
+<trans-unit id="s61e48919db20538a">
+  <source>UPN</source>
+</trans-unit>
+<trans-unit id="s4cdae7635e757555">
+  <source>Fields a user can identify themselves with. If no fields are selected, the user will only be able to use sources.</source>
+</trans-unit>
+<trans-unit id="s3380d7cbcebe50f6">
+  <source>Password stage</source>
+</trans-unit>
+<trans-unit id="s08c91cb1a2cd3d97">
+  <source>When selected, a password field is shown on the same page instead of a separate page. This prevents username enumeration attacks.</source>
+</trans-unit>
+<trans-unit id="sd97d8d0906e6cc47">
+  <source>Case insensitive matching</source>
+</trans-unit>
+<trans-unit id="s8aaad223e954f9ca">
+  <source>When enabled, user fields are matched regardless of their casing.</source>
+</trans-unit>
+<trans-unit id="s62e7f6ed7d9cb3ca">
+  <source>Pretend user exists</source>
+</trans-unit>
+<trans-unit id="s52bdc80690a9a8dc">
+  <source>When enabled, the stage will always accept the given user identifier and continue.</source>
+</trans-unit>
+<trans-unit id="sbab723b98dcfe23f">
+  <source>Show matched user</source>
+</trans-unit>
+<trans-unit id="se50a08ab71bb96ed">
+  <source>When a valid username/email has been entered, and this option is enabled, the user's username and avatar will be shown. Otherwise, the text that the user entered will be shown.</source>
+</trans-unit>
+<trans-unit id="s0295ce5d6f635d75">
+  <source>Source settings</source>
+</trans-unit>
+<trans-unit id="s91e3a47599412f51">
+  <source>Sources</source>
+</trans-unit>
+<trans-unit id="s17a679298216aca9">
+  <source>Select sources should be shown for users to authenticate with. This only affects web-based sources, not LDAP.</source>
+</trans-unit>
+<trans-unit id="sa41aee3ae04c9216">
+  <source>Show sources' labels</source>
+</trans-unit>
+<trans-unit id="s54cd35e6224ba65d">
+  <source>By default, only icons are shown for sources. Enable this to show their full names.</source>
+</trans-unit>
+<trans-unit id="s9ee20003cb116abf">
+  <source>Passwordless flow</source>
+</trans-unit>
+<trans-unit id="s0c8c4d2bb0a9162a">
+  <source>Optional passwordless flow, which is linked at the bottom of the page. When configured, users can use this flow to authenticate with a WebAuthn authenticator, without entering any details.</source>
+</trans-unit>
+<trans-unit id="s01a3a7f48ee4edaf">
+  <source>Optional enrollment flow, which is linked at the bottom of the page.</source>
+</trans-unit>
+<trans-unit id="s82188c9542510212">
+  <source>Optional recovery flow, which is linked at the bottom of the page.</source>
+</trans-unit>
+<trans-unit id="s3e59b8b2debf0209">
+  <source>This stage can be included in enrollment flows to accept invitations.</source>
+</trans-unit>
+<trans-unit id="s79ad406777feab1f">
+  <source>Continue flow without invitation</source>
+</trans-unit>
+<trans-unit id="s61ccefd661ac2296">
+  <source>If this flag is set, this Stage will jump to the next Stage when no Invitation is given. By default this Stage will cancel the Flow when no invitation is given.</source>
+</trans-unit>
+<trans-unit id="sdc30bddeda2f0225">
+  <source>Validate the user's password against the selected backend(s).</source>
+</trans-unit>
+<trans-unit id="sb8d4f44a1d5b9a14">
+  <source>Backends</source>
+</trans-unit>
+<trans-unit id="sba42248f3f27955c">
+  <source>User database + standard password</source>
+</trans-unit>
+<trans-unit id="s3330adb3f0922f7b">
+  <source>User database + app passwords</source>
+</trans-unit>
+<trans-unit id="sc10db51c9bb77d5c">
+  <source>User database + LDAP password</source>
+</trans-unit>
+<trans-unit id="sd35ae4be63df1f9f">
+  <source>Selection of backends to test the password against.</source>
+</trans-unit>
+<trans-unit id="s482ae78809a6822b">
+  <source>Flow used by an authenticated user to configure their password. If empty, user will not be able to configure change their password.</source>
+</trans-unit>
+<trans-unit id="s77994108c886b965">
+  <source>Failed attempts before cancel</source>
+</trans-unit>
+<trans-unit id="sa9020b93c3bd7235">
+  <source>How many attempts a user has before the flow is canceled. To lock the user out, use a reputation policy and a user_write stage.</source>
+</trans-unit>
+<trans-unit id="s5170f9ef331949c0">
+  <source>Show arbitrary input fields to the user, for example during enrollment. Data is saved in the flow context under the 'prompt_data' variable.</source>
+</trans-unit>
+<trans-unit id="s36cb242ac90353bc">
+  <source>Fields</source>
+</trans-unit>
+<trans-unit id="s2d5f69929bb7221d">
+  <source><x id="0" equiv-text="${prompt.name}"/> ("<x id="1" equiv-text="${prompt.fieldKey}"/>", of type <x id="2" equiv-text="${prompt.type}"/>)</source>
+</trans-unit>
+<trans-unit id="s3b7b519444181264">
+  <source>Validation Policies</source>
+</trans-unit>
+<trans-unit id="s59691290a232c687">
+  <source>Selected policies are executed when the stage is submitted to validate the data.</source>
+</trans-unit>
+<trans-unit id="sbf4ef82e04772a4e">
+  <source>Delete the currently pending user. CAUTION, this stage does not ask for confirmation. Use a consent stage to ensure the user is aware of their actions.</source>
+</trans-unit>
+<trans-unit id="s8cc920e6a8430a0d">
+  <source>Log the currently pending user in.</source>
+</trans-unit>
+<trans-unit id="sb85ffe141d7c229d">
+  <source>Session duration</source>
+</trans-unit>
+<trans-unit id="sece294cd51a85745">
+  <source>Determines how long a session lasts. Default of 0 seconds means that the sessions lasts until the browser is closed.</source>
+</trans-unit>
+<trans-unit id="sf7949fbbab2eb566">
+  <source>Different browsers handle session cookies differently, and might not remove them even when the browser is closed.</source>
+</trans-unit>
+<trans-unit id="s53bbc3ae4b5fa1d0">
+  <source>See here.</source>
+</trans-unit>
+<trans-unit id="s2512334108f06a5a">
+  <source>Stay signed in offset</source>
+</trans-unit>
+<trans-unit id="s1608b2f94fa0dbd4">
+  <source>If set to a duration above 0, the user will have the option to choose to "stay signed in", which will extend their session by the time specified here.</source>
+</trans-unit>
+<trans-unit id="s663ccbfdf27e8dd0">
+  <source>Network binding</source>
+</trans-unit>
+<trans-unit id="sb108a06693c67753">
+  <source>No binding</source>
+</trans-unit>
+<trans-unit id="s5aab90c74f1233b8">
+  <source>Bind ASN</source>
+</trans-unit>
+<trans-unit id="s488303b048afe83b">
+  <source>Bind ASN and Network</source>
+</trans-unit>
+<trans-unit id="s3268dcfe0c8234dc">
+  <source>Bind ASN, Network and IP</source>
+</trans-unit>
+<trans-unit id="s226381aca231644f">
+  <source>Configure if sessions created by this stage should be bound to the Networks they were created in.</source>
+</trans-unit>
+<trans-unit id="s2555a1f20f3fd93e">
+  <source>GeoIP binding</source>
+</trans-unit>
+<trans-unit id="s3d63c78f93c9a92e">
+  <source>Bind Continent</source>
+</trans-unit>
+<trans-unit id="s395d5863b3a259b5">
+  <source>Bind Continent and Country</source>
+</trans-unit>
+<trans-unit id="s625ea0c32b4b136c">
+  <source>Bind Continent, Country and City</source>
+</trans-unit>
+<trans-unit id="s4bc7a1a88961be90">
+  <source>Configure if sessions created by this stage should be bound to their GeoIP-based location</source>
+</trans-unit>
+<trans-unit id="s542a71bb8f41e057">
+  <source>Terminate other sessions</source>
+</trans-unit>
+<trans-unit id="sa920231366378c90">
+  <source>When enabled, all previous sessions of the user will be terminated.</source>
+</trans-unit>
+<trans-unit id="sfee06600c15082a9">
+  <source>Remove the user from the current session.</source>
+</trans-unit>
+<trans-unit id="s927398c400970760">
+  <source>Write any data from the flow's context's 'prompt_data' to the currently pending user. If no user
+        is pending, a new user is created, and data is written to them.</source>
+</trans-unit>
+<trans-unit id="sb379d861cbed0b47">
+  <source>Never create users</source>
+</trans-unit>
+<trans-unit id="s81d673755a86a4f0">
+  <source>When no user is present in the flow context, the stage will fail.</source>
+</trans-unit>
+<trans-unit id="s9940e3f073fbdbd4">
+  <source>Create users when required</source>
+</trans-unit>
+<trans-unit id="s5414356cc10e80fe">
+  <source>When no user is present in the the flow context, a new user is created.</source>
+</trans-unit>
+<trans-unit id="s57337099d96ce6d2">
+  <source>Always create new users</source>
+</trans-unit>
+<trans-unit id="se80dd66f23b4fc39">
+  <source>Create a new user even if a user is in the flow context.</source>
+</trans-unit>
+<trans-unit id="sed3512fe4560c7f4">
+  <source>Create users as inactive</source>
+</trans-unit>
+<trans-unit id="s9193ef1a39a6c872">
+  <source>Mark newly created users as inactive.</source>
+</trans-unit>
+<trans-unit id="s89d1847b5e4ad225">
+  <source>User path template</source>
+</trans-unit>
+<trans-unit id="s32babfed740fd3c1">
+  <source>User type used for newly created users.</source>
+</trans-unit>
+<trans-unit id="s18269e3889d6fa54">
+  <source>Path new users will be created under. If left blank, the default path will be used.</source>
+</trans-unit>
+<trans-unit id="sc1cb0eef9ed94e6a">
+  <source>Newly created users are added to this group, if a group is selected.</source>
+</trans-unit>
+<trans-unit id="sd8417b41ca27bc8f">
+  <source>New stage</source>
+</trans-unit>
+<trans-unit id="s293801033f9fc0d0">
+  <source>Create a new stage.</source>
+</trans-unit>
+<trans-unit id="s71633a67e0d7c0e4">
+  <source>Successfully imported device.</source>
+</trans-unit>
+<trans-unit id="s7d61705dfb120d7b">
+  <source>The user in authentik this device will be assigned to.</source>
+</trans-unit>
+<trans-unit id="s5eaf1d304e03ed4b">
+  <source>Duo User ID</source>
+</trans-unit>
+<trans-unit id="s003847d8bc01c676">
+  <source>The user ID in Duo, can be found in the URL after clicking on a user.</source>
+</trans-unit>
+<trans-unit id="sbbc806ea3987c781">
+  <source>Automatic import</source>
+</trans-unit>
+<trans-unit id="s77299a9d3dd932cd">
+  <source>Successfully imported <x id="0" equiv-text="${res.count}"/> devices.</source>
+</trans-unit>
+<trans-unit id="s6a615f6165ef01c9">
+  <source>Start automatic import</source>
+</trans-unit>
+<trans-unit id="s9f83d7768aea548a">
+  <source>Or manually import</source>
+</trans-unit>
+<trans-unit id="sddc8efe94cb8c210">
+  <source>Stages are single steps of a Flow that a user is guided through. A stage can only be executed from within a flow.</source>
+</trans-unit>
+<trans-unit id="s0eaf755fa88c8d97">
+  <source>Stage(s)</source>
+</trans-unit>
+<trans-unit id="s3914cb410fca44d4">
+  <source>Import</source>
+</trans-unit>
+<trans-unit id="s8a67b33a0d70d322">
+  <source>Import Duo device</source>
+</trans-unit>
+<trans-unit id="s254a9a23dc1635df">
+  <source>Import devices</source>
+</trans-unit>
+<trans-unit id="s48cf8fd56b1237ed">
+  <source>Successfully updated flow.</source>
+</trans-unit>
+<trans-unit id="sc3e0c240b159fbce">
+  <source>Successfully created flow.</source>
+</trans-unit>
+<trans-unit id="s925936f647ae52cc">
+  <source>Shown as the Title in Flow pages.</source>
+</trans-unit>
+<trans-unit id="s50719dda8f90abf4">
+  <source>Visible in the URL.</source>
+</trans-unit>
+<trans-unit id="s0f4c6540c30bd8b4">
+  <source>Designation</source>
+</trans-unit>
+<trans-unit id="sb25d9afe10941425">
+  <source>Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.</source>
+</trans-unit>
+<trans-unit id="sb36e4c05244278c1">
+  <source>No requirement</source>
+</trans-unit>
+<trans-unit id="s7b105164d209f670">
+  <source>Require authentication</source>
+</trans-unit>
+<trans-unit id="s239c2a351cde6d39">
+  <source>Require no authentication.</source>
+</trans-unit>
+<trans-unit id="s98beadfeeb3acb66">
+  <source>Require superuser.</source>
+</trans-unit>
+<trans-unit id="s047a5f0211fedc72">
+  <source>Require Outpost (flow can only be executed from an outpost).</source>
+</trans-unit>
+<trans-unit id="sfad9279cc42c6b61">
+  <source>Required authentication level for this flow.</source>
+</trans-unit>
+<trans-unit id="sb56674c9ea4f0588">
+  <source>Behavior settings</source>
+</trans-unit>
+<trans-unit id="sb6d7d58cb0a1544e">
+  <source>Compatibility mode</source>
+</trans-unit>
+<trans-unit id="s14ace18ccf4fb86d">
+  <source>Increases compatibility with password managers and mobile devices.</source>
+</trans-unit>
+<trans-unit id="scfbc2f1396ee8550">
+  <source>Denied action</source>
+</trans-unit>
+<trans-unit id="sff38031cf061e3ae">
+  <source>Will follow the ?next parameter if set, otherwise show a message</source>
+</trans-unit>
+<trans-unit id="s936bf4342b182ad4">
+  <source>Will either follow the ?next parameter or redirect to the default interface</source>
+</trans-unit>
+<trans-unit id="s22b0e8c5277dd5a9">
+  <source>Will notify the user the flow isn't applicable</source>
+</trans-unit>
+<trans-unit id="s2eeca5cfc99ef19b">
+  <source>Decides the response when a policy denies access to this flow for a user.</source>
+</trans-unit>
+<trans-unit id="sbaf20067de176c90">
+  <source>Appearance settings</source>
+</trans-unit>
+<trans-unit id="s2e4818861000b13f">
+  <source>Layout</source>
+</trans-unit>
+<trans-unit id="s1efbfc3937d565bd">
+  <source>Background</source>
+</trans-unit>
+<trans-unit id="s374abf1a54d87b67">
+  <source>Background shown during execution.</source>
+</trans-unit>
+<trans-unit id="s3ebf4c166058afce">
+  <source>Clear background</source>
+</trans-unit>
+<trans-unit id="sb24755ea94bef31d">
+  <source>Delete currently set background image.</source>
+</trans-unit>
+<trans-unit id="sb904f23f17b60c3a">
+  <source>Successfully imported flow.</source>
+</trans-unit>
+<trans-unit id="s344c4a2a48997e18">
+  <source>.yaml files, which can be found on goauthentik.io and can be exported by authentik.</source>
+</trans-unit>
+<trans-unit id="sc816360d6f5a1eeb">
+  <source>Flows describe a chain of Stages to authenticate, enroll or recover a user. Stages are chosen based on policies applied to them.</source>
+</trans-unit>
+<trans-unit id="s6f857299d5db1ecf">
+  <source>Flow(s)</source>
+</trans-unit>
+<trans-unit id="s9e830cbc0b42a514">
+  <source>Update Flow</source>
+</trans-unit>
+<trans-unit id="sc4fdeccf14be5378">
+  <source>Execute</source>
+</trans-unit>
+<trans-unit id="s293aa6a6446fb153">
+  <source>Export</source>
+</trans-unit>
+<trans-unit id="s2f1bcfcc5cae94c3">
+  <source>Create Flow</source>
+</trans-unit>
+<trans-unit id="s832282d415294df4">
+  <source>Import Flow</source>
+</trans-unit>
+<trans-unit id="s098237f7ccb4dc4a">
+  <source>Successfully cleared flow cache</source>
+</trans-unit>
+<trans-unit id="s59572c1be31a812e">
+  <source>Failed to delete flow cache</source>
+</trans-unit>
+<trans-unit id="sa2b727168b090d34">
+  <source>Clear Flow cache</source>
+</trans-unit>
+<trans-unit id="sf12d588a76ba7e51">
+  <source>Are you sure you want to clear the flow cache?
+            This will cause all flows to be re-evaluated on their next usage.</source>
+</trans-unit>
+<trans-unit id="sbe47a5bdeec19ab0">
+  <source>Stage binding(s)</source>
+</trans-unit>
+<trans-unit id="sfa88f413e287bb0f">
+  <source>Stage type</source>
+</trans-unit>
+<trans-unit id="s04440099d97c0bef">
+  <source>Edit Stage</source>
+</trans-unit>
+<trans-unit id="s980270d0fab7ecb3">
+  <source>Update Stage binding</source>
+</trans-unit>
+<trans-unit id="sfe938c1585e0bf68">
+  <source>These bindings control if this stage will be applied to the flow.</source>
+</trans-unit>
+<trans-unit id="sfac6f995c7670559">
+  <source>No Stages bound</source>
+</trans-unit>
+<trans-unit id="s955c1fec1c6fb970">
+  <source>No stages are currently bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s9a393a04eaf1eb0e">
+  <source>Create Stage binding</source>
+</trans-unit>
+<trans-unit id="s207e8b106806d7e4">
+  <source>Bind stage</source>
+</trans-unit>
+<trans-unit id="s6f367f5604d5056d">
+  <source>Create and bind Stage</source>
+</trans-unit>
+<trans-unit id="scc2e420c54dc8089">
+  <source>Bind existing stage</source>
+</trans-unit>
+<trans-unit id="s30d1f50f476c3f48">
+  <source>Flow Overview</source>
+</trans-unit>
+<trans-unit id="s01794c0ee3629c1b">
+  <source>Flow Info</source>
+</trans-unit>
+<trans-unit id="s77099d752f1ab773">
+  <source>Related actions</source>
+</trans-unit>
+<trans-unit id="sd07866d9f38b2c50">
+  <source>Execute flow</source>
+</trans-unit>
+<trans-unit id="s9ff3121d30f88d52">
+  <source>Normal</source>
+</trans-unit>
+<trans-unit id="s6e4c997a101b6abf">
+  <source>with current user</source>
+</trans-unit>
+<trans-unit id="s8ecdbff1a7329b64">
+  <source>with inspector</source>
+</trans-unit>
+<trans-unit id="s3576aead3e68c5c9">
+  <source>Export flow</source>
+</trans-unit>
+<trans-unit id="se2c3cbf2ed1403f1">
+  <source>Stage Bindings</source>
+</trans-unit>
+<trans-unit id="s78c08391ffbfb8c0">
+  <source>These bindings control which users can access this flow.</source>
+</trans-unit>
+<trans-unit id="s7513372fe60f6387">
+  <source>Event volume</source>
+</trans-unit>
+<trans-unit id="sc1a1ff47c058bb09">
+  <source>Event Log</source>
+</trans-unit>
+<trans-unit id="s65d67612999165e9">
+  <source>Event <x id="0" equiv-text="${this.event.pk}"/></source>
+</trans-unit>
+<trans-unit id="s455de2f740b073fd">
+  <source>Event info</source>
+</trans-unit>
+<trans-unit id="sb41b2cfbbc52565b">
+  <source>Created</source>
+</trans-unit>
+<trans-unit id="s037bc6d25a03c3c8">
+  <source>Successfully updated transport.</source>
+</trans-unit>
+<trans-unit id="s1575a15cee001915">
+  <source>Successfully created transport.</source>
+</trans-unit>
+<trans-unit id="s4acf840bc792c3ae">
+  <source>Local (notifications will be created within authentik)</source>
+</trans-unit>
+<trans-unit id="sede0abbf2b612812">
+  <source>Webhook (generic)</source>
+</trans-unit>
+<trans-unit id="s76f5dca6404a1210">
+  <source>Webhook (Slack/Discord)</source>
+</trans-unit>
+<trans-unit id="s6873bdbfa24615fb">
+  <source>Webhook URL</source>
+</trans-unit>
+<trans-unit id="s25ec2846f6b88214">
+  <source>Webhook Mapping</source>
+</trans-unit>
+<trans-unit id="sca2879d96f58a39c">
+  <source>Send once</source>
+</trans-unit>
+<trans-unit id="s2430e000b7cfefd0">
+  <source>Only send notification once, for example when sending a webhook into a chat channel.</source>
+</trans-unit>
+<trans-unit id="s57072ffb92b6c9c8">
+  <source>Define how notifications are sent to users, like Email or Webhook.</source>
+</trans-unit>
+<trans-unit id="s624256f8a4bb4c89">
+  <source>Notification transport(s)</source>
+</trans-unit>
+<trans-unit id="sac1332e6f421526e">
+  <source>Update Notification Transport</source>
+</trans-unit>
+<trans-unit id="s6b5002c605b39d6d">
+  <source>Create Notification Transport</source>
+</trans-unit>
+<trans-unit id="s0a39e4f61ccafacb">
+  <source>Successfully updated rule.</source>
+</trans-unit>
+<trans-unit id="s72e102414fec81a4">
+  <source>Successfully created rule.</source>
+</trans-unit>
+<trans-unit id="sa55ee64c5c51df0f">
+  <source>Select the group of users which the alerts are sent to. If no group is selected the rule is disabled.</source>
+</trans-unit>
+<trans-unit id="sffa171e11d4ae513">
+  <source>Transports</source>
+</trans-unit>
+<trans-unit id="s7b18721be331241e">
+  <source>Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI.</source>
+</trans-unit>
+<trans-unit id="scd0cfe87af6f2ff2">
+  <source>Severity</source>
+</trans-unit>
+<trans-unit id="s107bf77afb93c9b8">
+  <source>Send notifications whenever a specific Event is created and matched by policies.</source>
+</trans-unit>
+<trans-unit id="sf3f9a0feaf083207">
+  <source>Sent to group</source>
+</trans-unit>
+<trans-unit id="sc92ed9d5e01d3f24">
+  <source>Notification rule(s)</source>
+</trans-unit>
+<trans-unit id="s5140d157642d7362">
+  <source>None (rule disabled)</source>
+</trans-unit>
+<trans-unit id="sd1146418b344f81f">
+  <source>Update Notification Rule</source>
+</trans-unit>
+<trans-unit id="sbbc1de43ab6c1f76">
+  <source>Create Notification Rule</source>
+</trans-unit>
+<trans-unit id="s5795b310ab271d20">
+  <source>These bindings control upon which events this rule triggers.
+Bindings to groups/users are checked against the user of the event.</source>
+</trans-unit>
+<trans-unit id="s90c3b62194fe8508">
+  <source>Outpost Deployment Info</source>
+</trans-unit>
+<trans-unit id="s35f9df7668d5fa79">
+  <source>View deployment documentation</source>
+</trans-unit>
+<trans-unit id="sad09c62cb4ebae68">
+  <source>Click to copy token</source>
+</trans-unit>
+<trans-unit id="s0e03fe2dc5b9164b">
+  <source>If your authentik Instance is using a self-signed certificate, set this value.</source>
+</trans-unit>
+<trans-unit id="sc21032b0d37882a0">
+  <source>If your authentik_host setting does not match the URL you want to login with, add this setting.</source>
+</trans-unit>
+<trans-unit id="s6f270e1668c036e9">
+  <source>Successfully updated outpost.</source>
+</trans-unit>
+<trans-unit id="s79aed8154d7c472c">
+  <source>Successfully created outpost.</source>
+</trans-unit>
+<trans-unit id="sc3259eb55cf91e8c">
+  <source>LDAP</source>
+</trans-unit>
+<trans-unit id="s8afc8c5aafb392d3">
+  <source>Radius</source>
+</trans-unit>
+<trans-unit id="sa06cd519ff151b6d">
+  <source>RAC</source>
+</trans-unit>
+<trans-unit id="s03970aa76a09982d">
+  <source>Integration</source>
+</trans-unit>
+<trans-unit id="s9c29565c5ae1cc92">
+  <source>Selecting an integration enables the management of the outpost by authentik.</source>
+</trans-unit>
+<trans-unit id="s554ce268e9727e79">
+  <source>You can only select providers that match the type of the outpost.</source>
+</trans-unit>
+<trans-unit id="sf9b1c0661a02d9f9">
+  <source>Configuration</source>
+</trans-unit>
+<trans-unit id="s3abecf1e778c9625">
+  <source>See more here:</source>
+</trans-unit>
+<trans-unit id="s74cb3d66f6a668e1">
+  <source>Documentation</source>
+</trans-unit>
+<trans-unit id="saa8939ac88a76f98">
+  <source>Last seen</source>
+</trans-unit>
+<trans-unit id="s1ac2653a6492b435">
+  <source><x id="0" equiv-text="${this.outpostHealth.version}"/>, should be <x id="1" equiv-text="${this.outpostHealth.versionShould}"/></source>
+</trans-unit>
+<trans-unit id="s1e176e35c828318c">
+  <source>Hostname</source>
+</trans-unit>
+<trans-unit id="s322e34cfcba47155">
+  <source>Not available</source>
+</trans-unit>
+<trans-unit id="s02b632a9ac24a824">
+  <source>Last seen: <x id="0" equiv-text="${this.outpostHealth.lastSeen?.toLocaleTimeString()}"/></source>
+</trans-unit>
+<trans-unit id="sa43153d53ae65063">
+  <source>Unknown type</source>
+</trans-unit>
+<trans-unit id="s8802553bc57617ee">
+  <source>Outposts are deployments of authentik components to support different environments and protocols, like reverse proxies.</source>
+</trans-unit>
+<trans-unit id="s84d7d6ebbedcb586">
+  <source>Health and Version</source>
+</trans-unit>
+<trans-unit id="s9bf48a89367282cd">
+  <source>Warning: authentik Domain is not configured, authentication will not work.</source>
+</trans-unit>
+<trans-unit id="sbf5f4c5ba679e847">
+  <source>Logging in via <x id="0" equiv-text="${item.config.authentik_host}"/>.</source>
+</trans-unit>
+<trans-unit id="s59b6028f19d15cda">
+  <source>No integration active</source>
+</trans-unit>
+<trans-unit id="s9bd59e0ea70a3e4a">
+  <source>Update Outpost</source>
+</trans-unit>
+<trans-unit id="sc8f286ac783c385d">
+  <source>View Deployment Info</source>
+</trans-unit>
+<trans-unit id="s9ee92717d7f63247">
+  <source>Detailed health (one instance per column, data is cached so may be out of date)</source>
+</trans-unit>
+<trans-unit id="s1d49ec5030447643">
+  <source>Outpost(s)</source>
+</trans-unit>
+<trans-unit id="s1a2f8f4b3861583b">
+  <source>Create Outpost</source>
+</trans-unit>
+<trans-unit id="sdc1ef94016f0d855">
+  <source>Successfully updated integration.</source>
+</trans-unit>
+<trans-unit id="sc2a1a40a1b4b0170">
+  <source>Successfully created integration.</source>
+</trans-unit>
+<trans-unit id="se9b1fec72ffd8f48">
+  <source>Local</source>
+</trans-unit>
+<trans-unit id="sc1231049879b8d33">
+  <source>If enabled, use the local connection. Required Docker socket/Kubernetes Integration.</source>
+</trans-unit>
+<trans-unit id="s13de04774ff0f210">
+  <source>Docker URL</source>
+</trans-unit>
+<trans-unit id="sa7fcf026bd25f231">
+  <source>Can be in the format of 'unix://' when connecting to a local docker daemon, using 'ssh://' to connect via SSH, or 'https://:2376' when connecting to a remote system.</source>
+</trans-unit>
+<trans-unit id="saf1d289e3137c2ea">
+  <source>CA which the endpoint's Certificate is verified against. Can be left empty for no validation.</source>
+</trans-unit>
+<trans-unit id="s0f2e070d38cd36df">
+  <source>TLS Authentication Certificate/SSH Keypair</source>
+</trans-unit>
+<trans-unit id="s2f58bb9905d2b76f">
+  <source>Certificate/Key used for authentication. Can be left empty for no authentication.</source>
+</trans-unit>
+<trans-unit id="s8b33660e2ed7212c">
+  <source>When connecting via SSH, this keypair is used for authentication.</source>
+</trans-unit>
+<trans-unit id="sa668bd79645c3e06">
+  <source>Kubeconfig</source>
+</trans-unit>
+<trans-unit id="sa85cfb884c17d85d">
+  <source>Verify Kubernetes API SSL Certificate</source>
+</trans-unit>
+<trans-unit id="se78364ee913ae2bd">
+  <source>New outpost integration</source>
+</trans-unit>
+<trans-unit id="s68d69ad0271c8ef6">
+  <source>Create a new outpost integration.</source>
+</trans-unit>
+<trans-unit id="sae239213b7c70376">
+  <source>State</source>
+</trans-unit>
+<trans-unit id="sb96629f50f2e7fab">
+  <source>Unhealthy</source>
+</trans-unit>
+<trans-unit id="sa8e255492bb6ae0d">
+  <source>Outpost integration(s)</source>
+</trans-unit>
+<trans-unit id="s9d18948d25c68d66">
+  <source>Successfully generated certificate-key pair.</source>
+</trans-unit>
+<trans-unit id="sd4ac926e4ebb1cd7">
+  <source>Common Name</source>
+</trans-unit>
+<trans-unit id="s592425143c4f5834">
+  <source>Subject-alt name</source>
+</trans-unit>
+<trans-unit id="se9d0f12f95b14095">
+  <source>Optional, comma-separated SubjectAlt Names.</source>
+</trans-unit>
+<trans-unit id="s7609ee54e8a7b05a">
+  <source>Validity days</source>
+</trans-unit>
+<trans-unit id="s4c24b2baa377e870">
+  <source>Successfully updated certificate-key pair.</source>
+</trans-unit>
+<trans-unit id="s122f308b5f198ba7">
+  <source>Successfully created certificate-key pair.</source>
+</trans-unit>
+<trans-unit id="s08a8716c214a0efb">
+  <source>PEM-encoded Certificate data.</source>
+</trans-unit>
+<trans-unit id="s6e612e5a6a359bbb">
+  <source>Optional Private Key. If this is set, you can use this keypair for encryption.</source>
+</trans-unit>
+<trans-unit id="s27ac7a47b390e3cb">
+  <source>Certificate-Key Pairs</source>
+</trans-unit>
+<trans-unit id="sb72ebab438cb2983">
+  <source>Import certificates of external providers or create certificates to sign requests with.</source>
+</trans-unit>
+<trans-unit id="s4b5af7736aedd6c1">
+  <source>Private key available?</source>
+</trans-unit>
+<trans-unit id="s1d6e16d86961c782">
+  <source>Certificate-Key Pair(s)</source>
+</trans-unit>
+<trans-unit id="sc1ce2f758935ff48">
+  <source>Managed by authentik</source>
+</trans-unit>
+<trans-unit id="sf53a78d889b6c775">
+  <source>Managed by authentik (Discovered)</source>
+</trans-unit>
+<trans-unit id="sef50d248448e0df1">
+  <source>Yes (<x id="0" equiv-text="${item.privateKeyType?.toUpperCase()}"/>)</source>
+</trans-unit>
+<trans-unit id="s33aa05f435c29753">
+  <source>Update Certificate-Key Pair</source>
+</trans-unit>
+<trans-unit id="seffdf887fed7f668">
+  <source>Certificate Fingerprint (SHA1)</source>
+</trans-unit>
+<trans-unit id="sdd6b8b56a811080e">
+  <source>Certificate Fingerprint (SHA256)</source>
+</trans-unit>
+<trans-unit id="s2a2d3e7c379e9518">
+  <source>Certificate Subject</source>
+</trans-unit>
+<trans-unit id="s351246c52548086a">
+  <source>Download Certificate</source>
+</trans-unit>
+<trans-unit id="s47bd537a3bcebf19">
+  <source>Download Private key</source>
+</trans-unit>
+<trans-unit id="s3a5fec3d73ac9edc">
+  <source>Create Certificate-Key Pair</source>
+</trans-unit>
+<trans-unit id="s45cb501abd43ba52">
+  <source>Generate</source>
+</trans-unit>
+<trans-unit id="sf9bddaf910f4eea5">
+  <source>Generate Certificate-Key Pair</source>
+</trans-unit>
+<trans-unit id="s634e2fd82c397576">
+  <source>Successfully updated settings.</source>
+</trans-unit>
+<trans-unit id="sb8e4edaea6f1d935">
+  <source>Avatars</source>
+</trans-unit>
+<trans-unit id="s945856050217c828">
+  <source>Configure how authentik should show avatars for users. The following values can be set:</source>
+</trans-unit>
+<trans-unit id="sf4ef4c8ce713f775">
+  <source>Disables per-user avatars and just shows a 1x1 pixel transparent picture</source>
+</trans-unit>
+<trans-unit id="s5446842a7e4a963b">
+  <source>Uses gravatar with the user's email address</source>
+</trans-unit>
+<trans-unit id="s35363b9e1cc2abd3">
+  <source>Generated avatars based on the user's name</source>
+</trans-unit>
+<trans-unit id="s48110ca292cad513">
+  <source>Any URL: If you want to use images hosted on another server, you can set any URL. Additionally, these placeholders can be used:</source>
+</trans-unit>
+<trans-unit id="sbe1dfda044bdc93b">
+  <source>The user's username</source>
+</trans-unit>
+<trans-unit id="s653f257c9c2d4dc5">
+  <source>The email address, md5 hashed</source>
+</trans-unit>
+<trans-unit id="s9c9183cd80916b4f">
+  <source>The user's UPN, if set (otherwise an empty string)</source>
+</trans-unit>
+<trans-unit id="h4963ed14d7e239a9">
+  <source>An attribute path like
+                                    <x id="0" equiv-text="&lt;code&gt;"/>attributes.something.avatar<x id="1" equiv-text="&lt;/code&gt;"/>, which can be used in
+                                    combination with the file field to allow users to upload custom
+                                    avatars for themselves.</source>
+</trans-unit>
+<trans-unit id="s4c80c34a67a6f1c9">
+  <source>Multiple values can be set, comma-separated, and authentik will fallback to the next mode when no avatar could be found.</source>
+</trans-unit>
+<trans-unit id="h2fafcc3ebafea2f8">
+  <source>For example, setting this to <x id="0" equiv-text="&lt;code&gt;"/>gravatar,initials<x id="1" equiv-text="&lt;/code&gt;"/> will
+                                attempt to get an avatar from Gravatar, and if the user has not
+                                configured on there, it will fallback to a generated avatar.</source>
+</trans-unit>
+<trans-unit id="sea247dfb18f696d2">
+  <source>Default user change name</source>
+</trans-unit>
+<trans-unit id="s078ffec0257621c0">
+  <source>Enable the ability for users to change their name.</source>
+</trans-unit>
+<trans-unit id="s26ad11b21253152b">
+  <source>Default user change email</source>
+</trans-unit>
+<trans-unit id="s5fc6c14d106f40d3">
+  <source>Enable the ability for users to change their email.</source>
+</trans-unit>
+<trans-unit id="s23564aa839755965">
+  <source>Default user change username</source>
+</trans-unit>
+<trans-unit id="s6d816a95ca43a99d">
+  <source>Enable the ability for users to change their username.</source>
+</trans-unit>
+<trans-unit id="s84c5a011acd608c9">
+  <source>Event retention</source>
+</trans-unit>
+<trans-unit id="s2536ac8d32d2e63f">
+  <source>Duration after which events will be deleted from the database.</source>
+</trans-unit>
+<trans-unit id="s7b1fba26d245cb1c">
+  <source>When using an external logging solution for archiving, this can be set to "minutes=5".</source>
+</trans-unit>
+<trans-unit id="s44536d20bb5c8257">
+  <source>This setting only affects new Events, as the expiration is saved per-event.</source>
+</trans-unit>
+<trans-unit id="s57b52b60ed5e2bc7">
+  <source>Footer links</source>
+</trans-unit>
+<trans-unit id="s7349802b2f7f99c2">
+  <source>This option configures the footer links on the flow executor pages. It must be a valid JSON list and can be used as follows:</source>
+</trans-unit>
+<trans-unit id="s166b59f3cc5d8ec3">
+  <source>GDPR compliance</source>
+</trans-unit>
+<trans-unit id="sb8b23770f899e5bb">
+  <source>When enabled, all the events caused by a user will be deleted upon the user's deletion.</source>
+</trans-unit>
+<trans-unit id="s29501761df0fe837">
+  <source>Impersonation</source>
+</trans-unit>
+<trans-unit id="s8f503553d8432487">
+  <source>Globally enable/disable impersonation.</source>
+</trans-unit>
+<trans-unit id="see1eb81c1f734079">
+  <source>System settings</source>
+</trans-unit>
+<trans-unit id="s33f85f24c0f5f008">
+  <source>Save</source>
+</trans-unit>
+<trans-unit id="see2bcbc11bb91960">
+  <source>Successfully updated instance.</source>
+</trans-unit>
+<trans-unit id="s9e51d6de369f320b">
+  <source>Successfully created instance.</source>
+</trans-unit>
+<trans-unit id="s92e91071c6a45eb4">
+  <source>Disabled blueprints are never applied.</source>
+</trans-unit>
+<trans-unit id="sf63c89c0604c288f">
+  <source>Local path</source>
+</trans-unit>
+<trans-unit id="sd6422f7004036cdd">
+  <source>OCI Registry</source>
+</trans-unit>
+<trans-unit id="scbb7d3154da629f3">
+  <source>OCI URL, in the format of oci://registry.domain.tld/path/to/manifest.</source>
+</trans-unit>
+<trans-unit id="s0195c0df7294228a">
+  <source>See more about OCI support here:</source>
+</trans-unit>
+<trans-unit id="sfae395b94a5a0040">
+  <source>Blueprint</source>
+</trans-unit>
+<trans-unit id="s7e1342d37124b65b">
+  <source>Configure the blueprint context, used for templating.</source>
+</trans-unit>
+<trans-unit id="s6ec8c9d11310300a">
+  <source>Orphaned</source>
+</trans-unit>
+<trans-unit id="s6835db03209b4f94">
+  <source>Automate and template configuration within authentik.</source>
+</trans-unit>
+<trans-unit id="s23de62f931f7d754">
+  <source>Last applied</source>
+</trans-unit>
+<trans-unit id="s2708cac1f4942708">
+  <source>Blueprint(s)</source>
+</trans-unit>
+<trans-unit id="s880b8b70b22f9977">
+  <source>Update Blueprint</source>
+</trans-unit>
+<trans-unit id="sb8f855b49234b81b">
+  <source>Apply</source>
+</trans-unit>
+<trans-unit id="sef3d102324bf8561">
+  <source>Create Blueprint Instance</source>
+</trans-unit>
+<trans-unit id="s0e427111d750cc02">
+  <source>Successfully updated license.</source>
+</trans-unit>
+<trans-unit id="s06ae64e621f302eb">
+  <source>Successfully created license.</source>
+</trans-unit>
+<trans-unit id="s2905c425adae99bd">
+  <source>Install ID</source>
+</trans-unit>
+<trans-unit id="sb18ec434a8a3aafb">
+  <source>License key</source>
+</trans-unit>
+<trans-unit id="s9ce7cc01fb9b5b53">
+  <source>Manage enterprise licenses</source>
+</trans-unit>
+<trans-unit id="sf9ebf11ac2645820">
+  <source>No licenses found.</source>
+</trans-unit>
+<trans-unit id="sd49099e9522635f4">
+  <source>License(s)</source>
+</trans-unit>
+<trans-unit id="s3be1d90ffa46b7f1">
+  <source>Enterprise is in preview.</source>
+</trans-unit>
+<trans-unit id="s4015746f55a8d89f">
+  <source>Get a license</source>
+</trans-unit>
+<trans-unit id="sb2cbd06f8e25b47e">
+  <source>Go to Customer Portal</source>
+</trans-unit>
+<trans-unit id="sf58825457d61c429">
+  <source>Forecast internal users</source>
+</trans-unit>
+<trans-unit id="sde9a3f41977ec1f8">
+  <source>Estimated user count one year from now based on <x id="0" equiv-text="${this.forecast?.internalUsers}"/> current internal users and <x id="1" equiv-text="${this.forecast?.forecastedInternalUsers}"/> forecasted internal users.</source>
+</trans-unit>
+<trans-unit id="s4557b6b9da258643">
+  <source>Forecast external users</source>
+</trans-unit>
+<trans-unit id="sf52479d6daa0a4a8">
+  <source>Estimated user count one year from now based on <x id="0" equiv-text="${this.forecast?.externalUsers}"/> current external users and <x id="1" equiv-text="${this.forecast?.forecastedExternalUsers}"/> forecasted external users.</source>
+</trans-unit>
+<trans-unit id="sd22bd01bdf28c548">
+  <source>Cumulative license expiry</source>
+</trans-unit>
+<trans-unit id="s0dd031b58ed4017c">
+  <source>Internal: <x id="0" equiv-text="${item.internalUsers}"/></source>
+</trans-unit>
+<trans-unit id="s57b07e524f8f5c2a">
+  <source>External: <x id="0" equiv-text="${item.externalUsers}"/></source>
+</trans-unit>
+<trans-unit id="sdeb6cee42435dd07">
+  <source>Update License</source>
+</trans-unit>
+<trans-unit id="s6196153c4b0c1ea0">
+  <source>Install</source>
+</trans-unit>
+<trans-unit id="s0285b4bd69130fa3">
+  <source>Install License</source>
+</trans-unit>
+<trans-unit id="s67ac11d47f1ce794">
+  <source>WebAuthn requires this page to be accessed via HTTPS.</source>
+</trans-unit>
+<trans-unit id="se9e9e1d6799b86a5">
+  <source>WebAuthn not supported by browser.</source>
+</trans-unit>
+<trans-unit id="s09f0c100d0ad2fec">
+  <source>Open Wizard</source>
+</trans-unit>
+<trans-unit id="sf2ef885f7d0a101d">
+  <source>Demo Wizard</source>
+</trans-unit>
+<trans-unit id="s77505ee5d2e45e53">
+  <source>Run the demo wizard</source>
+</trans-unit>
+<trans-unit id="sab85321d3b0840b7">
+  <source>API request failed</source>
+</trans-unit>
+<trans-unit id="s28b99b59541f54ca">
+  <source>Connection failed after <x id="0" equiv-text="${this.connectionAttempt}"/> attempts.</source>
+</trans-unit>
+<trans-unit id="s7c7d956418e1c8c8">
+  <source>Re-connecting in <x id="0" equiv-text="${Math.max(1, delay / 1000)}"/> second(s).</source>
+</trans-unit>
+<trans-unit id="sfc003381f593d943">
+  <source>Connecting...</source>
+</trans-unit>
+<trans-unit id="sd766cdc29b25ff95">
+  <source>Authenticating with Apple...</source>
+</trans-unit>
+<trans-unit id="s2c8189544e3ea679">
+  <source>Retry</source>
+</trans-unit>
+<trans-unit id="s420d2cdedcaf8cd0">
+  <source>Authenticating with Plex...</source>
+</trans-unit>
+<trans-unit id="s2ddbebcb8a49b005">
+  <source>Waiting for authentication...</source>
+</trans-unit>
+<trans-unit id="sb15fe7b9d09bb419">
+  <source>If no Plex popup opens, click the button below.</source>
+</trans-unit>
+<trans-unit id="sbc625b4c669b9ce8">
+  <source>Open login</source>
+</trans-unit>
+<trans-unit id="sa3599457b9418bc5">
+  <source>User's avatar</source>
+</trans-unit>
+<trans-unit id="s9bd9ba84819493d4">
+  <source>Something went wrong! Please try again later.</source>
+</trans-unit>
+<trans-unit id="s4090dd0c0e45988b">
+  <source>Request ID</source>
+</trans-unit>
+<trans-unit id="s4d7fe7be1c49896c">
+  <source>You may close this page now.</source>
+</trans-unit>
+<trans-unit id="sf8c76d5fb408de7b">
+  <source>You're about to be redirect to the following URL.</source>
+</trans-unit>
+<trans-unit id="s197420b40df164f8">
+  <source>Follow redirect</source>
+</trans-unit>
+<trans-unit id="sa11e92683c5860c7">
+  <source>Request has been denied.</source>
+</trans-unit>
+<trans-unit id="s8939f574b096054a">
+  <source>Not you?</source>
+</trans-unit>
+<trans-unit id="sc4eedb434536bdb4">
+  <source>Need an account?</source>
+</trans-unit>
+<trans-unit id="s38f774cd7e9b9dad">
+  <source>Sign up.</source>
+</trans-unit>
+<trans-unit id="sa03aa46068460c95">
+  <source>Forgot username or password?</source>
+</trans-unit>
+<trans-unit id="s4a87445f3108db7c">
+  <source>Select one of the sources below to login.</source>
+</trans-unit>
+<trans-unit id="s091d5407b5b32e84">
+  <source>Or</source>
+</trans-unit>
+<trans-unit id="se5fd752dbbc3cd28">
+  <source>Use a security key</source>
+</trans-unit>
+<trans-unit id="s670ad066cc0e50a3">
+  <source>Login to continue to <x id="0" equiv-text="${this.challenge.applicationPre}"/>.</source>
+</trans-unit>
+<trans-unit id="scf5ce91bfba10a61">
+  <source>Please enter your password</source>
+</trans-unit>
+<trans-unit id="s85366fac18679f28">
+  <source>Forgot password?</source>
+</trans-unit>
+<trans-unit id="s14c552fb0a4c0186">
+  <source>Application requires following permissions:</source>
+</trans-unit>
+<trans-unit id="s7073489bb01b3c24">
+  <source>Application already has access to the following permissions:</source>
+</trans-unit>
+<trans-unit id="s98dc556f8bf707dc">
+  <source>Application requires following new permissions:</source>
+</trans-unit>
+<trans-unit id="sbd19064fc3f405c1">
+  <source>Check your Inbox for a verification email.</source>
+</trans-unit>
+<trans-unit id="s8aff572e64b7936b">
+  <source>Send Email again.</source>
+</trans-unit>
+<trans-unit id="sdc323c6af4ae9f01">
+  <source>Successfully copied TOTP Config.</source>
+</trans-unit>
+<trans-unit id="s3687049d1af562c4">
+  <source>Copy</source>
+</trans-unit>
+<trans-unit id="s3643189d1abbb7f4">
+  <source>Code</source>
+</trans-unit>
+<trans-unit id="sfe1c86b42ba13376">
+  <source>Please enter your TOTP Code</source>
+</trans-unit>
+<trans-unit id="sc2ec367e3108fe65">
+  <source>Duo activation QR code</source>
+</trans-unit>
+<trans-unit id="sc5668cb23167e9bb">
+  <source>Alternatively, if your current device has Duo installed, click on this link:</source>
+</trans-unit>
+<trans-unit id="s721d94ae700b5dfd">
+  <source>Duo activation</source>
+</trans-unit>
+<trans-unit id="s708d9a4a0db0be8f">
+  <source>Check status</source>
+</trans-unit>
+<trans-unit id="s31fba571065f2c87">
+  <source>Make sure to keep these tokens in a safe place.</source>
+</trans-unit>
+<trans-unit id="sc0a0c87d5c556c38">
+  <source>Phone number</source>
+</trans-unit>
+<trans-unit id="s04c1210202f48dc9">
+  <source>Please enter your Phone number.</source>
+</trans-unit>
+<trans-unit id="seb0c08d9f233bbfe">
+  <source>Please enter the code you received via SMS</source>
+</trans-unit>
+<trans-unit id="s2b7dbba348234a36">
+  <source>A code has been sent to you via SMS.</source>
+</trans-unit>
+<trans-unit id="sa84adff85b5e505c">
+  <source>Open your two-factor authenticator app to view your authentication code.</source>
+</trans-unit>
+<trans-unit id="s7abc9d08b0f70fd6">
+  <source>Static token</source>
+</trans-unit>
+<trans-unit id="s844fea0bfb10a72a">
+  <source>Authentication code</source>
+</trans-unit>
+<trans-unit id="s3cd84e82e83e35ad">
+  <source>Please enter your code</source>
+</trans-unit>
+<trans-unit id="s18b910437b73e8e8">
+  <source>Return to device picker</source>
+</trans-unit>
+<trans-unit id="sbcf8604929b6a27a">
+  <source>Sending Duo push notification</source>
+</trans-unit>
+<trans-unit id="s3b68883dda2682ed">
+  <source>Assertions is empty</source>
+</trans-unit>
+<trans-unit id="sbbb7318812d64e51">
+  <source>Error when creating credential: <x id="0" equiv-text="${err}"/></source>
+</trans-unit>
+<trans-unit id="sfe199b2564b66054">
+  <source>Error when validating assertion on server: <x id="0" equiv-text="${err}"/></source>
+</trans-unit>
+<trans-unit id="se409d01b52c4e12f">
+  <source>Retry authentication</source>
+</trans-unit>
+<trans-unit id="s8d857061510fe794">
+  <source>Duo push-notifications</source>
+</trans-unit>
+<trans-unit id="s47490298c17b753a">
+  <source>Receive a push notification on your device.</source>
+</trans-unit>
+<trans-unit id="s16bc281dce5685e8">
+  <source>Authenticator</source>
+</trans-unit>
+<trans-unit id="sdefec5401bf67eba">
+  <source>Use a security key to prove your identity.</source>
+</trans-unit>
+<trans-unit id="sd6a025d66f2637d1">
+  <source>Traditional authenticator</source>
+</trans-unit>
+<trans-unit id="sb25e689e00c61829">
+  <source>Use a code-based authenticator.</source>
+</trans-unit>
+<trans-unit id="s9e568afec3810bfe">
+  <source>Recovery keys</source>
+</trans-unit>
+<trans-unit id="sb17e8c70f9a05c77">
+  <source>In case you can't access any other method.</source>
+</trans-unit>
+<trans-unit id="s97f2dc19fa556a6a">
+  <source>SMS</source>
+</trans-unit>
+<trans-unit id="s0e516232f2ab4e04">
+  <source>Tokens sent via SMS.</source>
+</trans-unit>
+<trans-unit id="s6ae0d087036e6d6d">
+  <source>Select an authentication method.</source>
+</trans-unit>
+<trans-unit id="sac17f177f884e238">
+  <source>Stay signed in?</source>
+</trans-unit>
+<trans-unit id="s859b2e00391da380">
+  <source>Select Yes to reduce the number of times you're asked to sign in.</source>
+</trans-unit>
+<trans-unit id="sc1589121ae2f5f92">
+  <source>Enter the code shown on your device.</source>
+</trans-unit>
+<trans-unit id="s67664f8ee9aea98d">
+  <source>Please enter your Code</source>
+</trans-unit>
+<trans-unit id="s455a8fc21077e7f9">
+  <source>You've successfully authenticated your device.</source>
+</trans-unit>
+<trans-unit id="s3ab772345f78aee0">
+  <source>Flow inspector</source>
+</trans-unit>
+<trans-unit id="s502884e1977b2c06">
+  <source>Next stage</source>
+</trans-unit>
+<trans-unit id="sb3fa80ccfa97ee54">
+  <source>Stage name</source>
+</trans-unit>
+<trans-unit id="sbea3c1e4f2fd623d">
+  <source>Stage kind</source>
+</trans-unit>
+<trans-unit id="s2bc8aa1740d3da34">
+  <source>Stage object</source>
+</trans-unit>
+<trans-unit id="sc3e1c4f1fff8e1ca">
+  <source>This flow is completed.</source>
+</trans-unit>
+<trans-unit id="s342eccabf83c9bde">
+  <source>Plan history</source>
+</trans-unit>
+<trans-unit id="sb2f307e79d20bb56">
+  <source>Current plan context</source>
+</trans-unit>
+<trans-unit id="sa13e6c8310000e30">
+  <source>Session ID</source>
+</trans-unit>
+<trans-unit id="s6fe64b4625517333">
+  <source>Powered by authentik</source>
+</trans-unit>
+<trans-unit id="sdf34a5599d66f85c">
+  <source>Background image</source>
+</trans-unit>
+<trans-unit id="s7fa4e5e409d43573">
+  <source>Error creating credential: <x id="0" equiv-text="${err}"/></source>
+</trans-unit>
+<trans-unit id="s9d95f09deb601f34">
+  <source>Server validation of credential failed: <x id="0" equiv-text="${err}"/></source>
+</trans-unit>
+<trans-unit id="s6c8f05e3be04f62a">
+  <source>Register device</source>
+</trans-unit>
+<trans-unit id="s31aa94a0b3c7edb2">
+  <source>Select endpoint to connect to</source>
+</trans-unit>
+<trans-unit id="sba65ae54d6585c1a">
+  <source>Unread notifications</source>
+</trans-unit>
+<trans-unit id="s7cfe12cd14df9950">
+  <source>Sign out</source>
+</trans-unit>
+<trans-unit id="s5599c62bb78c631f">
+  <source>Admin interface</source>
+</trans-unit>
+<trans-unit id="s1298e361e40ee1c5">
+  <source>Stop impersonation</source>
+</trans-unit>
+<trans-unit id="s6abff64e7ff7fde9">
+  <source>Avatar image</source>
+</trans-unit>
+<trans-unit id="s28cbd874ba450b4e">
+  <source>Less details</source>
+</trans-unit>
+<trans-unit id="s8fa26f65aed77c96">
+  <source>More details</source>
+</trans-unit>
+<trans-unit id="s3fb39fc45e840f78">
+  <source>Refer to documentation</source>
+</trans-unit>
+<trans-unit id="sc741dfb09d3395f0">
+  <source>No Applications available.</source>
+</trans-unit>
+<trans-unit id="sf34026321b35315c">
+  <source>Either no applications are defined, or you don’t have access to any.</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
+</trans-unit>
+<trans-unit id="s06c92148da82be0d">
+  <source>Change your password</source>
+</trans-unit>
+<trans-unit id="sff50532a2d85e32e">
+  <source>Change password</source>
+</trans-unit>
+<trans-unit id="saf63d34c8601dd41">
+  <source><x id="0" equiv-text="${prompt.label}"/></source>
+</trans-unit>
+<trans-unit id="s045c3b86aae073c1">
+  <source>Delete account</source>
+</trans-unit>
+<trans-unit id="s4a6aa26413287069">
+  <source>Successfully updated details</source>
+</trans-unit>
+<trans-unit id="s6fcd9b5a87ceccd6">
+  <source>Open settings</source>
+</trans-unit>
+<trans-unit id="s8c05cccd470f6b5f">
+  <source>No settings flow configured.</source>
+</trans-unit>
+<trans-unit id="sb546eb04425e07fa">
+  <source>Update details</source>
+</trans-unit>
+<trans-unit id="sea2f00b34b385a43">
+  <source>Successfully updated device.</source>
+</trans-unit>
+<trans-unit id="s6a406aecb2c0e5c5">
+  <source>Enroll</source>
+</trans-unit>
+<trans-unit id="sabb56f74492e7e96">
+  <source>Update Device</source>
+</trans-unit>
+<trans-unit id="s30205d424e710818">
+  <source>Successfully disconnected source</source>
+</trans-unit>
+<trans-unit id="s67dedada007d4067">
+  <source>Failed to disconnected source: <x id="0" equiv-text="${exc}"/></source>
+</trans-unit>
+<trans-unit id="sd2208cd1a767644b">
+  <source>Disconnect</source>
+</trans-unit>
+<trans-unit id="s7a4f059aaa029719">
+  <source>Connect</source>
+</trans-unit>
+<trans-unit id="sababff57115130a0">
+  <source>Error: unsupported source settings: <x id="0" equiv-text="${source.component}"/></source>
+</trans-unit>
+<trans-unit id="sd1031bddc66dc495">
+  <source>Connect your user account to the services listed below, to allow you to login using the service instead of traditional credentials.</source>
+</trans-unit>
+<trans-unit id="s7968dbed9b106c29">
+  <source>No services available.</source>
+</trans-unit>
+<trans-unit id="s3a135682bd30bdbb">
+  <source>Create App password</source>
+</trans-unit>
+<trans-unit id="s588796ee929a2e4c">
+  <source>User details</source>
+</trans-unit>
+<trans-unit id="s332a5235948c1a1d">
+  <source>Consent</source>
+</trans-unit>
+<trans-unit id="sff945d3f59b93c5e">
+  <source>MFA Devices</source>
+</trans-unit>
+<trans-unit id="sc54aafeea9c9bab0">
+  <source>Connected services</source>
+</trans-unit>
+</body>
+</file>
+</xliff>
diff --git a/web/xliff/zh-Hans.xlf b/web/xliff/zh-Hans.xlf
index 69eb76c0b..3d6f02923 100644
--- a/web/xliff/zh-Hans.xlf
+++ b/web/xliff/zh-Hans.xlf
@@ -8145,6 +8145,22 @@ Bindings to groups/users are checked against the user of the event.</source>
   <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
   <target>设置会话在被断开连接并需要重新授权之前持续的时间。</target>
 </trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+  <target>提供程序需要企业版。</target>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+  <target>了解更多</target>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+  <target>最大并发连接数</target>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+  <target>允许到此端点的最大并发连接数。可以设置为 -1 以禁用限制。</target>
+</trans-unit>
 <trans-unit id="s744401846fea6e76">
   <source>Brand</source>
 </trans-unit>
@@ -8175,6 +8191,12 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sa9d13ce9e83aac17">
   <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
 </trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
 <trans-unit id="s6709b81e1ed4e39f">
   <source>The current brand must have a recovery flow configured to use a recovery link</source>
 </trans-unit>
diff --git a/web/xliff/zh-Hant.xlf b/web/xliff/zh-Hant.xlf
index 8ed4da7a0..d2c092bf0 100644
--- a/web/xliff/zh-Hant.xlf
+++ b/web/xliff/zh-Hant.xlf
@@ -6149,6 +6149,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s6dd297c217729828">
   <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
 </trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+</trans-unit>
 <trans-unit id="s744401846fea6e76">
   <source>Brand</source>
 </trans-unit>
@@ -6179,6 +6191,12 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sa9d13ce9e83aac17">
   <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
 </trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
 <trans-unit id="s6709b81e1ed4e39f">
   <source>The current brand must have a recovery flow configured to use a recovery link</source>
 </trans-unit>
diff --git a/web/xliff/zh_CN.xlf b/web/xliff/zh_CN.xlf
index ea9939a67..9f27a492e 100644
--- a/web/xliff/zh_CN.xlf
+++ b/web/xliff/zh_CN.xlf
@@ -8203,6 +8203,22 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s6dd297c217729828">
   <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
   <target>设置会话在被断开连接并需要重新授权之前持续的时间。</target>
+</trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+  <target>提供程序需要企业版。</target>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+  <target>了解更多</target>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+  <target>最大并发连接数</target>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+  <target>允许到此端点的最大并发连接数。可以设置为 -1 以禁用限制。</target>
 </trans-unit>
     </body>
   </file>
diff --git a/web/xliff/zh_TW.xlf b/web/xliff/zh_TW.xlf
index 192a55da5..7ee0e7217 100644
--- a/web/xliff/zh_TW.xlf
+++ b/web/xliff/zh_TW.xlf
@@ -8025,6 +8025,18 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s6dd297c217729828">
   <source>Determines how long a session lasts before being disconnected and requiring re-authorization.</source>
 </trans-unit>
+<trans-unit id="scc7f34824150bfb8">
+  <source>Provider require enterprise.</source>
+</trans-unit>
+<trans-unit id="s31f1afc1bfe1cb3a">
+  <source>Learn more</source>
+</trans-unit>
+<trans-unit id="sc39f6abf0daedb0f">
+  <source>Maximum concurrent connections</source>
+</trans-unit>
+<trans-unit id="s62418cbcd2a25498">
+  <source>Maximum concurrent allowed connections to this endpoint. Can be set to -1 to disable the limit.</source>
+</trans-unit>
 <trans-unit id="s744401846fea6e76">
   <source>Brand</source>
 </trans-unit>
@@ -8055,6 +8067,12 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sa9d13ce9e83aac17">
   <source>To let a user directly reset a their password, configure a recovery flow on the currently active brand.</source>
 </trans-unit>
+<trans-unit id="s94d61907ee22a8c1">
+  <source>Korean</source>
+</trans-unit>
+<trans-unit id="s95d56e58f816d211">
+  <source>Dutch</source>
+</trans-unit>
 <trans-unit id="s6709b81e1ed4e39f">
   <source>The current brand must have a recovery flow configured to use a recovery link</source>
 </trans-unit>
diff --git a/website/docs/flow/index.md b/website/docs/flow/index.md
index d13ea1e5e..0fd0c510c 100644
--- a/website/docs/flow/index.md
+++ b/website/docs/flow/index.md
@@ -65,4 +65,6 @@ This designates a flow for general setup. This designation doesn't have any cons
 
 Flows can be imported and exported to share with other people, the community and for troubleshooting. Flows can be imported to apply new functionality and apply existing workflows.
 
+Download our [Example flows](./examples/flows.md) and then import them into your authentik instance.
+
 Starting with authentik 2022.8, flows will be exported as YAML, but JSON-based flows can still be imported.
diff --git a/website/docs/providers/oauth2/index.md b/website/docs/providers/oauth2/index.md
index 0eba63765..90ce75778 100644
--- a/website/docs/providers/oauth2/index.md
+++ b/website/docs/providers/oauth2/index.md
@@ -35,12 +35,20 @@ To access the user's email address, a scope of `user:email` is required. To acce
 
 ### `authorization_code`:
 
-This grant is used to convert an authorization code to a refresh token. The authorization code is retrieved through the Authorization flow, and can only be used once, and expires quickly.
+This grant is used to convert an authorization code to an access token (and optionally refresh token). The authorization code is retrieved through the Authorization flow, and can only be used once, and expires quickly.
+
+:::info
+Starting with authentik 2024.1, applications only receive an access token. To receive a refresh token, applications must be allowed to request the `offline_access` scope in authentik and also be configured to request the scope.
+:::
 
 ### `refresh_token`:
 
 Refresh tokens can be used as long-lived tokens to access user data, and further renew the refresh token down the road.
 
+:::info
+Starting with authentik 2024.1, this grant requires the `offline_access` scope.
+:::
+
 ### `client_credentials`:
 
 See [Machine-to-machine authentication](./client_credentials)
diff --git a/website/docs/releases/2024/v2024.1.md b/website/docs/releases/2024/v2024.1.md
index 54c488a32..8168c31ba 100644
--- a/website/docs/releases/2024/v2024.1.md
+++ b/website/docs/releases/2024/v2024.1.md
@@ -17,6 +17,12 @@ slug: "/releases/2024.1"
     -   `authentik_outpost_radius_requests_rejected` -> `authentik_outpost_radius_requests_rejected_total`
     -   `authentik_main_requests` -> `authentik_main_request_duration_seconds`
 
+-   Required `offline_access` scope for Refresh tokens
+
+    The OAuth2 provider ships with a new default scope called `offline_access`, which must be requested by applications that need a refresh token. Previously, authentik would always issue a refresh token for the _Authorization code_ and _Device code_ OAuth grants.
+
+    Applications which require will need their configuration update to include the `offline_access` scope mapping.
+
 ## New features
 
 -   "Pretend user exists" option for Identification stage
diff --git a/website/integrations/services/jellyfin/index.md b/website/integrations/services/jellyfin/index.md
index 5de18d3b4..ef66efd27 100644
--- a/website/integrations/services/jellyfin/index.md
+++ b/website/integrations/services/jellyfin/index.md
@@ -15,7 +15,7 @@ Jellyfin does not have any native external authentication support as of the writ
 :::
 
 :::note
-Currently there are two plugins for Jelyfin that provide external authenticaion, an OIDC plugin and an LDAP plugin. This guide focuses on the use of the LDAP plugin.
+Currently, there are two plugins for Jellyfin that provide external authentication, an OIDC plugin and an LDAP plugin. This guide focuses on the use of the LDAP plugin.
 :::
 
 :::caution
@@ -34,49 +34,49 @@ The following placeholders will be used:
 
 ## Jellyfin configuration
 
-1. If you don't have one already create an LDAP bind user before starting these steps.
+1. If you don't have one already, create an LDAP bind user before starting these steps.
     - Ideally, this user doesn't have any permissions other than the ability to view other users. However, some functions do require an account with permissions.
     - This user must be part of the group that is specified in the "Search group" in the LDAP outpost.
 2. Navigate to your Jellyfin installation and log in with the admin account or currently configured local admin.
 3. Open the administrator dashboard and go to the "Plugins" section.
 4. Click "Catalog" at the top of the page, and locate the "LDAP Authentication Plugin"
 5. Install the plugin. You may need to restart Jellyfin to finish installation.
-6. Once finished navigate back to the plugins section of the admin dashboard, click the 3 dots on the "LDAP-Auth Plugin" card, and click settings.
+6. Once finished, navigate back to the plugins section of the admin dashboard, click the 3 dots on the "LDAP-Auth Plugin" card, and click settings.
 7. Configure the LDAP Settings as follows:
     - `LDAP Server`: `ldap.company.com`
     - `LDAP Port`: 636
     - `Secure LDAP`: **Checked**
     - `StartTLS`: Unchecked
     - `Skip SSL/TLS Verification`:
-        - If using a certificate issued by a certificate authority Jellyfin trusts, leave this unchecked.
-        - If you're using a self signed certificate, check this box.
+        - If using a certificate issued by a certificate authority, Jellyfin trusts, leave this unchecked.
+        - If you're using a self-signed certificate, check this box.
     - `Allow password change`: Unchecked
-        - Since authentik already has a frontend for password resets, its not necessary to include this in Jellyfin, especially since it requires bind user to have privileges.
+        - Since authentik already has a frontend for password resets, it's not necessary to include this in Jellyfin, especially since it requires bind user to have privileges.
     - `Password Reset URL`: Empty
-    - `LDAP Bind User`: Set this to a the user you want to bind to in authentik. By default the path will be `ou=users,dc=company,dc=com` so the LDAP Bind user will be `cn=ldap_bind_user,ou=users,dc=company,dc=com`.
+    - `LDAP Bind User`: Set this to a user you want to bind to in authentik. By default, the path will be `ou=users,dc=company,dc=com` so the LDAP Bind user will be `cn=ldap_bind_user,ou=users,dc=company,dc=com`.
     - `LDAP Bind User Password`: The Password of the user. If using a Service account, this is the token.
-    - `LDAP Base DN for Searches`: the base DN for LDAP queries. To query all users set this to `dc=company,dc=com`.
+    - `LDAP Base DN for Searches`: the base DN for LDAP queries. To query all users, set this to `dc=company,dc=com`.
         - You can specify an OU if you divide your users up into different OUs and only want to query a specific OU.
 
-At this point click `Save and Test LDAP Server Settings`. If the settings are correct you will see:
+At this point, click `Save and Test LDAP Server Settings`. If the settings are correct, you will see:
 `Connect(Success); Bind(Success); Base Search (Found XY Entities)`
 
 -   `LDAP User Filter`: This is used to a user filter on what users are allowed to login. **This must be set**
     -   To allow all users: `(objectClass=user)`
     -   To only allow users in a specific group: `(memberOf=cn=jellyfin_users,ou=groups,dc=company,dc=com)`
     -   Good Docs on LDAP Filters: [atlassian.com](https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html)
--   `LDAP Admin Base DN`: All of the users in this DN are automatically set as admins.
-    -   This can be left blank. Admins can be set manually outside of this filter
+-   `LDAP Admin Base DN`: All the users in this DN are automatically set as admins.
+    -   This can be left blank. Admins can be set manually outside this filter
 -   `LDAP Admin Filter`: Similar to the user filter, but every matched user is set as admin.
-    -   This can be left blank. Admins can be set manually outside of this filter
+    -   This can be left blank. Admins can be set manually outside this filter
 
-At this point click `Save and Test LDAP Filter Settings`. If the settings are correct you will see:
+At this point, click `Save and Test LDAP Filter Settings`. If the settings are correct, you will see:
 `Found X user(s), Y admin(s)`
 
 -   `LDAP Attributes`: `uid, cn, mail, displayName`
 -   `Enable case Insensitive Username`: **Checked**
 
-At this point, enter in a username and click "Save Search Attribute Settings and Query User". If the settings are correct you will see:
+At this point, enter a username and click "Save Search Attribute Settings and Query User". If the settings are correct, you will see:
 `Found User: cn=test,ou=users,dc=company,dc=com`
 
 -   `Enabled User Creation`: **Checked**
diff --git a/website/package-lock.json b/website/package-lock.json
index 743f24714..488dda4d8 100644
--- a/website/package-lock.json
+++ b/website/package-lock.json
@@ -18,7 +18,7 @@
                 "@mdx-js/react": "^3.0.0",
                 "clsx": "^2.1.0",
                 "disqus-react": "^1.1.5",
-                "postcss": "^8.4.32",
+                "postcss": "^8.4.33",
                 "prism-react-renderer": "^2.3.1",
                 "rapidoc": "^9.3.4",
                 "react": "^18.2.0",
@@ -33,7 +33,7 @@
                 "@docusaurus/module-type-aliases": "3.0.1",
                 "@docusaurus/tsconfig": "3.0.1",
                 "@docusaurus/types": "3.0.1",
-                "@types/react": "^18.2.46",
+                "@types/react": "^18.2.47",
                 "prettier": "3.1.1",
                 "typescript": "~5.3.3"
             },
@@ -4373,9 +4373,9 @@
             "integrity": "sha512-+0autS93xyXizIYiyL02FCY8N+KkKPhILhcUSA276HxzreZ16kl+cmwvV2qAM/PuCCwPXzOXOWhiPcw20uSFcA=="
         },
         "node_modules/@types/react": {
-            "version": "18.2.46",
-            "resolved": "https://registry.npmjs.org/@types/react/-/react-18.2.46.tgz",
-            "integrity": "sha512-nNCvVBcZlvX4NU1nRRNV/mFl1nNRuTuslAJglQsq+8ldXe5Xv0Wd2f7WTE3jOxhLH2BFfiZGC6GCp+kHQbgG+w==",
+            "version": "18.2.47",
+            "resolved": "https://registry.npmjs.org/@types/react/-/react-18.2.47.tgz",
+            "integrity": "sha512-xquNkkOirwyCgoClNk85BjP+aqnIS+ckAJ8i37gAbDs14jfW/J23f2GItAf33oiUPQnqNMALiFeoM9Y5mbjpVQ==",
             "dependencies": {
                 "@types/prop-types": "*",
                 "@types/scheduler": "*",
@@ -7898,9 +7898,9 @@
             }
         },
         "node_modules/follow-redirects": {
-            "version": "1.15.3",
-            "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.3.tgz",
-            "integrity": "sha512-1VzOtuEM8pC9SFU1E+8KfTjZyMztRsgEfwQl44z8A25uy13jSzTj6dyK2Df52iV0vgHCfBwLhDWevLn95w5v6Q==",
+            "version": "1.15.4",
+            "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.4.tgz",
+            "integrity": "sha512-Cr4D/5wlrb0z9dgERpUL3LrmPKVDsETIJhaCMeDfuFYcqa5bldGV6wBsAN6X/vxlXQtFBMrXdXxdL8CbDTGniw==",
             "funding": [
                 {
                     "type": "individual",
@@ -13137,9 +13137,9 @@
             }
         },
         "node_modules/postcss": {
-            "version": "8.4.32",
-            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.32.tgz",
-            "integrity": "sha512-D/kj5JNu6oo2EIy+XL/26JEDTlIbB8hw85G8StOE6L74RQAVVP5rej6wxCNqyMbR4RkPfqvezVbPw81Ngd6Kcw==",
+            "version": "8.4.33",
+            "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.33.tgz",
+            "integrity": "sha512-Kkpbhhdjw2qQs2O2DGX+8m5OVqEcbB9HRBvuYM9pgrjEFUg30A9LmXNlTAUj4S9kgtGyrMbTzVjH7E+s5Re2yg==",
             "funding": [
                 {
                     "type": "opencollective",
diff --git a/website/package.json b/website/package.json
index 7773daee1..37ba114a8 100644
--- a/website/package.json
+++ b/website/package.json
@@ -25,7 +25,7 @@
         "@mdx-js/react": "^3.0.0",
         "clsx": "^2.1.0",
         "disqus-react": "^1.1.5",
-        "postcss": "^8.4.32",
+        "postcss": "^8.4.33",
         "prism-react-renderer": "^2.3.1",
         "rapidoc": "^9.3.4",
         "react-before-after-slider-component": "^1.1.8",
@@ -52,7 +52,7 @@
         "@docusaurus/module-type-aliases": "3.0.1",
         "@docusaurus/tsconfig": "3.0.1",
         "@docusaurus/types": "3.0.1",
-        "@types/react": "^18.2.46",
+        "@types/react": "^18.2.47",
         "prettier": "3.1.1",
         "typescript": "~5.3.3"
     },