rollcall admin-cert request NAME makes a key locally and sends a CSR; the region signs admin:NAME (client auth) and records the serial; a verified, recorded, unrevoked certificate is an admin. CLI/console read it from client.json, a .p12 is written for the browser; the web UI no longer insists on a token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>