@@ -40,7 +40,7 @@ A missing or invalid token returns `401` with code `unauthorized`. A valid token
 
 Tokens are minted where a human can approve them — creating one is deliberately *not* possible with another API key:
 
-- **Dashboard** — with **All projects** selected in the project switcher, open **API Tokens** and click **New token**. The full token is shown once.
+- **Dashboard** — open your account menu at the bottom of the sidebar, choose **Personal access tokens**, and click **New token**. The full token is shown once.
 - **Device login** — for CLIs and dev tools, below.
 
 Only a hash is stored server-side, so save the token when it is shown.
@@ -49,7 +49,7 @@ Only a hash is stored server-side, so save the token when it is shown.
 
 Services shouldn't run as a person — when that person leaves or their access changes, the integration breaks. An org API key is its own principal: it holds an org role (`admin` or `member`) and per-project roles, granted exactly like a member's.
 
-Create one in the dashboard: with **All projects** selected in the project switcher, open **API Tokens**, switch to the **Organization** tab, and under **Organization API tokens** click **New token**. Pick a name and org role; the `omnara_org_v1_…` token is shown once. Then grant the key project roles from its detail panel — a member-role key sees nothing until you do, same as a human member.
+Create one in the dashboard: with **All projects** selected in the project switcher, open **API Tokens** under **Access** (org admins only) and click **New token**. Pick a name and org role; the `omnara_org_v1_…` token is shown once. Then grant the key project roles from its detail panel — a member-role key sees nothing until you do, same as a human member.
 
 Key management stays human-gated: creating, renaming, changing roles, and revoking all require a dashboard session, so one API key can never mint or escalate another. Listing and reading key metadata work with regular API auth ([List org API keys](/api-reference/endpoints/users-and-api-keys/list-org-api-keys)). Revocation is permanent and drops the key's org and project roles ([Revoke](/api-reference/endpoints/users-and-api-keys/revoke-an-org-api-key)).
 
@@ -148,4 +148,4 @@ Clients without OAuth support can pass a personal access token or org API key in
 
 ## Managing tokens
 
-The **API Tokens** page — or [List personal access tokens](/api-reference/endpoints/users-and-api-keys/list-the-authenticated-users-personal-access-tokens) — shows your tokens with creation and last-used times, metadata only: the secret is never shown again. `last_used_at` tells you which tokens are actually alive; prune the rest, and [revoke](/api-reference/endpoints/users-and-api-keys/revoke-a-personal-access-token) immediately if a token leaks — revocation is permanent.
+The **Personal access tokens** page in your account menu — or [List personal access tokens](/api-reference/endpoints/users-and-api-keys/list-the-authenticated-users-personal-access-tokens) — shows your tokens with creation and last-used times, metadata only: the secret is never shown again. `last_used_at` tells you which tokens are actually alive; prune the rest, and [revoke](/api-reference/endpoints/users-and-api-keys/revoke-a-personal-access-token) immediately if a token leaks — revocation is permanent.
@@ -66,9 +66,9 @@ Machines are org-level; a project's agents can only target machines granted to t
 
 <Tabs>
 <Tab title="Dashboard">
-  If you didn't share the machine while connecting it, select **All projects** in the project switcher, find its row under **Machines**, click **Share with project**, and select the project.
+  If you didn't share the machine while connecting it, select **All projects** in the project switcher, open **Machines**, and click **BYO Machines**. Open the machine's row actions, click **Share with project**, and select the project.
 
-  From a project, open its **Machines** page and click **Share machines**. The page's **Shared machines** table lists existing shares; click **Stop sharing** to revoke one.
+  From a project, open its **Machines** page and click **Share machines**. To see existing shares, click **BYO Machines**; open a row's actions and click **Stop sharing** to revoke one.
 </Tab>
 <Tab title="API">
   If you didn't pass `project_ids` while connecting the machine, grant it afterwards:
 
@@ -78,11 +78,11 @@ A configured model (`mdl_…`) gives a provider model a name and runtime setting
 <Tab title="Dashboard">
   In **Add models**, select the detected models you want, or click **Skip for now**. The detected slug is used as the configured model name. Agent YAML must use the configured model name exactly.
 
-  To add models later, select **All projects** in the project switcher, open **Models**, and click **New model**. In **Add models**, choose the provider, then search the provider's models and check the ones you want, or type a slug that isn't listed and click its **Add … as a custom model** row. Click **Edit** on a selected row to set its **Name**, **Context**, and **Max output**; a row that still needs input shows **Needs details**. Optionally pick projects under **Share with**, then click the add button, which shows the count (for example, **Add 2 models**).
+  To add models later, select **All projects** in the project switcher, open **Models**, expand the provider's models, and click **Add model**; the provider's own page has the same button above its model list. In **Add models**, the provider is preselected; search the provider's models and check the ones you want, or type a slug that isn't listed and click its **Add … as a custom model** row. Click **Edit** on a selected row to set its **Name**, **Context**, and **Max output**; a row that still needs input shows **Needs details**. Optionally pick projects under **Share with**, then click the add button, which shows the count (for example, **Add 2 models**).
 
   A provider can have several configured models for the same slug — for example, two names with different limits. Models the provider already has are marked **Added**; check one again to add another configuration under a different name.
 
-  To set the optional **Default output** allowance or change other settings later, open the model's row actions on the **Models** page and click **Edit**.
+  To set the optional **Default output** allowance or change other settings later, open the model's row actions under its provider on the **Models** page and click **Edit**.
 </Tab>
 </Tabs>
 
 
@@ -35,7 +35,7 @@ Help me setup Omnara by fetching the Skill file here: https://github.com/omnara-
 
   <Steps>
     <Step title="Set up">
-      The CLI signs in through your browser; if you have not logged in yet, the first command that needs your account starts the login for you. The REST API and the SDK authenticate with an API token. In the web browser, select **All projects** in the project switcher, open **API Tokens**, click **New token**, and save the value.
+      The CLI signs in through your browser; if you have not logged in yet, the first command that needs your account starts the login for you. The REST API and the SDK authenticate with an API token. In the web browser, open your account menu at the bottom of the sidebar, choose **Personal access tokens**, click **New token**, and save the value.
 
       <ApiSetup />
     </Step>
 
@@ -92,7 +92,7 @@ Each update creates the next revision; the skill's name cannot change.
   The CLI has no update command. Running `omnara skills create` again with the same owner and skill name uploads the next revision.
 </Tab>
 <Tab title="Dashboard">
-  Open the skill's row menu and click **Edit**. The **SKILL.md** tab edits the instructions in place and keeps the other files; **Upload archive** replaces every file. Frontmatter errors are marked in the editor, and **Save** stays disabled until they are fixed.
+  Click the skill's name to open its page. Edit `SKILL.md` in place and click **Save**; the other files are kept. Frontmatter errors are marked in the editor, and **Save** stays disabled until they are fixed. To replace every file, click **Upload new version** and choose a new archive; the `SKILL.md` name must stay the same.
 </Tab>
 </Tabs>
 
 
@@ -36,17 +36,20 @@ interface ModelChoice extends ConfiguredModelSummary {
 const ModelCombobox = createResourceCombobox<ModelChoice>({
   itemKey: (model) => model.id,
   itemLabel: (model) => `${model.name} · ${model.provider_config}`,
+  // Name gets the full first line; pricing only appears on the highlighted row so it
+  // never crowds the provider.
   renderItem: (model) => (
     <span className="flex min-w-0 flex-1 flex-col gap-0.5">
-      <span className="flex min-w-0 items-baseline gap-1.5">
-        <span className="truncate">{model.name}</span>
-        <span className="text-muted-foreground truncate text-xs">{model.provider_config}</span>
-      </span>
-      <span className="text-muted-foreground text-xs tabular-nums">
-        <ModelPricingSummary pricing={model.pricing} /> per 1M tokens
+      <span className="truncate">{model.name}</span>
+      <span className="text-muted-foreground flex min-w-0 items-baseline gap-3 text-xs">
+        <span className="truncate">{model.provider_config}</span>
+        <span className="in-data-highlighted:inline ml-auto hidden shrink-0 tabular-nums">
+          <ModelPricingSummary pricing={model.pricing} /> per 1M tokens
+        </span>
       </span>
     </span>
   ),
+  contentClassName: 'min-w-[min(36rem,var(--available-width))]',
   placeholder: 'Search shared models…',
   emptyMessage: 'No shared models found.',
 })
 
@@ -2,7 +2,7 @@ import { useMe } from '@omnara/react'
 import { Link } from '@tanstack/react-router'
 import { useState } from 'react'
 
-import { CircleHelp, LogOut, Monitor, Moon, Sun, UserIcon } from '@/components/icons'
+import { CircleHelp, Fingerprint, LogOut, Monitor, Moon, Sun, UserIcon } from '@/components/icons'
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -119,6 +119,15 @@ export function NavUser() {
                 <span className="translate-y-px">Account</span>
               </Link>
             </DropdownMenuItem>
+            <DropdownMenuItem
+              asChild
+              className="hover:bg-primary/15 focus:bg-primary/15 [&_svg]:!text-foreground"
+            >
+              <Link to="/user/api-tokens">
+                <Fingerprint />
+                <span className="translate-y-px">Personal access tokens</span>
+              </Link>
+            </DropdownMenuItem>
             <DropdownMenuItem
               asChild
               className="hover:bg-primary/15 focus:bg-primary/15 [&_svg]:!text-foreground"
 
@@ -15,11 +15,14 @@ import {
   Sparkles,
   Users,
 } from '@/components/icons'
+import { canManageOrg } from '@/lib/permissions'
+import { useActiveOrg } from '@/lib/use-active-org'
 import { useWebConfig } from '@/lib/web-config'
 
 export function OrganizationNav() {
   const pathname = useRouterState({ select: (state) => state.location.pathname })
   const { data: webConfig } = useWebConfig()
+  const { activeOrg } = useActiveOrg()
 
   function item(
     to: LinkProps['to'] & string,
@@ -65,7 +68,7 @@ export function OrganizationNav() {
         label="Access"
         items={[
           item('/members', 'Members', Users),
-          item('/user/api-tokens', 'API Tokens', Fingerprint),
+          ...(canManageOrg(activeOrg.role) ? [item('/api-tokens', 'API Tokens', Fingerprint)] : []),
         ]}
       />
     </>
 
@@ -16,6 +16,7 @@ import { ManagedLogo, OmnaraManagedTag } from '@/components/brand/OmnaraManaged'
 import { ResourceListToolbar } from '@/components/data-table/ResourceListToolbar'
 import { Monitor, Server } from '@/components/icons'
 import { SearchHeader } from '@/components/layout/SearchHeader'
+import { ConnectMachineDialog } from '@/components/org/ConnectMachineDialog'
 import { machinePoolProviderLabel } from '@/components/org/MachinePoolDialogState'
 import { MachinePoolProviderLogo } from '@/components/org/MachinePoolProviderLogo'
 import {
@@ -42,6 +43,19 @@ export function MachinePoolsSection() {
   const query = useMachinePools(activeOrg.id, { filters: list.apiFilters, sort: list.sort })
   const paged = usePagedQuery(query, list.queryKey)
   const [poolDialog, setPoolDialog] = useState<MachinePoolDialog>(null)
+  const [connectOpen, setConnectOpen] = useState(false)
+
+  const connectButton = (
+    <Button
+      size="sm"
+      variant="outline"
+      onClick={() => {
+        setConnectOpen(true)
+      }}
+    >
+      Connect machine
+    </Button>
+  )
 
   const newPoolButton = () =>
     canManage ? (
@@ -72,9 +86,10 @@ export function MachinePoolsSection() {
             />
           }
         >
+          {connectButton}
           {newPoolButton()}
         </SearchHeader>
-        <ByoMachinesCard orgId={activeOrg.id} />
+        <ByoMachinesCard orgId={activeOrg.id} emptyAction={connectButton} />
         <AgentCardList
           items={paged.rows}
           getId={(pool) => pool.id}
@@ -99,6 +114,7 @@ export function MachinePoolsSection() {
           emptyAction={newPoolButton()}
         />
       </div>
+      <ConnectMachineDialog open={connectOpen} onOpenChange={setConnectOpen} orgId={activeOrg.id} />
       {canManage && (
         <MachinePoolDialogs
           orgId={activeOrg.id}
@@ -207,7 +223,7 @@ export function PoolSubtitle({ pool }: { pool: MachinePool }) {
   )
 }
 
-function ByoMachinesCard({ orgId }: { orgId: string }) {
+function ByoMachinesCard({ orgId, emptyAction }: { orgId: string; emptyAction: ReactNode }) {
   // One small page: enough for the preview, and one extra row tells us whether there are more.
   const preview = useMachines(orgId, {
     filters: { source_kind: 'byo' },
@@ -228,6 +244,7 @@ function ByoMachinesCard({ orgId }: { orgId: string }) {
         isPending={preview.isPending}
         isError={preview.isError}
         emptyMessage="No machines connected yet. Connect a machine you operate to run agents on it."
+        emptyAction={emptyAction}
         viewAll={
           hasMore && (
             <Link to="/machines/byo" className={agentCardMoreLinkClass}>
 
@@ -11,12 +11,15 @@ export function MachinePreviewList({
   isPending,
   isError,
   emptyMessage,
+  emptyAction,
   viewAll,
 }: {
   machines: MachineSummary[]
   isPending: boolean
   isError: boolean
   emptyMessage: string
+  /** Shown under the empty message, e.g. a button to add the first machine. */
+  emptyAction?: ReactNode
   /** Link to the full list; omit when every machine is already shown. */
   viewAll?: ReactNode
 }) {
@@ -25,9 +28,12 @@ export function MachinePreviewList({
       {isError ? (
         <p className="text-muted-foreground px-2 py-1.5 text-sm">Couldn&rsquo;t load machines.</p>
       ) : machines.length === 0 ? (
-        <p className="text-muted-foreground px-2 py-1.5 text-sm">
-          {isPending ? 'Loading machines…' : emptyMessage}
-        </p>
+        <div className="flex flex-col items-start gap-2 px-2 py-1.5">
+          <p className="text-muted-foreground text-sm">
+            {isPending ? 'Loading machines…' : emptyMessage}
+          </p>
+          {!isPending && emptyAction}
+        </div>
       ) : (
         <ul className="flex flex-col gap-0.5">
           {machines.map((machine) => {