Users
Everyone who signs in to the panel has an account of their own, listed under Users. Every admin can do everything. The owner, the account the install created, differs only in that nobody else may change or remove it.
Add an admin
Section titled “Add an admin”- Open Users and choose Add admin.
- Enter a Username and a first Password of at least 10 characters.
- Choose Add admin.
The new admin can change the password on their own page. A username that differs from a taken one only in letter case is refused.
Change a username, password or recovery email
Section titled “Change a username, password or recovery email”Open the account from Users. Every change asks for Your password: the password of whoever makes the change, never the account’s own.
- Change username signs nobody out.
- On your own account, Change password signs out every other browser signed in as you. On a colleague’s, Set password ends every session they have.
- Send confirmation link sets a recovery email, where “Forgot your password?” on the sign-in page sends its link. The address counts once its link is followed, within 24 hours.
Only the owner can change the owner’s account.
Set up two-factor authentication
Section titled “Set up two-factor authentication”- On your own page, under Two-factor authentication, choose Set up and enter your password.
- Scan the QR code with an authenticator app, type the code it shows, and choose Turn it on.
- Save the ten recovery codes, which are shown only once, and choose I have saved them.
Turning it on signs out your other sessions. From then on, signing in asks for a code from the app, or one of the recovery codes. New recovery codes replaces the set.
Only the person holding the phone can set it up. When an admin loses the phone and the codes, another admin can choose Turn off on their page. The owner’s can only be turned off by the owner.
Remove an admin
Section titled “Remove an admin”Choose Remove in the list, or Remove admin on their page, and type their username to confirm. Their sessions end at once. AI apps they approved are disconnected too. API keys are not affected. The owner cannot be removed, and you cannot remove yourself.
Limits
Section titled “Limits”- There are no lesser roles. Every admin controls the whole panel and every server, terminal included. Give an account only to someone you would trust with root.
- Two-factor authentication guards the browser sign-in only. API keys are a separate credential.
- An owner who forgot the password and has no recovery email, or lost both the phone and the recovery codes, needs a shell on the server to get back in.