Users, roles and access

Signing in

A panel account signs in with an email address and password, or with a passkey on its own: a successful passkey assertion opens a full session with no password step. Passkeys are offered only when the panel is reached over HTTPS, which it always is.

Sessions expire after 12 hours of inactivity by default; an administrator can set anything from 15 minutes to 30 days under Settings → Session timeout. The timer counts from your last activity, not from sign-in. Changing your password signs out every other device.

Sign-in attempts are limited to 10 per 5 minutes per IP address; the response is "too many attempts, slow down". A wrong password and an unknown email both return "invalid credentials", in the same time, so accounts cannot be enumerated.

Secure your account

Open Account & Security from your name in the header.

Passkeys

1. Under Passkeys, press Add, give it a name (default "Passkey") and complete your browser's or device's prompt.
2. Sign out and sign back in with the passkey to confirm it works. The list shows when each passkey was added and last used; rename or remove them here.

Two-factor authentication (TOTP)

1. Under Two-Factor Authentication, press Enable. The panel shows the secret and an otpauth:// URI: add it to your authenticator app (paste the secret or the URI; a QR image is not shown).
2. Enter the current 6-digit code to confirm. Codes are valid for 30 seconds, with one step of tolerance either side, and a code cannot be reused.

Lost password or authenticator

• Forgot password? on the sign-in screen sends a single-use link valid for one hour. It appears only when outgoing email is configured and a panel domain is set; otherwise it is hidden.
• An administrator can reset another user's password and revoke their passkeys from Access Control.
• From a shell on the server, root can reset anyone, including the only administrator, in any licence state:

sudo apcli user list
sudo apcli user passwd admin@example.com --generate     # prints the new password once

The reset also ends all of that user's sessions. It works over a root-only socket with a root-only token, so it cannot be reached from the network.

Roles

Access is decided along two axes: an account role, and per-site grants.

Two server-wide capabilities can be delegated to a non-administrator: server (services, reboot, hostname, package installs, snapshots) and runtimes (installing Node and PHP versions). Managing users and settings (SMTP, licence, off-site backup target, updates) can never be delegated. Docker sites and the audit log are also administrators only.

A non-administrator sees only the sites they have been granted. Nothing else on the server is visible to them.

Add a user

1. Access Control → New user. Enter a name and email address and choose the account role.
2. Grant sites: for each site, pick the role that applies to it.
3. Leave the password blank and the panel generates one and shows it once; pass it on over a channel you trust. There is no invitation email.

Deleting a user revokes access immediately and removes the record; the sites are untouched. You cannot edit your own account from Access Control; use Account & Security.

Audit log

Audit Log (administrators) records every action taken through the panel: who, what, on which target, when. Site changes, file operations, database and backup actions, user and role changes, service restarts, updates and settings are all recorded; successful sign-ins are not. Entries are kept indefinitely and can be filtered by text, activity type and date range in the panel. There is no export.

Not available

• Personal API tokens for users. The only token is the root-only CLI token used by apcli on the server itself. Register interest in API access.
• TOTP recovery codes (see above).