Email and sign-in
Operators find Tenants, Users and Settings under Platform in the sidebar.
Settings → Email: SMTP server, sender, and Send test mail. Email is used for invitations and “forgot password”.
The panel tries all of the SMTP server’s addresses (IPv4 and IPv6) at once. When none answers, the test names the addresses it tried.
Sign-in
Section titled “Sign-in”Everyone can use a password with two-factor authentication (an authenticator app, with recovery codes) and passkeys. Sign-in attempts are rate-limited.
Settings → Sign-in adds Discord and OpenID Connect providers (Authentik, Keycloak, Google, Entra ID…). Changes apply at once, without a restart. Each provider shows the callback URL to register at the provider: https://<panel>/signin-<Name>.
Accounts are never matched by email: a provider has to be linked on the account page while signed in, unless open registration is on.
Create accounts on first sign-in (per provider): for a company login everyone may use. A first sign-in creates an account, optionally joining a tenant with a role. An email that already has an account is refused with a hint to link the provider instead; a provider that shares no email can’t create accounts.
Providers in the environment
Section titled “Providers in the environment”Providers can also be set in deploy/panel.env (copy panel.env.example); any number, numbered from 0:
Auth__Providers__0__Name=authentikAuth__Providers__0__Type=oidcAuth__Providers__0__DisplayName=AuthentikAuth__Providers__0__Authority=https://auth.example.com/application/o/server-panel/Auth__Providers__0__ClientId=…Auth__Providers__0__ClientSecret=…Auth__Providers__0__CreateAccounts=true # optional, with …__DefaultTenantId and …__DefaultRole
Auth__Providers__1__Name=discordAuth__Providers__1__Type=discordAuth__Providers__1__DisplayName=DiscordAuth__Providers__1__ClientId=…Auth__Providers__1__ClientSecret=…Each needs a unique Name. An invalid entry stops the panel at start with a message naming the field. Providers from the environment are shown in the admin area but can only be changed there.
Accounts
Section titled “Accounts”Settings → General decides whether people may create an account by signing in with a provider (open registration), and whether they may create tenants.
Users (operators):
- add someone by invitation, or with a password you set
- edit name and operator
- lock or unlock
- reset two-factor (lost phone)
- create a password reset link (emailed, and shown to you)
- change the email address (at once, without a confirmation mail)
- delete
People change their own email address on the account page; it counts once they open the link sent to the new address, so that needs email set up. They can also download their data and delete their account there (Privacy).
Invitations: adding an email without an account (on a tenant’s Members page, or as a user) creates a one-time link valid for 7 days. The person picks a name and password, or signs in with a provider, and lands in the tenant with the chosen role. Without email set up, the panel shows the link for you to pass on.
Tenants (operators): create (the owner is invited if they have no account yet), rename, delete (only without servers).