User Accounts

Every person who works on your site signs in to the dashboard with their own user account. This page explains how to manage your own account, secure it with two-factor authentication, recover access and invite other people to collaborate with you. All of these options can be found in the Users section of the System Settings.

Your Account

Your account consists of a username, an email address and a password. You can sign in using either your username or your email address. Both can be changed at any time under Your Account.

A username must start and end with a lowercase letter or a number and can only contain the characters a-z, 0-9, _ and -. Usernames and email addresses must be unique across all accounts.

Passwords

Use the Change password button to set a new password. You have to enter your current password first, and the new password must be different from the current one.

New passwords have to meet a set of requirements. By default, a password must be at least 8 characters long and contain at least one uppercase letter, one lowercase letter, one digit and one of the special characters @#%^~+=*$&!. You can change these rules in the configuration file using the following two options:

{
  "AM_PASSWORD_MIN_LENGTH": 8,
  "AM_PASSWORD_REQUIRED_CHARS": "@#%^~+=*$&! A-Z a-z 0-9"
}

The value of AM_PASSWORD_REQUIRED_CHARS is a space-separated list of character groups. A password must contain at least one character of each group.

Two-Factor Authentication

Two-factor authentication (2FA) adds a second step to the sign-in process. After entering your password, you also have to enter a 6-digit code that is generated by an authenticator app on your phone. Your account therefore stays protected even if your password is compromised. Any app that supports time-based one-time passwords (TOTP) can be used.

From now on, the dashboard asks for a code each time you sign in. In case you want to stop using 2FA, click Disable two-factor authentication in the same section. Note that 2FA is configured per account, so every user has to set it up for themselves.

Account Recovery

In case you forgot your password or lost access to your authenticator app, you can recover your account by email. This requires a working email configuration and an account that has an email address.

In case email isn't available, an account can't be recovered from the sign-in page. You can still create a new account using the command line and then sign in with that account.

Collaborators

You can add as many users as you like. Automad doesn't have user roles, so all users have the same permissions and can access every part of the dashboard, including the system settings and the user management. Only add people you fully trust.

Inviting Users

The easiest way of adding a collaborator is sending an invitation by email. Click Invite user by email, enter a username and the email address of the person and click Send invitation. The new user then receives an email with a button that leads to the setup page, where a verification code can be requested in order to set a password and complete the setup.

Invitations are sent using the email configuration of your site. Make sure it works before inviting users.

Creating Users Manually

In case email isn't available, you can also create an account directly. Click the link below the collaborator buttons, enter a username, an email address and a password and click Create user. You then have to share the credentials with the new user yourself, and the user should change the password after signing in for the first time.

Removing Users

Click Users with access in order to see a list of all accounts. A shield icon next to a name indicates that the user has enabled two-factor authentication. Select the users you want to remove and click Remove selected users. You can't remove your own account.

Signing Out All Users

The Sign out all users now button at the bottom of the section ends all active sessions at once, including your own. This is useful in case a device that was signed in got lost or a user should lose access immediately. Technically, a new session cookie salt is generated and saved as AM_SESSION_COOKIE_SALT in the configuration file, which invalidates all existing sessions.

Command Line

User accounts can also be created with the user:create command of the Console. This is helpful for automated installations or in case you have no access to any existing account. Run the following command in the Automad base directory:

php automad/console user:create --email userdomaincom

The --email, --username and --password arguments are all optional. A random username and password are generated in case they are left out. The credentials of the new account are printed to the terminal once the account is created.