Set up sign-in

People sign in to the Studio with an email and password, and with GitHub when you add a GitHub OAuth app. This page covers what you do on the server: claim a fresh install with the setup code, turn on GitHub sign-in, make a reset link for a locked-out admin, and turn sign-in off for local development. Inviting people and changing roles happens in the Studio: Invite and manage members.

The commands below are for the base stack. On a production server, add -f docker-compose.yml -f docker-compose.prod.yml after docker compose.

Create the first adminCopy Anchor Link

While no admin can sign in, the backend logs a setup code at every start. Whoever can read the server's logs can claim the install with it.

docker compose logs backend | grep "setup code"

No admin can sign in yet. Open http://localhost:8080/studio and set up the first admin with the setup code XXXXX-XXXXX.

The setup code is derived from SESSION_SECRET, so it changes when the secret changes. Once an admin exists, the form answers This server already has an admin. Sign in instead. Whenever no admin can sign in, the backend logs a setup code again at its next start.

Add GitHub sign-inCopy Anchor Link

GitHub sign-in lets in members whose account has GitHub linked (on their Settings page, or by joining with GitHub from an invite link) and people who open an invite link. Anyone else who tries it sees a message that their GitHub account is not a member of the workspace.

https://sluby.example.com/api/v1/auth/github/callback

GITHUB_CLIENT_ID=<client id>
GITHUB_CLIENT_SECRET=<client secret>

docker compose up -d

Make a reset link from the command lineCopy Anchor Link

Admins make reset links for members on the Members page (Give someone a reset link). When no admin can sign in to make one, for example because the only admin forgot their password, make it on the server:

docker compose exec backend node dist/db/reset-link.js --email you@example.com

Reset link for <name>:

  https://sluby.example.com/studio/reset/<token>

It works once, until <date>. Using it sets a new password and signs out every other session of the account.

The link works once and for 7 days. The script finds the account by the email it signs in with, so it cannot make a link for an account that signs in with GitHub only. For a removed account it refuses and says that an admin can restore it on the Members page.

When you run the backend from source, use npm run admin:reset-link --workspace=backend -- --email you@example.com instead.

Create an admin API key from the command lineCopy Anchor Link

To call the API before anyone has signed in, for example from a provisioning script, create a key with every scope on the server:

docker compose exec backend node dist/db/seed-api-key.js --name provisioning

The script prints the key once, after Key:. The key acts as an admin. To have the backend create a key you choose at startup instead, set BOOTSTRAP_API_KEY. What each scope allows: Scopes.

Turn sign-in off for local developmentCopy Anchor Link

On a machine only you can reach, skip sign-in with this line:

AUTH_DISABLED=true

Run docker compose up -d to apply it. Every visitor then acts as one local admin account, and the Studio shows a banner that starts with Sign-in is off. What the setting allows and where it is refused: AUTH_DISABLED.

To turn sign-in back on, set AUTH_DISABLED=false and run docker compose up -d again.

RelatedCopy Anchor Link

• Accounts, roles and sessions
• Sign in and out, from the Studio side
• Sign-in problems