socAdmin docs
guides Users and roles

Users and roles

Every person gets their own socAdmin account, as an admin or a read-only user.

Accounts

A socAdmin account is an email and a password, stored in socAdmin’s own SQLite file. It is separate from database users: once signed in, each person still enters the database credentials they are allowed to use.

Passwords must have at least 10 characters, including an uppercase letter, a lowercase letter, a digit and a special character. They are hashed with bcrypt.

The first admin

There are two ways to get the first admin account:

  • Set ADMIN_EMAIL and ADMIN_PASSWORD. socAdmin creates this admin on startup if the email doesn’t exist yet. Recommended on Docker.
  • Register in the browser. When socAdmin has no accounts, the first person to register becomes the admin.

Everyone who registers after that gets the read-only role.

Roles

Admin Read-only
Browse databases, tables, collections and rows Yes Yes
View structure, indexes, triggers, routines, views Yes Yes
Export and back up Yes Yes
Use saved connections Yes Yes
Run queries in the editor Yes No
Insert, edit and delete rows or documents Yes No
Create, alter, drop or truncate databases and tables Yes No
Import SQL, CSV or JSON, restore a backup Yes No
Save or delete shared connections Yes No
Manage socAdmin users and roles Yes No
Edit the IP whitelist Yes No

Adding people

Admins create accounts and change roles from the users screen in socAdmin.

To stop strangers from creating accounts on a public instance, turn off self-registration:

REGISTRATION_ENABLED=false

With registration off, only an admin can add users. The very first account can still be created when socAdmin is empty.

Sign-in protection

  • After 5 failed sign-ins for the same email from the same IP, sign-in is blocked for 15 minutes.
  • Sessions use a short-lived access token (15 minutes) renewed by a refresh token (7 days), both in HttpOnly cookies.
  • Changing or resetting a password revokes that user’s refresh tokens.

Forgot a password? See Resetting a password.