Accounts & Sign-in
The first admin, teammates, passwords and e-mail verification
Self-hosted
The first account. A fresh install shows a setup form on the first
visit: name, e-mail, password (12+ characters mixing three of upper case,
lower case, digits and symbols) and the organization name. Submitting it
creates the administrator and signs you in. Unattended installs create the
admin from BOOTSTRAP_ADMIN_EMAIL and BOOTSTRAP_ADMIN_PASSWORD instead
(Configuration).
Everyone else. Signup closes after the first account
(SIGNUP_MODE=bootstrap). Admins add people under Settings → Team
with a name, an e-mail and a role; the account is created at once with a
one-time password shown to the admin, who hands it over. The person changes
it under Settings → Account after the first sign-in.
Roles. admin manages projects, the team and the audit log; viewer
reads dashboards and data.
E-mail. Without SMTP_* the server sends nothing: accounts are
verified on creation and password-reset links are written to the api log
(docker compose logs api). With SMTP configured, verification and reset
mails work as usual.
Sessions are httpOnly cookies renewed automatically; changing your
password signs you out everywhere. Cookies carry the Secure flag when
PUBLIC_URL is https.
IForevents Cloud
Creating an account. app.iforevents.com/register asks for an e-mail, a password, your full name and an organization name. The organization is your workspace: projects, teammates and billing hang off it, and it starts on the Free plan. You become its owner. Google and GitHub sign-in create the account in one step. The form is protected by Cloudflare Turnstile and refuses disposable e-mail domains.
E-mail verification is a soft gate: you are signed in right after signup, and a banner reminds you until the address is verified. Creating projects, issuing API tokens, inviting teammates and billing changes wait for it. Verify with the 6-digit code from the mail, typed on the verification page, or with the link in it. Codes and links expire after 48 hours; request a new one from the verification page or Settings → Account.
Teammates join through invitations from Settings → Team
(Team); accepting one creates their account. A deployment
of the hosted edition can also close self-service signup
(SIGNUP_MODE=invite on the accounts service), in which case the register
page says so and every account arrives through an invitation.
Signing in. app.iforevents.com/login. Sessions are httpOnly cookies renewed automatically; changing your password signs you out everywhere.