Users, roles and sign-up

3 levels of role: platform, organization, team
open is the default SIGNUP_MODE
7 days default invitation lifetime
404 /admin for everyone until ADMIN_IP_ALLOWLIST is set

Three levels of role

Level	Roles	Who holds it	What it can do
Platform (System admin)	`user`, `admin`	The people who run the server	Open `/admin` and `/api/admin/*`: create users, change a user’s role or reset a password, view stats and user lists. Can also grant extra platform roles such as `feedback_manager`.
Organization (Org owner, Org admin, Member)	`owner`, `admin`, `member`	Anyone in an org	Org owners and Org admins change the org’s policies, sign-in methods and transcription provider, and invite people to the org. Members read.
Team (Team lead, Member)	`lead`, `member`	Anyone on a team	A Team lead invites people to the team, edits the team’s suggestion rules, and (with an Org owner or Org admin) turns on keep-the-call-recorded.

A System admin is not automatically an Org owner or Org admin, and the reverse is also true. System admin is about running the server; org roles are about one organization’s data and rules.

The first System admin

firstboot.sh ends by printing a setup link, https://<your-host>/setup?token=… (the token is also SETUP_TOKEN in .env). Open it and sign up. Until the first team exists, sign-up needs the token, and every account made with it becomes a System admin. Once the first team exists the token is inert.

Prefer to skip the browser? Set BOOTSTRAP_ADMIN_EMAIL. On boot, only if the server has no System admin yet, the server creates that account with a generated password and prints it once, to the server log:

docker compose logs server | grep -A3 'first platform admin created'

A restart finds a System admin and prints nothing. If that email already has an account, the server does not promote it, because it cannot tell who registered the address. It logs the exact command to run from the box’s shell instead.

Opening `/admin`

ADMIN_IP_ALLOWLIST is a comma-separated list of IPs and IPv4 CIDRs allowed to reach /admin and /api/admin/*. It fails closed: unset, the System admin pages answer 404 to everyone, and the server logs a warning at boot. Blocked requests also get 404, so the System admin pages cannot be told apart from a route that does not exist. Each /admin request logs the address the server saw, which is the value to put in the list.

Being on the list is not enough on its own: you must also be signed in as a System admin.

Who may sign up: `SIGNUP_MODE`

Mode	Behaviour
`open`	Anyone may sign up with an email and password. This is the default.
`sso_only`	Self-service password sign-up is refused. A social sign-in (Slack, and Teams through Microsoft) still creates accounts.
`closed`	Invite-only. A new person needs an invitation sent to their email address. A System admin can also create accounts at `/admin`, which needs `ADMIN_IP_ALLOWLIST`.

An email-bound invitation authorizes creating an account in every mode. A link invitation with no email does not on an sso_only or closed box: it would let one leaked link mint any number of accounts on a locked box, so those invitees sign in through SSO or get an email-bound invite. In closed a first-time SSO sign-in is refused; existing accounts still sign in.

The older DISABLE_SIGNUP=true behaves as closed, and SIGNUP_MODE wins if both are set. Apply a change with docker compose up -d, not deploy.sh, so GoTrue is recreated too. On an SSO-only box also set GOTRUE_DISABLE_SIGNUP=false; see Configuration.

Invitations

Org invitation: an Org owner or Org admin invites an email as admin or member. It expires after 7 days by default.
Team invitation: a Team lead invites as lead or member, with or without an email. A link addressed to one email lasts 7 days by default; a shareable link with no email lasts 24 hours.
Either can be given a different lifetime of 1 to 720 hours.
Without RESEND_API_KEY the invitation and its link are still created, and the response says the email was not sent. Share the link yourself.
Invitations respect the org’s sign-in methods: someone who can only sign in a way the org turned off cannot join.

Single sign-on

To let people sign in with Slack or Microsoft, add the provider to SOCIAL_PROVIDERS and supply its credentials. Set SIGNUP_MODE=sso_only if sign-in through the provider should be the only way in.

Slack (OIDC): provider id slack_oidc. See Your own Slack app.
Microsoft (Azure / Entra): provider id azure. Pin it to your tenant with AZURE_TENANT: left unset, any Microsoft account can sign in. See Microsoft.

The per-org switch in Sign-in and channels (off for every new link) lets everyone from the same Slack workspace or Entra tenant join the first person’s org without an invitation.