Guides

Manage users & access

Astrodock has two completely separate kinds of accounts. This page explains the difference, then walks through creating an app user, granting them access to an app, resetting a password, and the self-service page where users manage their own login.

Two kinds of accounts

It's worth getting this straight up front, because it's the thing people trip over most.

Account typeWho they areWhere they live
Admins You and anyone who helps run the platform. They log into the dashboard to create apps, deploy, and manage everything. The admin login (admin.<your-domain>).
App end-users The people who log into the apps you deploy. They never see the dashboard. The dashboard's Users page (you manage them; they log into the apps).

Your admin login is not an app account

Being an admin doesn't automatically let you log into a deployed app. App login uses the end-user accounts below — even your own. (An end-user can be flagged as an admin too, but those are still two separate ideas.)

How app login works

When an app uses platform login (its app.json has auth.mode: platform), Astrodock handles the password checking for it. The flow is simple:

  1. A user types their email and password into your app's login form.
  2. Your app's server forwards those, plus its own app id and secret, to the platform's /verify endpoint.
  3. The platform checks the password and that the user has been granted access to that specific app. It replies with the user's id, email, and name — or a rejection.
  4. Your app creates its own session and lets them in.

So there are two gates: the password must be right, and the user must be on the app's access list. Miss either and login is refused.

Where the app id and secret come from

You don't manage these by hand. The app's id is its slug, and its secret is minted when you run astrodock apply. The starter app reads both from its environment automatically — see App structure & app.json.

Create an app user

  1. Open the Users page

    In the dashboard, go to Users, then click New user.

  2. Fill in their details

    Enter a name, an email, and an initial password (at least 8 characters). The email is what they'll log in with — it's stored lower-cased, so capitalisation doesn't matter.

  3. Save

    The user now exists on the platform — but they still can't log into anything yet. That's the next step.

Grant access to an app

A brand-new user has access to nothing. You grant access per app, by the app's slug, so the same person can be allowed into one app and kept out of another.

  1. Open the user

    On the Users page, click the user you want to edit.

  2. Grant access to the app

    In their app access list, turn on the app you want them to use (it's listed by slug). That's the access check the /verify flow looks for.

Revoking access

To remove someone, open the user and turn the app back off. They'll be refused at the next login. Revoking access doesn't delete the account, so you can grant it again later without re-creating them.

Reset a password

If a user is locked out, you can set a new password for them from the dashboard — you never need to know their old one.

  1. Open the user

    Find them on the Users page and open their record.

  2. Reset the password

    Click Reset password and enter a new one (at least 8 characters). Share it with them over a safe channel and ask them to change it.

Active and admin flags

Each user has two switches you can toggle when editing them:

The self-service /account page

Users don't have to come to you for everything. Astrodock hosts a small /account page where an end-user can change their own password after signing in. Point users there (for example, link to it from your app) so routine password changes don't land on your desk.

Good first-login habit

When you hand someone a password you set, ask them to visit /account and change it to something only they know.

What about "public" apps?

Everything above applies only to apps with auth.mode: platform. Apps with auth.mode: public do not use the Users page at all — Astrodock doesn't gate them. A public app handles its own login (or has none), so creating users and granting access has no effect on it.

Public means open

A public app is reachable by anyone who knows the URL unless the app itself adds protection. Choose platform auth if you want Astrodock to control who gets in.

Next steps