Users, roles and permissions

Create and edit FeatherPanel users, ban accounts, find alt accounts, send SSO login links, and build roles from permission nodes.

Users

Admin area, Users lists every account with its role, status, sign-in type (Local, LDAP or OIDC/SSO), 2FA and Discord badges, and when it was last seen. Filter by role, status (active or banned), email verification or IP, and sort by creation date, activity, username or email.

Create User needs a username (3 to 32 letters, numbers or underscores), first and last name, email and a password of at least 8 characters. The email domain is checked against blocked email domains.

Editing a user

The edit page has these sections:

• User Details. Name, email, role, WebSpace limit, external ID for integrations, and a new password (leave blank to keep the current one).
• Account Information. User ID, UUID, first and last IP, linked Discord account. Ban IP blocks new registrations from the user’s IP.
• Actions. Ban or unban, disable 2FA, unlink Discord.
• Single Sign-On. Generate SSO Link creates a login link for this user. It lasts 5 minutes by default (app_sso_token_lifetime_minutes, 1 to 1440) and lands on app_sso_redirect_path.
• Direct Email. Send an HTML email to the user. Sent mail appears under Mails, where failed mail can be resent.
• Servers, VDS, Activities for this user.
• Potential Alts. Other accounts that share IP addresses or browser sync IDs with this one, with a confidence score. Matches are a hint, not proof.

Force verify email, on the user list, marks the address verified so the user can log in without the link.

Banning

Banning needs a reason for staff, and the user is notified by email. The panel also stops and suspends every WebSpace the user owns. Unbanning restores access and sends an email.

Alt detection

The panel records browser fingerprints and IPs. Clear device fingerprints on a user lets them register again from the same device. On the user list, Clear all device fingerprints and Reset alt detection for all users wipe that data for everyone. A reset also ignores all IP evidence recorded before it. Activity logs are kept.

Deleting

A user who owns servers, VDS instances or WebSpaces, or has an active subscription, cannot be deleted (HTTP 409).

Roles

Admin area, Roles. A role has a display name, an internal name generated from it, an optional badge label and icon (JPG, PNG, GIF or WebP up to 5 MB) and a color. Save the role first, then open the Permissions tab to grant permission nodes. The tab groups them by category, with Enable all and Disable all per category and a search box. Duplicate copies an existing role.

admin.root grants everything. It shows as Locked on your own role so you cannot take it away from yourself.

Built-in roles: Admin (1), Moderator (2), User (3) and Banned (4). They can be edited but not deleted. Every permission node is listed in the permission reference.

API keys

Admin area, API Keys opens the same API client manager as the account page (/api/user/api-clients): the keys belong to your account and act with your permissions. See API authentication.

API