Authentication

Presenton uses one admin account per self-hosted instance. The stored password is hashed, and authentication state is kept in /app_data/userConfig.json.

Create the admin account

Preseed credentials on first boot. The password must contain at least six characters; use a substantially longer password for any shared or remote deployment.

docker run -it --name presenton \
  --publish 5001:80 \
  --env AUTH_USERNAME=admin \
  --env AUTH_PASSWORD=replace-with-a-long-password \
  --volume "./app_data:/app_data" \
  ghcr.io/presenton/presenton:v0.9.0-beta

Or place them in a protected .env file for Compose:

AUTH_USERNAME=admin
AUTH_PASSWORD=replace-with-a-long-password

If an account already exists, the startup values are ignored unless you explicitly enable credential override.

How each interface authenticates

Interface	Authentication
Browser UI	Admin sign-in session
`/api/v1/*`	HTTP Basic with the admin username and password
`/api/v1/auth/*`	Authentication endpoints are exempt from API Basic auth
`/mcp`	Bearer session token when authentication is configured

REST API example

curl --request GET \
  --url http://localhost:5001/api/v1/ppt/presentation/all \
  --user "$PRESENTON_USERNAME:$PRESENTON_PASSWORD"

MCP token example

curl --request POST \
  --url http://localhost:5001/api/v1/auth/login \
  --header 'Content-Type: application/json' \
  --data '{"username":"admin","password":"YOUR_PASSWORD"}'

Use the returned access_token as Authorization: Bearer YOUR_ACCESS_TOKEN on MCP requests.

Rotate credentials

Set the new username and password together with AUTH_OVERRIDE_FROM_ENV=true, replace the container, and then remove the override setting.

docker stop presenton
docker rm presenton

docker run -it --name presenton \
  --publish 5001:80 \
  --env AUTH_USERNAME=admin \
  --env AUTH_PASSWORD=replace-with-a-new-long-password \
  --env AUTH_OVERRIDE_FROM_ENV=true \
  --volume "./app_data:/app_data" \
  ghcr.io/presenton/presenton:v0.9.0-beta

Credential override rotates the session signing secret and invalidates existing browser sessions and MCP bearer tokens. Remove AUTH_OVERRIDE_FROM_ENV after the one-time rotation so every restart does not rotate sessions again.

Recover access

For one boot, start the instance with RESET_AUTH=true. Then stop the instance, unset the variable, and start it again with new credentials.

docker stop presenton
docker rm presenton

docker run -it --name presenton \
  --publish 5001:80 \
  --env RESET_AUTH=true \
  --volume "./app_data:/app_data" \
  ghcr.io/presenton/presenton:v0.9.0-beta

As a manual recovery path, stop Presenton, back up ./app_data/userConfig.json, then remove AUTH_USERNAME, AUTH_PASSWORD_HASH, and AUTH_SECRET_KEY from that file before restarting. Prefer RESET_AUTH when possible.

Production safeguards

Terminate HTTPS at a reverse proxy or load balancer.
Keep the instance off the public internet unless remote access is required.
Store passwords in a secret manager rather than command history.
Limit filesystem access to /app_data and its backups.
Rotate credentials after suspected exposure.
Issue a new MCP token after credential rotation.

Connect an MCP client

Obtain a bearer token and configure compatible local or remote MCP clients.

Get started

Learn the basics

Features

Tutorials

API guides

Deploy and configure

Develop and contribute

This release

Create the admin account

How each interface authenticates

REST API example

MCP token example

Rotate credentials

Recover access

Production safeguards

Connect an MCP client

​Create the admin account

​How each interface authenticates

​REST API example

​MCP token example

​Rotate credentials

​Recover access

​Production safeguards

Connect an MCP client

Create the admin account

How each interface authenticates

REST API example

MCP token example

Rotate credentials

Recover access

Production safeguards