Skip to main content
Presenton supports multiple accounts with a private workspace for each user. The first account becomes the primary administrator and can create, reset, or remove other accounts from Admin → Users.

​
Set up the primary administrator

On a new installation, open Presenton and follow the account setup screen. For an unattended deployment, preseed the primary administrator on first boot. Usernames must contain at least three characters and new passwords must contain at least eight characters.
Or place them in a protected .env file for Compose:
If an account already exists, the startup values are ignored unless you explicitly enable credential override.

​
Manage users

The primary administrator can open Admin → Users to create users, reset their passwords, or remove their access. Each user receives a private workspace for presentations, templates, tasks, and uploaded assets. Existing single-user installations migrate automatically. The existing account becomes the primary administrator while its owned data remains attached to the same account.

​
How each interface authenticates

​
Create an API key

The primary administrator opens Admin → API keys, selects Generate key, and copies the new sk-presenton-... value. The key is shown only when it is created. Send the key as a bearer token for REST API or MCP requests:
API keys cannot sign in to the browser UI. Revoking a key from the admin panel takes effect immediately.

​
Rotate credentials

Set the new username and password together with AUTH_OVERRIDE_FROM_ENV=true, replace the container, and then remove the override setting. Rotation preserves the administrator’s user ID and owned data.
Credential override invalidates existing browser sessions and API keys. Remove AUTH_OVERRIDE_FROM_ENV after the one-time rotation so every restart does not repeat the operation.

​
Recover access

For one boot, start the instance with RESET_AUTH=true and supply the primary administrator’s new username and password. Then stop the instance, remove the recovery variables, and start it normally.
Do not manually remove authentication fields from /app_data/userConfig.json. Use the recovery variables so the database account and its ownership links remain intact.

​
Production safeguards

  • Terminate HTTPS at a reverse proxy or load balancer.
  • Keep the instance off the public internet unless remote access is required.
  • Store passwords in a secret manager rather than command history.
  • Limit filesystem access to /app_data and its backups.
  • Revoke API keys after suspected exposure.
  • Generate separate API keys for clients that need independent revocation.

Connect an MCP client

Generate an API key and configure compatible local or remote MCP clients.