Authentication

Presenton supports multiple accounts with a private workspace for each user. The first account becomes the primary administrator and can create, reset, or remove other accounts from Admin → Users.

Local accounts control access to this installation. The optional Login with Presenton device flow connects an installation-wide cloud generation provider; it does not replace local sign-in.

Set up the primary administrator

On a new installation, open Presenton and follow the account setup screen. For an unattended deployment, preseed the primary administrator on first boot. Usernames must contain at least three characters and new passwords must contain at least eight characters.

docker run -it --name presenton \
  --publish 5001:80 \
  --env AUTH_USERNAME=admin \
  --env AUTH_PASSWORD=replace-with-a-long-password \
  --volume "./app_data:/app_data" \
  ghcr.io/presenton/presenton:latest

Or place them in a protected .env file for Compose:

AUTH_USERNAME=admin
AUTH_PASSWORD=replace-with-a-long-password

If an account already exists, the startup values are ignored unless you explicitly enable credential override.

Manage users

The primary administrator can open Admin → Users to create users, reset their passwords, or remove their access. Each user receives a private workspace for presentations, templates, tasks, and uploaded assets. Existing single-user installations migrate automatically. The existing account becomes the primary administrator while its owned data remains attached to the same account.

Connect an optional Presenton account

The primary administrator can choose Presenton during provider onboarding or in Settings, copy the displayed device code, and approve it on the hosted Presenton page. The resulting provider connection is shared by the installation and can be replaced or disconnected only by the administrator.

Identity	Purpose	Storage
Local Presenton user	Signs in to the self-hosted browser and owns a private workspace	Local application database and session cookie
Presenton account connection	Authorizes optional cloud-backed generation and document workflows	One encrypted global provider record
Presenton API key	Authenticates REST API and MCP requests	Hashed local API-key record

Connecting the provider does not grant browser access to the self-hosted instance. Disconnecting it revokes the delegated cloud credentials without deleting local users or presentations.

How each interface authenticates

Interface	Authentication
Browser UI	User sign-in session
`/api/v1/*`	Admin-generated Presenton API key
`/mcp`	Admin-generated Presenton API key
Electron desktop app	Authentication and MCP are disabled

Create an API key

The primary administrator opens Admin → API keys, selects Generate key, and copies the new sk-presenton-... value. The key is shown only when it is created. Send the key as a bearer token for REST API or MCP requests:

curl --request GET \
  --url http://localhost:5001/api/v1/ppt/presentation/all \
  --header "Authorization: Bearer $PRESENTON_API_KEY"

API keys cannot sign in to the browser UI. Revoking a key from the admin panel takes effect immediately.

Rotate credentials

Set the new username and password together with AUTH_OVERRIDE_FROM_ENV=true, replace the container, and then remove the override setting. Rotation preserves the administrator’s user ID and owned data.

docker stop presenton

Remove the stopped container:

docker rm presenton

Start it once with credential override enabled:

docker run -it --name presenton \
  --publish 5001:80 \
  --env AUTH_USERNAME=admin \
  --env AUTH_PASSWORD=replace-with-a-new-long-password \
  --env AUTH_OVERRIDE_FROM_ENV=true \
  --volume "./app_data:/app_data" \
  ghcr.io/presenton/presenton:latest

Credential override invalidates existing browser sessions and API keys. Remove AUTH_OVERRIDE_FROM_ENV after the one-time rotation so every restart does not repeat the operation.

Recover access

For one boot, start the instance with RESET_AUTH=true and supply the primary administrator’s new username and password. Then stop the instance, remove the recovery variables, and start it normally.

docker stop presenton

Remove the stopped container:

docker rm presenton

Start it once with recovery enabled:

docker run -it --name presenton \
  --publish 5001:80 \
  --env RESET_AUTH=true \
  --env AUTH_USERNAME=admin \
  --env AUTH_PASSWORD=replace-with-a-new-long-password \
  --volume "./app_data:/app_data" \
  ghcr.io/presenton/presenton:latest

Do not manually remove authentication fields from /app_data/userConfig.json. Use the recovery variables so the database account and its ownership links remain intact.

Connect an MCP client

Generate an API key and configure compatible local or remote MCP clients.

Getting started

Deploy

Configure

Enterprise

Set up the primary administrator

Manage users

Connect an optional Presenton account

How each interface authenticates

Create an API key

Rotate credentials

Recover access

Connect an MCP client

​Set up the primary administrator

​Manage users

​Connect an optional Presenton account

​How each interface authenticates

​Create an API key

​Rotate credentials

​Recover access

Connect an MCP client

Set up the primary administrator

Manage users

Connect an optional Presenton account

How each interface authenticates

Create an API key

Rotate credentials

Recover access