> ## Documentation Index
> Fetch the complete documentation index at: https://docs.presenton.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Configure multi-user access, administrator recovery, and API keys for the browser, REST API, and MCP server.

Presenton supports multiple accounts with a private workspace for each user. The first account becomes the primary administrator and can create, reset, or remove other accounts from **Admin → Users**.

## Set up the primary administrator

On a new installation, open Presenton and follow the account setup screen. For an unattended deployment, preseed the primary administrator on first boot. Usernames must contain at least three characters and new passwords must contain at least eight characters.

```bash theme={null}
docker run -it --name presenton \
  --publish 5001:80 \
  --env AUTH_USERNAME=admin \
  --env AUTH_PASSWORD=replace-with-a-long-password \
  --volume "./app_data:/app_data" \
  ghcr.io/presenton/presenton:v0.9.3-beta
```

Or place them in a protected `.env` file for Compose:

```dotenv theme={null}
AUTH_USERNAME=admin
AUTH_PASSWORD=replace-with-a-long-password
```

If an account already exists, the startup values are ignored unless you explicitly enable credential override.

## Manage users

The primary administrator can open **Admin → Users** to create users, reset their passwords, or remove their access. Each user receives a private workspace for presentations, templates, tasks, and uploaded assets.

Existing single-user installations migrate automatically. The existing account becomes the primary administrator while its owned data remains attached to the same account.

## How each interface authenticates

| Interface            | Authentication                      |
| -------------------- | ----------------------------------- |
| Browser UI           | User sign-in session                |
| `/api/v1/*`          | Admin-generated Presenton API key   |
| `/mcp`               | Admin-generated Presenton API key   |
| Electron desktop app | Authentication and MCP are disabled |

## Create an API key

The primary administrator opens **Admin → API keys**, selects **Generate key**, and copies the new `sk-presenton-...` value. The key is shown only when it is created.

Send the key as a bearer token for REST API or MCP requests:

```bash theme={null}
curl --request GET \
  --url http://localhost:5001/api/v1/ppt/presentation/all \
  --header "Authorization: Bearer $PRESENTON_API_KEY"
```

API keys cannot sign in to the browser UI. Revoking a key from the admin panel takes effect immediately.

## Rotate credentials

Set the new username and password together with `AUTH_OVERRIDE_FROM_ENV=true`, replace the container, and then remove the override setting. Rotation preserves the administrator's user ID and owned data.

```bash theme={null}
docker stop presenton
docker rm presenton

docker run -it --name presenton \
  --publish 5001:80 \
  --env AUTH_USERNAME=admin \
  --env AUTH_PASSWORD=replace-with-a-new-long-password \
  --env AUTH_OVERRIDE_FROM_ENV=true \
  --volume "./app_data:/app_data" \
  ghcr.io/presenton/presenton:v0.9.3-beta
```

<Warning>
  Credential override invalidates existing browser sessions and API keys. Remove `AUTH_OVERRIDE_FROM_ENV` after the one-time rotation so every restart does not repeat the operation.
</Warning>

## Recover access

For one boot, start the instance with `RESET_AUTH=true` and supply the primary administrator's new username and password. Then stop the instance, remove the recovery variables, and start it normally.

```bash theme={null}
docker stop presenton
docker rm presenton

docker run -it --name presenton \
  --publish 5001:80 \
  --env RESET_AUTH=true \
  --env AUTH_USERNAME=admin \
  --env AUTH_PASSWORD=replace-with-a-new-long-password \
  --volume "./app_data:/app_data" \
  ghcr.io/presenton/presenton:v0.9.3-beta
```

<Warning>
  Do not manually remove authentication fields from `/app_data/userConfig.json`. Use the recovery variables so the database account and its ownership links remain intact.
</Warning>

## Production safeguards

* Terminate HTTPS at a reverse proxy or load balancer.
* Keep the instance off the public internet unless remote access is required.
* Store passwords in a secret manager rather than command history.
* Limit filesystem access to `/app_data` and its backups.
* Revoke API keys after suspected exposure.
* Generate separate API keys for clients that need independent revocation.

<Card title="Connect an MCP client" icon="plug" href="/hosting/mcp">
  Generate an API key and configure compatible local or remote MCP clients.
</Card>