Admin panel

Users & accounts

Managing every account on the server — provisioning, invites, disabling and server bans.

Admin only

The Users page of the admin panel lists every account on the server, searchable and sortable.

Creating accounts

Three doors into the server:

Open registration — users sign up themselves when registrationEnabled is on.
Direct creation — an admin creates the account and sets a password.
Provisioning with invite mail — an admin creates the account and the user receives an email to set their own password (needs SMTP configured).

Acting on accounts

From a user’s row/drawer:

Disable — blocks login without touching content; reversible.
Server ban — the app-wide top of the moderation ladder; refused at login, liftable by admins only.
Role — grant or revoke the global admin role.
Disable 2FA — shown once the account has two-factor authentication turned on; deletes their secret and recovery codes so they can sign in with just their password and re-enroll. Audit-logged.

Note

Account deletion is user-initiated (with a grace period) — admins disable or ban; they don’t erase someone’s identity on their behalf.

Rescuing a locked-out sole admin

The admin-panel action above needs another admin to click it — if the account that’s locked out of 2FA is itself the only admin, disable it from the server console instead:

docker compose exec app bin/console tyto:user:reset-2fa admin@example.com

Also audit-logged. See Troubleshooting for the full recovery-code-first path.