Admin sign-in

The dashboard has one admin account protected by a password. There are no usernames.

Setting the password

Open the dashboard after deploying and choose a password of at least 8 characters. You are signed in straight away.

Until the password is set, anyone who opens the dashboard could set it first. Set a SETUP_TOKEN secret before deploying, and finish setup right after, so that nobody else can.

How it is protected

  • The password is hashed with PBKDF2-SHA256, a random salt and 100,000 iterations, and stored in the settings table. The plain password is never stored.
  • Sign-in sets an HttpOnly, SameSite=Lax cookie signed with HMAC, valid for 14 days, and marked Secure over HTTPS.
  • After five failed attempts from one IP, sign-in locks for an increasing time.
  • Changing the password signs out every other browser, within about 10 seconds.
  • Actions that change data only accept same-origin JSON requests.

What is public

Only the collector endpoint /api/ingest, /recorder.js, the sign-in page and the demo shop. The session list, replays and every session API require sign-in.

Forgot the password

Delete the admin row and open the dashboard to set a new one. On D1:

npx wrangler d1 execute replayowl --remote \
  --command "DELETE FROM settings WHERE key = 'admin'"

On Postgres, run DELETE FROM settings WHERE key = 'admin'.