Skip to content
CatalystCatalyst Docs

Users

Manage accounts under Admin → Users.

Prerequisites

Section titled “Prerequisites”
  • The user.create permission (or full administrator access) to create accounts.
  • At least one role defined if you want to assign one at creation time.

Create an account

Section titled “Create an account”

You need user.create. Select Create user and fill in the numbered sections of the form:

  1. Account credentials — Email, Username, and Password (at least 8 characters).
  2. Roles & Servers — assign one or more Roles (the chips are multi-select and searchable) and, optionally, direct server access.
  3. Node Access — grant the account scoped access to specific nodes, or skip.
  4. Select Create user.

Edit user reopens the same form with a fourth Security section for the account’s two-factor, passkey, and linked-account state; leaving the password blank keeps the current one. Saving needs user.update; changing roles also needs user.set_roles.

Find and act on users

Section titled “Find and act on users”
  • Search by name, email, or ID, and filter by Role or Status (Active, Banned, Unverified).
  • View details shows the account, its roles, sign-in history, Two-Factor Authentication, Passkeys, and Linked Accounts state. The actions live in Edit user’s Security section: Wipe 2FA, Wipe all passkeys, Enforce or Unenforce 2FA, and Unlink an SSO account.
  • Unverified accounts get a Verify email action on their row and in the row’s overflow menu.
  • Select users to act in bulk: Ban, Unban, Verify Emails, or delete. Banning and deleting are destructive; a user who still owns servers cannot be deleted.

Server sharing between players does not need admin help — owners send invites and add subusers themselves from the server’s Users & Access view.

Admin discipline

Section titled “Admin discipline”
  1. Few admins. Admin rights bypass every limit in the system. Most staff need a scoped role, not admin.
  2. Named accounts only. No shared admin login — shared logins make the audit log useless and revocation impossible.
  3. Offboard promptly. Ban the account when staff leave; sessions are revoked and the account’s API keys stop authenticating.
  4. Strong auth. Enforce strong passwords and enable the MFA/SSO options in security.

When users cannot log in

Section titled “When users cannot log in”
  1. Confirm the account exists and is not banned; check Status in Admin → Users.
  2. Set a new password by editing the user (leave the password blank to keep the current one), or Verify email from the user’s row if the address is unverified.
  3. Check mail delivery if invites or resets never arrive (see panel issues).
  4. In Admin → Audit Logs, filter the action login_failed (shown as Sign-in failed) or the resource type auth_lockout (Login lockout) before resetting anything.
Section titled “Related”