First admin and the admin panel
How the first platform admin is created (there are no default credentials), what each admin screen does, roles inside a workspace, and how customers get in.
7 min readUpdated Oct 17, 2026Applies to Adcraft 1.0.0
On this page
Adcraft ships with no default credentials and no setup wizard. There are no passwords at all: people sign in with an emailed magic link or with Google. Nobody is a platform admin until their address is listed in ADMIN_EMAILS.
Creating the first admin
1. Make sure someone can sign in
In production, sign-in needs at least one of:
- Resend (
RESEND_API_KEY, withEMAIL_FROMon a domain verified in Resend) for magic links, or - Google (
AUTH_GOOGLE_IDandAUTH_GOOGLE_SECRET).
With neither, the sign-in page shows "No sign-in method is configured" and nobody can get in. The development sign-in box, which signs you in with any address and no email, is never available when NODE_ENV is production, and the Docker image always runs in production mode.
2. Name the address
Set ADMIN_EMAILS in the environment and restart. It takes a comma-separated list:
ADMIN_EMAILS=you@example.com,partner@example.com3. Sign in with that address
Open /sign-in and sign in with the address. You become a platform admin on that sign-in. The list is also checked on every request, so someone already signed in is promoted as soon as the app has restarted with their address added, without signing out. Open /admin.
ADMIN_EMAILS is authoritative:
- A listed address is an admin on every request. Admin → Users refuses to revoke it and says to remove it from
ADMIN_EMAILSinstead. - Removing an address demotes that user on their next request after the restart, unless the next point applies. The demotion is written to the audit log.
- Admins granted in the panel are kept. A user made admin with Make admin under Admin → Users stays an admin without being listed, until another admin revokes them.
Important
"Granted in the panel" means the latest grant or revoke for that user in the audit log is a grant from Admin → Users. An admin flag set any other way, for example by the list before you removed the address or by editing the database, is removed on the user's next request unless the address is listed. To keep someone as an admin without listing them, remove the address, restart, and grant it again with Make admin once the flag has gone.
More admins
Any platform admin can promote or demote other users under Admin → Users with Make admin and Revoke admin. You cannot change your own flag, and you cannot revoke an address listed in ADMIN_EMAILS. There is a single admin level: every platform admin can use every admin screen.
The admin screens
Every admin action is written to the audit log.
| Screen | Path | What it is for |
|---|---|---|
| Overview | /admin |
Sign-ups, active workspaces, creatives per day, generation cost, an estimated gross margin, failure rate, queue depth, provider health and recent failures |
| Organisations | /admin/orgs |
Search workspaces; see plan, members, credits, activity, suspension and deletion requests. Open one for the actions below. |
| Users | /admin/users |
Search users, see their workspaces and roles, make or revoke platform admins |
| Generations & costs | /admin/generations |
Every AI call with provider, model, status, credits and estimated cost; filter by provider, model, status, workspace and date; retry failed jobs or mark stuck ones failed |
| Models & pricing | /admin/models |
Add, edit, enable, disable, set default and test AI models, and set their credit prices. See AI models and providers. |
| Providers | /admin/providers |
Read-only: which integrations have their keys set, which are missing, and successes and failures in the last 24 hours |
| Billing | /admin/billing |
Read-only: subscriptions with Stripe links, plan distribution, top-ups and an MRR figure based on plan list prices |
| Campaigns | /admin/campaigns |
Read-only: every connected ad account (sandbox or live, token expiry) and campaign across all workspaces |
| Errors | /admin/errors |
Unhandled server errors with route, message and stack, repeats collapsed, kept for 14 days |
| Settings & flags | /admin/settings |
Maintenance banner, sign-ups on or off, trial credits, plan feature switches and guardrail defaults |
| Audit log | /admin/audit |
Every admin and workspace action, filterable by scope, action, workspace and actor |
Working on one workspace
Admin → Organisations → (a workspace) has tabs for overview, members, credits, brands and products, generation events, ad accounts and campaigns, and internal notes. From there an admin can:
- Adjust credits by any positive or negative whole number, with a reason.
- Change plan to Starter, Studio or Agency, optionally adding that plan's credits. This does not change anything in Stripe; see Selling it as SaaS.
- Suspend or reinstate the workspace. Members of a suspended workspace see a "suspended" page when they open the app, with your
SUPPORT_EMAILas the contact, and the workspace's API keys are refused with401. Nothing is deleted. - View as support. Opens the workspace with the viewer role, a banner reading "Viewing (workspace) as support (viewer access)" and an Exit button, so you can see what the customer sees.
- Remove a member and add internal notes.
- Retry a failed generation.
Warning
View as support is not fully read-only. Every owner and editor check (billing, team, API keys, privacy, publishing, static ads, share links and templates) refuses it, but some actions do not check the viewer role yet: parts of videos, briefs, characters, the product library and brands, the onboarding product import, and comments. Those still change the customer's workspace if you use them. It also works on suspended workspaces. Make changes through the admin actions on this page instead, which are audited.
Platform settings
| Setting | Default | What it does |
|---|---|---|
| Maintenance banner | Empty | Shown at the top of every workspace page while it is not empty (up to 300 characters). Not shown on the admin, marketing or sign-in pages. |
| Sign-ups | On | When off, new users can still sign in but cannot create a workspace. Invitations to existing workspaces still work. |
| Trial credits | 10 | Credits given to every new workspace |
| Plan features | All on | Product video, UGC presenter video and publishing, per plan. See Plan feature switches. |
| Guardrail defaults | See Guardrails | Monthly provider cost cap, spend approval threshold, HeyGen voice slots and the generation rate limit |
Note
The welcome screen says "Starts with 10 free credits" whatever you set as trial credits. If you change the amount, also change the text in apps/app/src/app/(auth)/welcome/page.tsx.
Not in this version
- No deleting a workspace from the admin panel. Deletion requests are recorded and must be carried out by hand; see Workspace deletion requests.
- Last sign-in is not tracked, because sessions are stateless tokens.
- No password reset or impersonation by email address. There are no passwords; use View as support.
Roles inside a workspace
Every workspace member has one of three roles:
| Owner | Editor | Viewer | |
|---|---|---|---|
| View work, comment | Yes | Yes | Yes |
| Create briefs and brands | Yes | Yes | Not blocked in 1.0.0 |
| Create and edit static ads and characters | Yes | Yes | No |
| Create videos and library products | Yes | Yes | Not blocked in 1.0.0 |
| Request and give approvals, share links, templates | Yes | Yes | No |
| Connect ad accounts, build and publish campaigns | Yes | Yes | No |
| Publish active above the spend threshold | Yes | No (paused only) | No |
| Buy a plan or a top-up, open the billing portal, rename the workspace | Yes | No | No |
| Team, API keys, webhooks, guardrails, audit log, deletion request | Yes | No | No |
The person who creates a workspace is its owner. A workspace cannot lose its last owner from the team screen.
Inviting a team
Owners invite people under Settings → Team with a role. With Resend configured the invitation is emailed; otherwise (or if sending fails) the owner gets a link to copy and send. Invitations expire after 7 days, and the person must sign in with the invited address to accept.
How customers get in
- There is no separate sign-up form. Anyone who can sign in (magic link or Google) and has no workspace is taken to /welcome, which creates a workspace and a first brand, adds the trial credits, and offers to import a first product.
- Turn Sign-ups off under Admin → Settings to stop new workspaces being created.
- The marketing site at
/,/showcaseand/pricing, the legal pages and the client review links (/share/…) are public. Everything else requires sign-in.
Workspace deletion requests
Owners can request deletion under Settings → Privacy by typing the workspace name. This does not delete anything. It records the request (visible as "Deletion requested" in Admin → Organisations), writes it to the audit log and, if Resend is configured, emails your privacy address (PRIVACY_EMAIL, or SUPPORT_EMAIL when that is the only one set) and the requester.
To carry it out, delete the workspace's row in the organizations table (memberships and workspace data are removed with it) and the workspace's org/<id>/ folder in file storage.
Important
Set PRIVACY_EMAIL (or SUPPORT_EMAIL) to your own address. With neither, deletion request emails go to the placeholder privacy@example.com. The wording of the privacy, terms and DPA pages is still in apps/app/src/lib/legal.ts; rewrite it for your business.