Users & Access

Roles

Access is role-based:

Role	Scope
Admin	Full access to everything, including settings and user management
Operator	Per group: view live/archive, export clips and screenshots, control PTZ, toggle recording, acknowledge events, manage maps, and add or remove Viewers in their groups
Viewer	Per group: view live/archive and browse events, clips, and screenshots for their groups’ cameras

Operator and Viewer are granted per group (see Groups), so you can give a user access to just the cameras they need. The UI hides controls a user lacks permission for, so users never see buttons they cannot use.

Manage users

Under Settings → Users an admin can invite users, assign roles, and activate or deactivate accounts. The first admin account is created automatically at install time with the credentials the installer prints.

Deactivating a user or changing their role signs that user out of all their sessions immediately. Any change to a user’s password — self-service or through a reset link — does the same.

Inviting a user and resetting a password both produce a one-time link for the admin to copy and share with the person directly — Vision does not email credentials. The recipient opens the link to set their own password. Links expire after 7 days, and deactivating an account invalidates its outstanding links. Consuming a link is recorded in the audit log.

Your profile & password

Any signed-in user can change their own password from the Profile menu (top of the sidebar) — enter your current password and a new one (minimum 8 characters). No admin involvement is needed. Changing your password signs you out of your other sessions and voids any outstanding reset links for your account.

Recover a forgotten password

Locked out of the admin account with no other active admin to send a reset link? Recover it from the server host — a break-glass path that needs shell access to the machine, not a signed-in session.

The database and config are owned by root/vision, so run it with sudo:

sudo vision reset-password admin@localhost

It prints a one-time reset link — never a password — and immediately signs that account out of every session:

Password reset link for admin@localhost:

  https://your-server/reset-password?token=…

Expires: 2026-07-28T12:00:00Z (7 days)
Existing sessions for this user were signed out.

Open the link in a browser to set a new password. It expires after 7 days. The account must be active — re-activate a deactivated user first. No password is ever typed, generated, or printed, and the action is recorded in the audit log.

Note

The command reads the live database, so you don’t need to stop the service. It looks for config.yaml in the working directory, then /etc/vision/. Add --config or --db for non-default paths, and --url https://your-host to set the link’s host when it isn’t already in http.allowed_origins.

Sessions

Signing in issues a short-lived access token (default 15 minutes) that the UI renews silently in the background. The session itself lasts up to the refresh lifetime (default 7 days) and is kept in an httpOnly cookie; you are sent to the login page only when the session can no longer be refreshed. Logging out invalidates the session durably — a server restart does not resurrect it. Admins can tune the lifetimes with auth.access_ttl and auth.refresh_ttl — see the configuration reference.

After 5 failed sign-ins for one email, that email is locked for 60 seconds; other accounts are unaffected. Reloading the page never signs you out — if many reloads come from one network at once, the page waits a few seconds instead. Tunable via auth_rate_limit.* — see the configuration reference.

Audit trail

Successful and failed logins, logouts, password changes, reset-link usage, user changes, and other key actions are recorded in the audit log for accountability — see Logs.