User Management

Manage users in your Deckyard instance.

Overview

Administrators can add new users, manage roles, and control access to the platform. Users live in the database, and managing them requires admin privileges.

Adding Users

Via Admin Panel

1. Navigate to Admin > Users
2. Click Add User
3. Enter the user’s email address
4. Optionally enter their display name
5. Select a role (User or Admin)
6. Click Create

The user receives an invitation email with a link to set up their account.

Via API

POST /api/admin/users
Content-Type: application/json
Authorization: Bearer <admin-token>

{
  "email": "newuser@example.com",
  "name": "New User",
  "role": "user",
  "sendInvitation": true
}

Rate limit: 20 user creations per admin per hour.

User Roles

Deckyard has two user roles:

User Role

Standard users can:

• Create and manage their own presentations
• Collaborate on presentations shared with them
• Access the image library
• Use all editor features

Admin Role

Admins have all user permissions plus:

• Access to user management
• Access to instance settings
• View and configure webhooks
• Manage email templates
• Access analytics dashboards

Assigning Admin Role

A user becomes an admin if:

1. Their email matches AUTH_ADMIN_EMAIL environment variable
2. They are explicitly assigned the admin role via the admin panel
3. They sign in with SSO and belong to one of the groups in OIDC_ADMIN_GROUPS (see Authentication)

Invite Flows

Initial Invitation

When you create a new user:

1. A user record is created without a password
2. An invitation token is generated (valid for 7 days)
3. An invitation email is sent with a setup link
4. User clicks the link and sets their password
5. Account is activated

Resending Invitations

If a user hasn’t activated their account:

1. Go to Admin > Users
2. Find the user
3. Click Resend Invitation

A new invitation token is generated and an activation reminder email is sent.

Magic Link Login

Magic links let existing users sign in without a password; they do not create accounts. A link is only sent to an email address that already has a user, so add the user here first. See Magic Link Authentication.

Password Resets

User-Initiated Reset

Users can reset their own passwords:

1. Click “Forgot password” on the login page
2. Enter their email address
3. Receive a reset link via email
4. Click the link and set a new password

Admin-Initiated Reset

Admins can trigger a password reset:

1. Go to Admin > Users
2. Find the user
3. Click Reset Password
4. User receives an email with reset instructions

Password resets:

• Invalidate all existing sessions for that user
• Generate a time-limited reset token
• Are rate-limited (3 per email per hour, 10 per IP per hour)

Removing Users

Deleting a User

1. Go to Admin > Users
2. Find the user
3. Click Delete
4. Confirm the deletion

Important:

• Admins cannot delete their own account
• Deleting a user removes their login credentials
• Presentations owned by the user are not automatically deleted
• Consider transferring ownership of presentations before deletion

Via API

DELETE /api/admin/users/{userId}
Authorization: Bearer <admin-token>

User Status

Users can have different statuses:

Status	Description
Active	User can log in normally
Pending	Invitation sent, waiting for setup
Inactive	Account disabled (future feature)

Viewing User Details

The user list shows:

• Email address
• Display name
• Role (User/Admin)
• Status
• Created date
• Last login (if available)

Click on a user to see detailed information including:

• Account creation details
• Invitation status
• Authentication source

Audit Logging

User management actions are logged:

• User creation (who created, when)
• User deletion (who deleted, when)
• Role changes
• Password resets

Logs include IP addresses and user agents for security auditing.

Related

• Authentication
• Sharing & Permissions
• Email Configuration