Skip to main content

Admin password

A board's page and API ask for a password, with HTTP Basic auth and the user name admin.

A new board has no password until you set one, either under Admin password on its page or in menuconfig before flashing. Until then anyone on the network can change or reflash it, and its page shows No admin password.

Set or change it​

  • One board: under Admin password on its page, enter New password and Confirm, then choose Set password.
  • Every board: on the matrix, Admin password sets it on every board at once (Set on all devices).

Use the same password on every board: the matrix signs in to the others with the one you used for the board you opened it on.

Passwords can be up to 64 characters, with no control characters.

From scripts, pass it with curl -u admin:PASSWORD, or set it with POST /api/password (password= with an empty value removes it).

What it covers​

The password protects the board's web page and API. It doesn't cover:

  • /stream.sdp, so media players can open an encoder's stream
  • /usbip.sh and /usbip.ps1, the USB/IP host setup scripts
  • the serial server sockets and the USB/IP server: use their allow lists

A web page on another site can't change a board through your browser, even if the browser has its password saved. Boards accept changes from their own pages and those of other boards they have found on the network.

The password is stored as a salted SHA-256 hash. HTTP Basic auth sends it unencrypted (there is no HTTPS), so it keeps out casual visitors and stray web pages, not someone capturing traffic on the network.

Forgotten password​

A forgotten password needs a USB reflash that erases the board, which also resets its settings:

idf.py -p /dev/ttyACM0 erase-flash flash

Boards updated from older firmware​

A board updated over the network from firmware that had no passwords starts out open, or with the menuconfig password if the new build has one.