Accounts and access

The first-run page creates the customer's owner administrator. There is no default account. Manage staff accounts in Settings → Access. Selecting your name at the bottom of the side rail opens the same page; the Sign out button sits beside it. In a short browser window the rail's page links scroll on their own, so your name and Sign out stay on screen. Operators and viewers see only Notifications and Access in Settings.

Role	Normal responsibilities
Administrator	Configure the recorder; all cameras and footage export
Operator	Daily operation, wall arrangements, action buttons, PTZ, deterrence outputs (a light, siren, or relay), talking through a camera's speaker, and playing saved spoken messages on granted cameras
Viewer	View granted cameras, events, and recordings

New Operators and Viewers start with no camera grants and no export permission. Under Camera access and footage export, grant individual cameras or all current and future cameras, and choose export separately. Saving permission changes signs the account out on every device. A session that ends while a page is open, through sign-out elsewhere, expiry, or a permission change, returns the page to the sign-in screen with a note; sign in again to continue where you were.

Camera access allows review pulls of up to 120 seconds per request. Longer pulls and downloads require export permission and are audited. Recorded-frame access older than the review window also needs export permission. Timeline playback stays inside the review window for every account, administrators included, so only the Save dialog and the API's longer pulls appear as exports.

An account's email address and phone number (international form, such as +15551234567) are where notification rules reach that person; clearing one turns that channel off for them. People can edit their own under Settings → Notifications. A username is 1 to 80 characters of letters from any alphabet, digits, punctuation, and single spaces; it cannot begin or end with a space or contain control characters or line breaks. Passwords need at least eight characters. Changing your password, an administrator resetting it, or changing an account's role signs that account out on every device. Deleting an account keeps its history, and at least one administrator must remain. Every account change is on the History page.

Two-step sign-in

Each account can enable Two-step sign-in with an authenticator. Scan the displayed QR code with the authenticator app, or enter the setup key by hand. Then confirm a current code and save the ten single-use recovery codes, which are shown only once. Keep the recorder and phone clocks synchronized; codes are SHA1, six digits, thirty seconds, and setup expires after ten minutes. Disabling two-step sign-in or replacing recovery codes needs your password and an unused authenticator or recovery code. Each recovery code works once, alongside your password.

A permanent owner can reset another account's second factor without changing its role or camera grants: use it when someone has lost their authenticator. They are signed out everywhere and enroll a new authenticator after signing in with their password. An owner who loses access needs the offline owner recovery procedure.

Repeated wrong passwords pause sign-in for an account or for the address the attempts came from. A lockout expires on its own; owners can review Sign-in lockouts and clear one so that account or address can try again at once. Use separate accounts so history identifies each operator.

Temporary installer access

The owner chooses Installer access and customer handoff → Authorize temporary access, supplies a unique username, password, work description, and duration of 1–168 hours, and confirms with their own credentials.

Installer access expires at the original deadline. It cannot be extended or converted into a permanent account. Installers can configure the recorder but cannot create permanent accounts, change staff permissions, grant installer access, accept their own handoff, or choose the nightly backup folder.

When the work is complete, the owner reviews coverage, recording, retention, notification recipients, and webhook destinations, then accepts the handoff or revokes access. Restoring a backup also ends temporary installer grants.

Accepting confirms that you control the customer account and have reviewed the installer's work, and signs the installer out everywhere. Authorization and acceptance notes are kept permanently. Any change the installer made that decides where site data can go — the backup folder, network shares, notification delivery, the MQTT broker, the published address — is added to the handoff record when it is saved, with where backups are written now.

Integration credentials

API tokens represent an existing permanent account and inherit its permissions. A permanent owner administrator creates and revokes them in Settings → API tokens; a temporary installer cannot, and neither can another token: minting and revoking need a signed-in browser session. A camera with privacy masks refuses its live video socket to tokens, which use the masked stream.mjpg and frame.jpg routes instead. Use a read-only token when the integration does not need writes, and choose the least account that will do: a viewer granted only the cameras the other system needs, an operator only if it must move a camera, switch its light or siren, play a saved message, or press a button. Talking live through a camera's speaker needs a person in a signed-in browser; a token cannot open it. Give temporary work, such as a commissioning laptop or a trial integration, an expiry so it stops on its own. See HTTP API.