# Passwords

Local accounts with an email address and password, and how to turn them off.

Other sign-in methods are [OpenID Connect](https://docs.kogut.dev/sign-in/openid-connect/) and
[forward auth](https://docs.kogut.dev/sign-in/forward-auth/).

## The first account

1. Find the setup token in the server log or `setup-token` in the data directory. See
   [First run](https://docs.kogut.dev/getting-started/first-run/) for log commands.
2. Open the panel and enter the token, your email address, and a password of at least
   12 characters.

The first account is an admin. The 32-character hex token stays the same across restarts
until an account exists, then kogut deletes its file. The file has mode `0600`.

## Add people

As an admin, open **Settings → People** and enter an email address, a [role](https://docs.kogut.dev/sign-in/roles/),
and a password of at least 12 characters. kogut does not email the password; share it
yourself.

For a single sign-on account, leave the password empty. The email must match the
provider's address; OpenID Connect also needs the address to be verified. The panel
cannot change passwords, edit accounts, or remove them.

## Turn passwords off

Configure OpenID Connect or forward auth first, then add:

```toml title="kogut.toml"
[auth]
password = false
```

Password sign-in then returns `403`. Stored passwords remain, so `password = true`
restores access. First-run setup works while no account exists. kogut rejects this
setting when no other sign-in method is configured.

## Check sign-in failures

kogut allows a burst of 10 attempts per client address, then one per second. Unknown
emails and wrong passwords take the same time to reject.

Sessions last 30 days and are not extended by use. See
[API authentication](https://docs.kogut.dev/reference/http-api/#authentication) for cookie and Origin rules.
API clients use bearer tokens instead of sessions.