kogutdocs

    Type to search page titles, headings and text.

    Sign-in

    Passwords

    Local accounts with an email address and password, and how to turn them off.

    Other sign-in methods are OpenID Connect and forward auth.

    The first account

    1. Find the setup token in the server log or setup-token in the data directory. See First run for log commands.
    2. Open the panel and enter the token, your email address, and a password of at least 12 characters.

    The first account is an admin. The 32-character hex token stays the same across restarts until an account exists, then kogut deletes its file. The file has mode 0600.

    Add people

    As an admin, open Settings → People and enter an email address, a role, and a password of at least 12 characters. kogut does not email the password; share it yourself.

    For a single sign-on account, leave the password empty. The email must match the provider’s address; OpenID Connect also needs the address to be verified. The panel cannot change passwords, edit accounts, or remove them.

    Turn passwords off

    Configure OpenID Connect or forward auth first, then add:

    kogut.toml
    [auth]
password = false

    Password sign-in then returns 403. Stored passwords remain, so password = true restores access. First-run setup works while no account exists. kogut rejects this setting when no other sign-in method is configured.

    Check sign-in failures

    kogut allows a burst of 10 attempts per client address, then one per second. Unknown emails and wrong passwords take the same time to reject.

    Sessions last 30 days and are not extended by use. See API authentication for cookie and Origin rules. API clients use bearer tokens instead of sessions.