Server health: checking…
This section appears only when no admin exists. After the first super_admin is created, setup closes for good. The setup token is a Workers Secret (ADMIN_SETUP_TOKEN) — it is never stored in this repo.
Save this now — it is shown only once. Add it to your authenticator app, then log in with the 6-digit code it shows.
Secret:
Authenticator URL:
If an admin created a password reset for you, they will have sent you a token out-of-band (no email is sent by this server yet). Enter it here with a new password (at least 12 characters). Your authenticator code is unchanged.
If you were invited, the inviter will have sent you a token out-of-band. Enter it here with a password (at least 12 characters) to create your account. You will then be shown an authenticator secret once — save it before logging in.
Save this now — it is shown only once. Add it to your authenticator app, then log in with the 6-digit code it shows.
Secret:
Authenticator URL:
Prices are shown in dollars here and stored as integer cents on the server. A slug can never be changed once a plan is created. Archiving (Active off) stops new sales; existing licences run to expiry. Deleting is refused while any licence or promo code uses the plan.
Codes are uppercase. A code can never be changed once created, and its type cannot change after any redemption. Deleting is refused after any redemption — archive (Active off) instead. Only free-days and free-licence can be redeemed through the server today; percent-off and fixed-off need a Freemius checkout, so they can be created now but their redemption waits for the last Freemius step. Redemption itself happens through the desktop Licence card (Step 5) calling POST /api/redeem — not from this page.
Only a super_admin can create or delete a tenant. A tenant with members cannot be deleted — remove its members first. Tenant owners can rename their own tenant; admins cannot. Roles are enforced on the server, not just by hiding buttons here: super_admin (everything), tenant_owner (own tenant: rename, members, templates), tenant_admin (own tenant: members and templates), member (own tenant: templates read-only).
The invite token below is shown only once. Send it to the new super_admin yourself — no email is sent by this server yet.
Pick a tenant above (Members button), then invite, change roles, reset passwords, or remove members here. Only a super_admin can promote to tenant_owner or invite one; an admin cannot change or remove an owner; the only owner of a tenant cannot be demoted or removed.
Publish a release AFTER uploading its installer to R2 with wrangler r2 object put muserouter-updates/<platform>/<file> --file <file>. The feed is /updates/<brand>/<platform>/latest.yml (mac: latest-mac.yml, linux: latest-linux.yml). sha512 must be base64 (88 chars) — the value electron-updater verifies. Deleting a release deletes its feed entry only, never the R2 file. The feed is not a licence check: anyone can download an installer.
Pick a tenant above (Templates button). A pack is metadata only: {"templateName": "...", "project": "...", "profiles": [{"service": "...", "name": "...", "colour": "#2563eb", "url": "https://..."}]}. Any other field is rejected by the server, so a pack can never carry a password, cookie, session or token. Editing a pack bumps its version by one. Members can read packs but cannot create, edit or delete them. Desktop import (fetch a pack, create empty profiles) is not in this step — it needs a member-auth design for the desktop app that is not decided here.
The desktop Licence card is Step 5; tenants, members and template packs are Step 6; the remaining sections follow, one by one.
Freemius mapping (Step 9) is set in the plan form above. Freemius secrets (API token, product secret) are Workers Secrets only and are never entered here. No Freemius call is made from this page.