> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mangrove.dino.icu/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign-in and sessions

> Mangrove has email-and-password accounts, created by an owner.

Mangrove has email-and-password accounts, created by an owner. There's no
public sign-up, no single sign-on, and no password-reset email.

## The first account

On a fresh install, the dashboard's first screen creates the first account, which is always an **owner**. It asks for a single-use **setup token** as well as your email and password; see [Claiming the instance](https://docs.mangrove.dino.icu/start/install.md#claiming-the-instance) for where to find it. `setup.sh` creates the account for you instead. This screen only appears while there are no accounts at all.

## Signing in

Sign in with your email and password. Your session lasts **30 days**, in an
`HttpOnly` cookie (`mangrove_session`). **Log out** at the bottom of the
sidebar ends it.

Sign-in and first-run setup are rate-limited to **5 attempts per 5 minutes
per IP address**. After that, sign-in fails until the window passes.

Serve the dashboard over HTTPS. The cookie isn't marked `Secure`, so over
plain HTTP it can be read in transit. See
[Going to production](https://docs.mangrove.dino.icu/operate/production.md#serve-the-dashboard-over-https).

## Other clients

`mangrovectl`, `mangrove-tui` and `mangrove-mcp` share one session file,
`~/.mangrove/session`. Sign in once with any of them:

```sh theme={null}
mangrovectl login --email you@example.com --password '...'
```

There are no API tokens. Scripts and CI sign in like this and reuse the
session until it expires. See [HTTP API](https://docs.mangrove.dino.icu/interfaces/api.md#authentication).

## Managing sessions (owners)

**Admin → Active sessions** lists every signed-in session on the box. Revoke
one to sign it out immediately: a lost laptop, an old CI login, someone
who's left.

## Forgotten passwords

* **A member** forgot theirs: an owner deletes the account under
  **Admin → Team** and creates it again with a temporary password. The
  person changes it in [Settings](https://docs.mangrove.dino.icu/account/profile.md#change-password). Their
  workspace memberships need adding again.
* **The only owner** forgot theirs: there's no recovery flow. Restore from a
  backup taken while you knew the password, or ask another owner. Keep at
  least two owner accounts, or a password manager entry, for this reason.

## Signing in to protected deployments

A [password-protected deployment](https://docs.mangrove.dino.icu/deploy/protection.md) can also let
people in with their Mangrove account. They're sent to the dashboard to
sign in, then straight back.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.