Skip to main content
MonoRelay supports both API key authentication and local user accounts. User accounts allow per-user request logging, role-based access control, and SSO login via GitHub or Google. Admins manage all user accounts from the Users page in the admin dashboard.

​
User roles

MonoRelay has three levels of access: Regular user — Can make API requests and view their own request logs in the dashboard. Cannot access provider configuration, user management, or system settings. Admin — Has full access to the admin dashboard including provider management, all request logs, user list, settings, and config sync. Admins can activate, deactivate, and promote other users. Super admin — Has all admin capabilities plus the ability to reset all system data (statistics, logs, and user records). There is exactly one super admin account per MonoRelay instance. The first user to register on a fresh installation automatically receives super admin status.

​
User fields

Each user account stores the following information:

​
Managing users from the dashboard

Open the Users page from the sidebar. The table lists all registered accounts with their current status and role. You can perform the following actions on any user other than your own account:
  • Activate / deactivate — Click the user icon in the Actions column to toggle is_active. Deactivated users are immediately blocked from logging in and making API requests.
  • Grant / revoke admin — Click the shield icon to toggle is_admin. This gives or removes full dashboard access.
  • Delete — Click the trash icon to permanently delete the account. This action cannot be undone.
Deleting a user is irreversible. Their request log entries remain in the database associated with their former user ID, but the account itself cannot be recovered.

​
First user and super admin

The first account created on a new MonoRelay installation is automatically assigned super admin status. Super admins can reset all system data — including statistics, logs, and all user accounts — from the Settings page. This operation is destructive and cannot be undone.

​
API key vs user account authentication

You can authenticate to the MonoRelay API using either method:
  • API key — Set the Authorization: Bearer <access_key> header using the access_key value from config.yml. This bypasses the user system entirely and is suitable for service-to-service requests.
  • User account — Log in through the dashboard to receive a JWT session token. User account requests are associated with the logged-in user and appear separately in per-user log views.
Both methods are accepted on all API endpoints. User account tokens are scoped to the permissions of that user’s role.