Webhood uses PocketBase as its authentication backend, which means all user accounts are stored and managed directly within your Webhood deployment. There is no external identity provider to configure — everything you need is inside the Settings → Accounts tab of the Webhood UI.Documentation Index
Fetch the complete documentation index at: https://mintlify.com/webhood-io/webhood/llms.txt
Use this file to discover all available pages before exploring further.
Navigating to the Accounts panel
Click your username or the gear icon in the navigation bar to open Settings, then select the Accounts tab. You will see a table listing all registered users along with their role, username, email address, and last-updated timestamp.Creating a new user
- Click Add user in the Accounts panel.
-
A slide-over panel opens. Fill in the following fields:
Field Notes Username 3–20 characters. Used as a display name throughout the UI. Email address Must be a valid email. Used to log in. Password Minimum 8 characters. Password again Must match the password field. Role useroradmin(see below). - Click Save changes. The new account appears in the table immediately.
Editing a user
Click the row of the user you want to edit to open the same slide-over panel pre-filled with their current details. You can change the email address, reset the password, or update the role. Leave the password fields empty if you do not want to change the password. Click Save changes when done.Deleting a user
Open the edit panel for the user and click the red Delete button.User roles
Webhood has two roles:| Role | Permissions |
|---|---|
user | Can submit scans and view all scan results. |
admin | All user permissions, plus access to Settings → General to manage scanner instances and their configuration. |
API tokens
API tokens allow external systems and automation to submit scans and interact with the Webhood API without a user login. Tokens are created and revoked in Settings → Accounts under the API Tokens section. Each token acts as an authentication credential — scans submitted with a token are attributed to that token’s ID in the scan metadata. Tokens expire one year after creation. Treat API tokens like passwords: do not share them, and revoke them if they are exposed.Self-registration
By default, the Webhood login page does not expose a public sign-up form. To allow new users to register themselves, set theSELF_REGISTER environment variable to true in your deployment:
user role and cannot elevate their own privileges.
PocketBase also exposes its own admin panel (distinct from the Webhood UI) at
/_/ on the backend port. This panel provides lower-level access to collections, rules, and logs and is intended for advanced management tasks. Use it with care — changes made directly in the PocketBase admin panel may not be reflected correctly in the Webhood UI if they conflict with the expected schema.