Users, roles, and groups

Accounts, the three roles, and groups — how you control who can publish and who can download what.

The three roles

admin — full control: users, tokens, channels, groups, invites, builds.
publisher — may upload, finalize, and promote builds, but only to the channels on its allow-list. The safe identity for CI.
member — may follow channels and download the builds they’re entitled to.

You manage all of this from either the desktop client’s Admin page or the nightship CLI — they do the same thing over the same API. The commands below use the CLI because it’s precise to write down; every one has an equivalent in the Admin UI. (The offline nightshipd subcommands are only for the root-of-trust operations — the first admin.)

Manage users

Point the CLI at your server once (nightship config set server <url> and config set token <admin-token>), then:

nightship user create alice --role member
nightship users
nightship user set-role alice admin
nightship user disable alice

In order: create a user, list everyone, change a role, and suspend an account (disable / enable, or delete to remove).

For a CI publisher scoped to specific channels, set the role with an allow-list:

nightship user create ci
nightship user set-role ci publisher --channels latest,beta

Screenshot — the Users tab of the Admin page

Users, roles, and groups — all from the Admin page.

The recovery account

The user named admin is your server’s recovery account — like root on Unix. The server refuses to delete, disable or demote it, whether you ask from the Admin page, the CLI or the API, so there is always a way back in: whoever has shell access to the server mints a fresh single-use invite for it and redeems it in the app with Join with invite.

nightshipd invite create admin --hours 4 --data-dir /var/lib/nightship

Run it as the user that owns the data directory — Bootstrap the first admin shows how for each way of running the server. On Nightship Cloud there is no shell: use Lost access? on the Cloud page or Lost access… in the app, and we mail a fresh invite to your registered contact.

Otherwise it is a normal admin: it takes a privileged seat, and Change profile puts your own name on it. A server whose first admin has a different name has no recovery account — create the first admin as admin.

Groups

A group bundles channel access, so you grant it once and onboard people into it:

nightship group create testers
nightship group assign-channel testers latest
nightship user join-group alice testers

group unassign-channel removes a channel from a group again. A member can also join a group by redeeming an invite that carries it, so a new person immediately follows the right channels — see Invites and onboarding.

How people get a token

Creating a user account doesn’t hand out a credential. Real people get one by redeeming an invite (single-use, time-boxed, and scoped to groups) — that’s the normal onboarding path, and it’s why you rarely mint tokens by hand. The exceptions are the first admin and service accounts like CI, whose tokens are minted with the offline nightshipd token create … --data-dir on the server box. Tokens are shown once, stored hashed, and revoked instantly with token delete.

← All guides