Admin Panel

The admin panel is a system-level interface for platform operators. It is not scoped to any workspace — admins can manage users, system configuration, and feature flags across the entire Mopheus instance.

The admin panel is distinct from workspace-level admin roles. A workspace Admin can manage members and settings within their workspace; a system admin manages the platform itself.

Accessing the Admin Panel

Navigate to /admin in your browser. Only users with the system admin role can access this area. Non-admin users will see a 403 error.

The admin panel has six tabs:

The First Admin User

On first startup, Mopheus automatically creates an admin user from environment variables:

If a user with that email already exists, Mopheus promotes them to admin instead of creating a new account.

Important: Change the default password after first login.

User Management

The Users tab lists all registered accounts. From here you can:

Create a User

1. Click New user
2. Enter the user's email and name
3. Click Create

The new account has no password set. If email (SMTP) is configured, the user receives a welcome email with a link to set their own password. Otherwise, use the password reset flow below.

Send Password Reset

1. Find the user in the list
2. Click the Send password reset action
3. The user receives an email with a reset link

Admins cannot directly set or view user passwords — the reset email is the only mechanism.

Enable or Disable a User

The user list shows whether each account is enabled. Use the user actions menu to disable an account when access should be suspended, or enable it again later. Disabled users cannot sign in, and disabled accounts do not consume user license quota.

System Configuration

The Config tab exposes all system-level settings. Changes take effect according to each setting's reload behavior:

Key Configuration Groups

General:

• Site Name (site_name) — Platform display name
• Allow Registration (allow_registration) — Enable or disable public registration
• Require Email Verification (require_email_verification) — Require email verification for new accounts
• Allowed Email Domains (allowed_email_domains) — Comma-separated list; empty = all domains
• Server URL (server_url) / App URL (app_url) — Backend and frontend URLs

Email (SMTP):

• Email Provider (email_provider) — "smtp" or empty (auto → log fallback)
• SMTP Host (smtp_host), SMTP Port (smtp_port), SMTP Username (smtp_username), SMTP Password (smtp_password)
• SMTP TLS (smtp_tls) — true for implicit TLS (port 465), false for STARTTLS (port 587)

Storage:

• Storage Driver (storage_driver) — "local", "s3", "oss", "obs", "cos", or "minio"
• S3-compatible settings: S3 Bucket (s3_bucket), S3 Region (s3_region), S3 Endpoint (s3_endpoint), S3 Access Key (s3_access_key), and S3 Secret Key (s3_secret_key)
• Private Bucket (s3_private) — When enabled, attachments use short-lived signed downloads or the API proxy rather than public object URLs. S3-compatible drivers require a bucket, endpoint, access key, and secret key; restart the server after changing any storage setting.
• S3 CDN Domain (s3_cdn_domain) — Optional public CDN hostname used only for attachment downloads; uploads always use the S3 API endpoint.
• Local settings: Local Storage Dir (storage_local_dir), Local Storage Base URL (storage_local_base_url)

Alibaba Cloud OSS Private Bucket

Mopheus uses the AWS S3 API for OSS. Set the bucket ACL to Private, create a RAM AccessKey with object read, write, list, and delete permissions for that bucket, then configure the storage keys as follows. Replace cn-beijing with the Bucket's actual region in both the endpoint and region values.

storage_driver = oss
s3_bucket = mopheus-dev
s3_region = cn-beijing
s3_endpoint = https://s3.oss-cn-beijing.aliyuncs.com
s3_access_key = <RAM AccessKey ID>
s3_secret_key = <RAM AccessKey Secret>
s3_private = true
s3_cdn_domain =

The OSS S3-compatible endpoint is https://s3.oss-{region}.aliyuncs.com; it is not the bucket hostname or the native OSS endpoint. OSS uses virtual-hosted addressing, so requests are sent to <bucket>.s3.oss-{region}.aliyuncs.com. If Mopheus runs in Alibaba Cloud in the same region, use https://s3.oss-{region}-internal.aliyuncs.com for uploads. The browser cannot reach an internal endpoint, so downloads use the Mopheus API proxy. Enter a complete endpoint URL including https://, then restart the server after saving these settings.

Huawei Cloud OBS Private Bucket

Set the OBS bucket ACL to Private, grant the IAM user object read, write, list, and delete permissions for the bucket, then configure the Bucket's actual region and endpoint. The endpoint must include https://.

storage_driver = obs
s3_bucket = mopheus-dev
s3_region = cn-north-4
s3_endpoint = https://obs.cn-north-4.myhuaweicloud.com
s3_access_key = <IAM Access Key>
s3_secret_key = <IAM Secret Key>
s3_private = true
s3_cdn_domain =

OBS requires virtual-hosted addressing: Mopheus sends requests to <bucket>.obs.{region}.myhuaweicloud.com. Path-style URLs are not supported by OBS. Restart the server after saving the settings.

Local MinIO

Start MinIO with an S3 API port (9000) and create the bucket, then configure Mopheus with the API endpoint. Port 9001 is the MinIO console and is not used as s3_endpoint.

storage_driver = minio
s3_bucket = it-bucket
s3_region = us-east-1
s3_endpoint = http://127.0.0.1:9000
s3_access_key = mopheus-it
s3_secret_key = mopheus-it-secret
s3_private = true
s3_cdn_domain =

For a browser-accessible MinIO host, replace 127.0.0.1 with that host or IP. To run the optional developer integration test against this instance, set MINIO_ENDPOINT, MINIO_BUCKET, MINIO_ACCESS_KEY, and MINIO_SECRET_KEY, then run the test with the integration build tag. Without these variables, the test is skipped.

Task Sweeper:

• Agent Task Timeout (agent_task_timeout) — Running task timeout (Go duration, e.g. 4h, 24h)
• Dispatch Stale Timeout (dispatch_stale_timeout) — Dispatched task that never started (e.g. 5m)
• Queue TTL (queue_ttl) — Queued task max wait time (e.g. 2h)

Lark / Feishu:

• Enable Lark (lark_enabled) — Toggle Feishu/Lark Bot integration
• Lark App ID (lark_oauth_app_id) / Lark App Secret (lark_oauth_app_secret) — Credentials from Lark Open Platform
• Lark Domain (lark_domain) — "feishu.cn" (China) or "larksuite.com" (International)
• Lark Secret Key (lark_secret_key) — AES-256 key for encrypting Lark app credentials at rest

Feature Flags

The Features tab manages feature flags. Each flag has a system state:

To manage a feature flag:

1. Open the Features tab
2. Click a feature to view its details
3. Change the system state as needed
4. For Selected state, manage the workspace whitelist

License Management

The License tab shows the active authorization status for the whole installation. If no signed license has been imported, Mopheus uses the built-in default license.

Default limits are:

Imported licenses are signed license codes. To request and import a license:

1. Open the License tab
2. Click Download license request to save the request code for this installation
3. Send the request code to your license provider
4. When you receive the license code, upload the license file or switch to paste mode and paste the code directly
5. After import succeeds, the page shows the new license status and limits

The license page also displays reserved limits such as users, members per workspace, projects, skills, jobs, repositories, runtimes, API tokens, open tickets, monthly agent task runs, storage, attachments, Lark installations, webhook integrations, and concurrent agent tasks. Reserved values are signed and stored now, even when a particular limit is not yet enforced by the product. A value of -1 means unlimited.