Skip to content

docs(readme): describe the owner grant as the auth server applies it #290

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Bccorb merged 1 commit into from
Oct 20, 2026
Merged

docs(readme): describe the owner grant as the auth server applies it #290

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -496,8 +496,9 @@ for the owner. It waits for the auth server, defaults to the project's `OWNER_EM
to a local auth server (`--url`, default `http://localhost:5312`). The code replaces any code sent
before, so run it after the page asks, and enter it within 5 minutes.

Both signup paths (email OTP and a verified OAuth profile) establish control of the address before
the account is created, so only someone who actually receives mail there can claim it.
The owner gets `admin:write` (or `admin` on an instance whose available roles list only that). Email
OTP registration creates the account before the address is verified, but an unverified account
cannot sign in, so only someone who receives the code at that address can use it.

**The grant is signup-time only.** Changing `OWNER_EMAIL` after an account already exists promotes
nobody. To hand ownership to a different address, set it in `auth/` (or the compose file) before that
Expand Down
Loading