Users and integrations

Use a global administrator account to manage the instance. Project access and global roles work together.

Give a user access

1. Open Admin → Users.
2. Create the account and choose its global role.
3. Add the user through the project’s Members settings.
4. Choose the project role needed for their work.

Choose the lowest role that covers the task:

• Viewer: Read accessible projects, deployment history, and logs.
• Deployer: Run existing releases, retry, re-run, and cancel deployments.
• Maintainer: Author project content and run runbooks, subject to project permissions.
• Admin: Manage instance settings, users, agents, and approvals.

The lower permission from the global role and project membership limits access. Global administrators can access all projects. Deployment, runbook, and artifact approvals require a global administrator. See the complete role reference for special permissions.

Protect your account

Open Security from your account menu. You can change your local password and enroll an authenticator app or passkey. Store recovery codes securely when DurpDeploy shows them.

Keep the server’s public hostname unchanged when possible. Passkeys depend on that hostname and origin. An administrator can reset another user’s MFA after fresh authentication. That reset removes browser sessions but does not revoke API tokens.

Connect notifications

Open Project menu → Settings → Notifications. Configure the channels your team uses:

• Slack: An incoming webhook URL.
• Discord: A channel webhook URL.
• Gotify: A server URL and application token.
• Email: Recipient addresses and server-side SMTP settings.

Saved webhook URLs and tokens are write-only. Leave a credential field blank to keep its current value. Select Clear credential only when you intend to remove it.

For email, set DURPDEPLOY_SMTP_HOST, DURPDEPLOY_SMTP_PORT, and DURPDEPLOY_SMTP_FROM in compose.app.env. Add DURPDEPLOY_SMTP_USER and DURPDEPLOY_SMTP_PASS when authentication is required. Recreate the app after changing the file:

docker compose up -d app

Administrators can inspect delivery history at /admin/notifications on their server. Global channels for backup and agent health use /admin/notifications/settings. See the notification reference for SMTP transport requirements.

Use the API

The API provides automation access at /api/v1. Open the API reference for endpoints, request fields, and response schemas.

Maintainers and administrators can create tokens from Tokens in the account menu. Choose the required projects, permission ceiling, and expiration. Use a Viewer ceiling for the read-only example below. A token cannot grant more access than its owner has.

In Bash, read your token without putting its value in the command:

read -r -s -p 'API token: ' DURPDEPLOY_TOKEN
printf '\n'
curl --fail --show-error \
  --header "Authorization: Bearer $DURPDEPLOY_TOKEN" \
  https://deploy.example.com/api/v1/projects
unset DURPDEPLOY_TOKEN

Replace the domain with your server’s domain. Revoke unused tokens from the token settings page. Browser MFA does not protect bearer-token requests.

Add single sign-on

OIDC sign-in is optional. Follow the OIDC setup guide for provider settings, callback URL, and role mapping. Keep a working local administrator account for recovery.