Authentication and Users

A self-hosted DBO Studio can run with or without login. Login is controlled by one environment variable, APP_AUTH_MODE, and you can switch it on and off with a restart. The desktop app never shows login.

Choose a mode

`APP_AUTH_MODE`	Who can use DBO Studio	Use it for
`none`	Anyone who can open the URL. No login screen.	Your own machine, or a host only you can reach
`local`	People with an account. Email and password, with optional two-factor sign-in.	Any server other people can reach

Warning: With none, anyone who can reach the port can use every saved connection, including remembered database passwords. Do not run none on a host that other people can reach.

Set the mode and restart DBO Studio:

bash

APP_AUTH_MODE=local
APP_ALLOWED_ORIGINS=https://dbo.example.com

APP_ALLOWED_ORIGINS must list the address people type in the browser. With login on, DBO Studio only accepts browser requests from those origins.

Because no account exists yet, DBO Studio prints a one-time setup link in its output. With Docker, run docker logs dbo to see it:

text

no admin account yet: open https://dbo.example.com/?setup=3f9c… to create one (setup token 3f9c…)

Open that link. The Create admin account screen opens with the setup token already filled in. If you open DBO Studio without the link, paste the token yourself.
Enter an email and a password. That account becomes the admin, and you are signed in.

Everything saved before login was on, such as connections, saved queries, and AI settings, now belongs to that admin.

Only someone who can read the server output can create the admin, so it is safe to finish setup after the port is public. The token works once, and a restart prints a new one.

Create the admin from the environment

To skip the setup screen, for example in automated deployments, also set:

bash

[email protected]
APP_ADMIN_PASSWORD=ChangeMe1

DBO Studio creates this admin at startup when no account exists yet. The admin must choose a new password at first sign-in. These variables are ignored once any account exists, so you can remove them after the first start.

Password rules

Passwords are 8 to 40 characters and include at least one letter and one number. A strength meter on every password form helps people pick a stronger one.

Set APP_AUTH_MODE=none and restart.
Open DBO Studio. There is no login screen.

Nothing is deleted. Users, their passwords, and their data stay in the app database. While login is off:

Every browser acts as the first admin, so the admin's connections, chats, saved queries, and AI settings stay visible.
Other users' data is hidden.

Set APP_AUTH_MODE=local and restart to turn login back on. Everyone signs in again and finds their data as they left it.

DBO Studio logs a warning at startup while login is off and accounts exist.

Users

Admins manage accounts in Settings → Administration.

Add a user

Click Create user.
Enter an email, a temporary password, and a role.
Send the temporary password to the person. They must change it at first sign-in.

Roles

Role	Can do
Admin	Everything, including managing users and sharing connections.
Member	Use the connections they own or that are shared with them. Other abilities depend on their permissions.

Permissions

Admins can turn these on or off for each member:

Permission	Allows	Default for members
Create connection	Adding new connections	Off
AI settings	Setting up their own AI provider	On
MCP settings	Enabling the MCP server for their account	Off

Admins always have all three.

Disable, reset, and remove access

From the user row an admin can:

Reset password: set a new temporary password. The user must change it at next sign-in.
Disable: block sign-in and end the user's sessions. Enable restores access. Their data is kept.
Disable 2FA: turn off two-factor sign-in for someone who lost their device.

Each user can turn on two-factor sign-in in Settings → Security:

Click to set it up and scan the QR code with an authenticator app, such as Google Authenticator, 1Password, or Authy.
Enter the 6-digit code to confirm.

From then on, signing in asks for the password and then a code from the app. Users can turn it off again with their password and a current code.

Shared connections

With login on, every connection belongs to one user. An admin can share it with others.

Go to Settings → Administration.
On a user's row, choose Share connections.
Pick the connections and a role, then Grant access.

Role	Can do
Viewer	Open the connection and run queries.
Editor	Also change the connection details.

These roles control the connection entry in DBO Studio. They are not database permissions. Whether a query can change data depends on the database user.

By default, each person enters their own database password. When granting access, the admin can also share the saved password, so everyone uses the same database identity. Prefer separate database users where you can.

Saved queries, history, and AI chats stay private to each user, even on a shared connection.

Sessions

Signing in sets an HttpOnly dbo_session cookie, marked Secure when DBO Studio is served over HTTPS.
A session ends after 24 hours without activity, and after 7 days at most.
Signing out, changing your password, or being disabled ends the session on the server.

Configuration: every environment variable
Security: hardening checklist
Docker

Deploying with Docker and Docker Compose

Configuration Reference