Accounts and permissions
Player accounts, room roles, host approval, and account recovery.
Players and hosts
A player can use quick join without a password, providing a username and email identity. The browser keeps a device session; using the same display name in a new account does not reclaim an old hand. An approved host or site administrator can create rooms. An account with a password can request host access, but an administrator must approve it.
Room codes let people request access. With room approval enabled, a GM must admit each joining player. Without it, players are admitted immediately.
Room roles
| Role | Access |
|---|---|
| Player | Move pieces and play their own hand. |
| Helper | Player actions plus Library access for permitted decks, dice, objects, dispensers, mats, and notecards, scoreboard editing, and private notecard passing. |
| GM | Helper actions plus table settings, boards, scenes, skyboxes, concealment, and game snapshots. Manage Helpers and Players; only the Owner can promote or demote GMs. |
| Owner | The room creator, with GM access and protection from management by other GMs. |
Site administrator is a separate, server-wide permission. Administrators manage users, host approval, rooms, and the asset library. They can join rooms as GMs and use private library assets.
GMs can use Room info > Members > Time-out / End time-out for members they can manage. Players choose More > Spectate / Return to play, or Watch beside an admitted lobby room. These modes block gameplay while retaining permitted chat, camera, and inspection. Existing hands and reserved seats remain; a new spectator starts without a seat. Returning to play requires a free seat when needed and does not end a GM time-out.
Passwords and recovery
Use Account security in the lobby to set or change your password. Setting a password does not automatically request or grant host access. Changing an existing password requires the current password.
Enroll recovery before you lose access:
- Recovery email: request verification and open the link in the signed-in browser that requested it. Press Continue to finish.
- Recovery codes: generate and save the ten single-use codes outside your browser. They are displayed once. A new set replaces the old one.
Use Recover account / reset password to recover with a verified email or a saved recovery code. Recovery preserves the account's rooms, roles, hands, and library ownership. It does not grant host or administrator access.
A successful password change or recovery ends previous device sessions and invalidates existing recovery codes. Save a new set afterward. An unverified email address alone cannot recover a passwordless account.
Password lengths and host requests
Signup and account-security forms require matching passwords of 8-128 characters. The separate initial administrator bootstrap password accepts 12-1024 characters. A password signup requests host approval; setting a password later through Account security does not. Choose Request host access to enter the approval queue.
Administrator recovery
On the server, promote an existing account with:
npm run admin:grant -- user@example.com
For Compose, prefix the command with docker compose exec app. Run the command
where the application's database environment is available. Native Linux/Proxmox services
use a systemd environment file, so run this as root on the installed host or inside the
LXC:
runuser -u open-tabletop -- /usr/bin/node \
--env-file=/etc/open-tabletop/open-tabletop.env \
/opt/open-tabletop/current/scripts/admin-role.mjs grant user@example.comPromotion changes permissions; it does not reset a password or sign you in. Bootstrap settings create the first administrator only on an empty users table; they do not reset existing accounts.
Sources checked: docs/ACCOUNT_SECURITY.md, server/permissions.js, public/landing.js. Reviewed September 29, 2026 against the working source. Published releases may differ; check the changelog for your version.