The root user

Every service comes with a user called root, which can do everything: read and write any collection, change users, permissions and settings. You set its password when you create the service.

The password

To change it, on the service’s Home, in the Basic Auth box, type a new password of at least 8 characters and click Reset password.

The console does not keep the password, so it cannot show it later. If you know it and want the console to use it in this session, type it and click Use it: it stays in the browser tab and is never sent to the server.

Reset password changes the password on the service. Anything that used the old one stops working until you update it.

The Admin JWT

Next to Basic Auth is the Admin JWT: a token with administrator rights that lasts 15 minutes. Use it for a quick test from a terminal, without typing the password:

curl -i https://c0ffee.ulabase.app/todos \
  -H "Authorization: Bearer <admin-jwt>"

When it expires, click Refresh for a new one. See Tokens for what this token can reach.

What root is for

Use root to set the service up: create collections, users and permissions from a terminal or with ulabase, and check things by hand.

Your app never uses root. It signs in as one of the service’s own users, each with the roles and permissions you grant. You need a user, created through sign-up or on the Users page, and a permission on the Permissions page. The console’s API Tutorial does this in its last two steps.

How root gets its powers

root holds the root role, and the service is created with the permission rootCanDoEverything, which grants that role everything:

{
  "_id": "rootCanDoEverything",
  "roles": ["root"],
  "predicate": "path-prefix('/')",
  "priority": 0,
  "mongo": { "allowManagementRequests": true, "allowWriteMode": true }
}

You can see it on the Permissions page. Do not delete it: without it, nobody can administer the service.