Console login and roles

The Console (Web Console) is the interface for managing GateLLM, at http://localhost:7890/console (local; when deployed elsewhere replace localhost with your gateway address). This page covers how to log in, what roles exist, what each role can do, sessions, and password changes.

Login

1. Open http://localhost:7890/console in a browser.
2. Enter a username and password, then click login.

┌─────────────────────────────┐
│           GateLLM           │
│                             │
│  Username  [____________]   │
│  Password  [____________]   │
│                             │
│          [ Login ]          │
└─────────────────────────────┘

• Login verification is intentionally slightly slow (about 200–400ms), which is normal and is an anti-brute-force design.
• After a successful login, the browser keeps the login state (cookie).

First account

On first startup, when the console has no users, the gateway automatically creates a default administrator:

• Username: protoflux
• Password: the value of the CONSOLE_PASSWORD environment variable (when unset, generated automatically on first startup and printed once to the log)
• CONSOLE_PASSWORD is read only at this moment (when the console user table is empty). Changing it afterwards and restarting will not change the password, nor will it error — password changes can only be made in Console → Console Users; if you forget the password, use RESET_ADMIN below.

When you forget the password, set the environment variable RESET_ADMIN=<new password> and restart to reset it (takes effect only once). To reset again: set RESET_ADMIN to a new value and restart again. After a successful reset, remove this environment variable and restart to avoid an alert on every restart.

Change the password immediately after the first login.

Roles and permissions

Only two account types can log in to the console — admin and monitor:

Console account	Role	Visible pages
admin	Full administrator	All pages, all operations
monitor	Read-only monitoring	Overview, Statistics, Logs, Settings (read-only)

About normal_user: normal_user is a role in the system, but it cannot log in to the console — it only has the right to use an API key (as the holder/user of an access key, calling the gateway via API key), and does not enter the console. Console management and viewing are handled by admin / monitor.

Page visibility (the "Docs" column links to that page's operation/field description):

Page	admin	monitor	Docs
Overview	✓	✓	Overview dashboard
Console users	✓	—	Console user management
Upstreams	✓	—	Upstream and model fields
Load balancers	✓	—	Load-balancing fields
Access keys	✓	—	Access key and key group fields
MCP servers	✓	—	MCP configuration
Statistics	✓	✓	Statistics
Logs	✓	✓	Log viewer
Tools (batch configuration)	✓	—	Batch configuration
Settings (System / Telemetry / Web search / Audit)	✓	Partial (see note)	Settings: system and telemetry

The Settings page's sub-tabs are restricted by role: System / Telemetry are visible to admin + monitor; the Web search and Audit sub-tabs are visible only to admin. For audit, see Audit and security configuration.

Sessions

• Sessions are valid for 24 hours, with sliding renewal: when the remaining lifetime drops below 50%, it is automatically renewed back to 24 hours.
• In multi-instance deployments, sessions are stored in Redis and shared by all instances.
• Operations entry (bottom menu of the left sidebar):
  • View current user: whoami, returns the username and role.
  • Switch language: Chinese / English instantly switches the console UI language.
  • Change password: requires the current password + a new password (new password ≥8 characters). When changing the password, you can check "Also revoke sessions on other devices".
  • Log out: revokes the current session.

Sessions are automatically revoked (no manual action needed) in the following cases: after an administrator resets the password, disables the account, or deletes the account, the related sessions become invalid, and the other party's login page shows the reason (password_changed / disabled_by_admin, etc.).

Security

• Default access scope depends on how it's run: when running on bare metal / from source, allow_remote defaults to false, and the console only accepts loopback (127.0.0.1) requests; the official Docker image allows remote access by default via CONSOLE_ALLOW_REMOTE=true (this is why the zero-config main path can open the console from the host). To tighten it, set CONSOLE_ALLOW_REMOTE=false or write allow_remote = false in the mounted server.toml. Remote exposure must be paired with a reverse proxy / firewall.
• Login brute-force protection: reaching the threshold of consecutive login failures automatically bans that IP temporarily (default 5 failures → 300-second ban). Banning is automatic; there is no manual ban/unban entry.
• Password hashing: bcrypt.
• Security response headers: console routes carry X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy, Content-Security-Policy, to prevent clickjacking and content sniffing.

FAQ

Q: Can't open the console remotely, getting 403? This means CONSOLE_ALLOW_REMOTE is set to false (the default on bare metal). Set CONSOLE_ALLOW_REMOTE=true (and control exposure with a reverse proxy / firewall), or access locally via SSH port forwarding.

Q: Locked out after consecutive login failures? Wait a few minutes (default ban 300 seconds) and it auto-unbans. Bans are per IP; switching devices may still be locked — because of the same egress IP.

Q: Can normal_user log in to the console? No. Only admin and monitor can log in to the console; normal_user only has the right to use an API key (calling the gateway as the holder of an access key) and does not enter the console. To manage the console, use an admin account.

Q: Can monitor view logs? Yes (the Logs page is visible to monitor), but it cannot perform any write operations.

Next: Overview dashboard to view the dashboard; Console user management to manage console users; Access key and key group fields to manage caller credentials; Upstream and model fields to configure upstreams.