> Raw Markdown twin (generated at build time from the source Markdown). Rendered page: https://docs.gatellm.io/en/console/user-management · Doc index: https://docs.gatellm.io/en/llms.txt


# Console user management

Console users (ConsoleUser) are the management accounts for logging into the console. The only roles that can log in to the console are `admin` and `monitor` (`normal_user` is not a console login account, see below). This page covers how to create/edit/disable/delete console users from a UI-operations perspective. For role permissions, see [Console login and roles](/en/console/login-and-roles.md).

Entry: Console → **Console Users** (admin only).

> Note the distinction between two kinds of "users": console users govern "who can enter the console", while access keys govern "who can call the API" (see [Access key and key group fields](/en/reference/access-keys-groups-fields.md)).

## Management

| Action | How | Description |
|------|--------|------|
| Create | List → New | Fill in username, password (≥8), display name, role, enabled |
| Edit | List → Edit | Username is read-only; password can be left blank to keep unchanged |
| Reset password | List → Reset password | Fill in a new password (≥8), optionally revoke all of that user's sessions |
| Disable | List → toggle status | After disabling, login is impossible and existing sessions are revoked |
| Delete | List → Delete | You cannot delete/disable yourself |

> Create form: choose **role** `admin` or `monitor` (console accounts; see "Role description" below for meanings); **enabled** is on by default, and turning it off means the user cannot log in. `normal_user` is not a console login role (only has API-key usage rights) and does not need to be created here.

## Console user fields

| Field | Description |
|------|------|
| Username | Login name, unique |
| Password | Stored as a bcrypt hash, never exposed in API responses |
| Display name | Used for UI display |
| Role | admin / monitor (console accounts) |
| Enabled | Turning off revokes sessions |

## Role description

| Role | Position | Visible pages |
|------|------|---------|
| `admin` | Full administrator | All pages, all operations |
| `monitor` | Read-only monitoring | Overview, Statistics, Logs, Settings (read-only) |

> `normal_user` is not a console login account — it only has API-key usage rights and is outside this page's management scope. For page visibility details, see [Console login and roles](/en/console/login-and-roles.md#roles-and-permissions).

## FAQ

**Q: What happens after disabling a console user?**
That user's existing sessions are revoked immediately and login becomes impossible. After re-enabling, login is possible again.

**Q: After deleting a console user, what happens to the access keys they created?**
The key's `created_by` field is cleared, turning it into a legacy key (visible only to admin); the key itself still works. To fully clean up the key, operate on it separately.

**Q: Can normal_user log in to the console or manage console users?**
No. `normal_user` cannot log in to the console (only has API-key usage rights); console user management itself is also admin-only.

**Q: How do I force a user to log in again?**
An admin resets that user's password, or disables then re-enables, or directly checks "revoke all of that user's sessions" when resetting the password.

**Q: Can I delete/disable myself?**
No. The system prevents administrators from accidentally deleting/disabling their own account.

**Next**: [Console login and roles](/en/console/login-and-roles.md) for login and role permissions; [Access key and key group fields](/en/reference/access-keys-groups-fields.md) to manage caller credentials; [Audit and security configuration](/en/reference/audit-and-security-config.md) for password policy and security settings.