Accounts and workspace access
Your account lets you sign in to a dtxWiki server. Your workspace membership determines which shared space you can enter and what you can do there. A server administrator operates the whole installation and can start account recovery. These are separate responsibilities.
View full-size image
Example dtxWiki screen. It uses fictional demonstration data.
Choose a role
| Workspace role | Typical use | Main abilities |
|---|---|---|
| Viewer | A colleague who needs to consult knowledge | Read accessible content and use read surfaces; editing actions are restricted |
| Editor | A person who contributes knowledge | Create and edit Context content, work with Agent drafts and Chats, subject to review and policy |
| Owner | A person responsible for this workspace | Editor abilities plus membership, roles, sharing, and workspace policy management |
Role permissions still interact with page state, content sensitivity, and review policy. For example, a private edit that has not been submitted is visible only to its author. An Editor role does not make every protected action available.
Membership applies to the whole workspace, not one folder or page. If you need to share only a subset of your work, create a collaborative workspace for that material. Adding someone to your Personal Workspace changes who can access that space.
Add an existing account to a workspace
As a workspace Owner:
- Select the workspace you intend to share.
- Open Settings → Members & access.
- In Find or add members, enter the person’s complete login email. Partial names can search members, but adding requires the exact email of an existing active account.
- Choose the initial role. Use Viewer for someone who only needs to read.
- Review the confirmation, then add the member. Confirm the account appears with the expected role.
An email entered here does not create an account or send a registration invitation. If the account does not exist, ask the server administrator to create it first.
Changing someone to Owner grants control over members, sharing, policies, and other owners. Removing a member removes their access to the entire workspace. If you give up your own Owner role, another owner must promote you again; plan the handover first.
Joining a discoverable workspace
Workspace visibility and membership are separate:
- Private: only members can discover and enter it.
- Team: signed-in users on the server can discover it, but membership is still needed to enter.
- Public: visitors can discover its public profile; internal knowledge still needs membership.
If join requests are enabled, a signed-in non-member can request access. Owners review requests in Members & access; approval adds the person as a Viewer. An owner can change the role later if the person needs to contribute.
Visibility alone does not put every page on the public web. A published Context version must be separately published to the web. See Sharing.
Create a server account
This step is for a server operator. Team and remote modes close self-sign-up by default. For a systemd installation:
sudo dtxwiki users add person@example.com
For Docker, from the existing infra/prod directory:
docker compose exec app dtxwiki users add person@example.com
The command asks for a password of at least eight characters twice with hidden input and creates the user's Personal Workspace. The email is the login ID; no separate username is needed. Arrange a secure initial handover; the user should choose a new password in Account → Password. Creating the account does not add it to an existing shared workspace.
For a local installation with signup enabled, the user can instead choose Sign up in the browser. Follow installation and first login for the separate server-admin grant. The first registered account is a workspace Owner, not an automatic server administrator.
An operator can also add an existing account by the workspace’s actual slug, its URL-friendly identifier:
sudo dtxwiki workspace members add person@example.com \
--workspace YOUR_WORKSPACE_SLUG --role viewer
sudo dtxwiki workspace members list --workspace YOUR_WORKSPACE_SLUG
Do not assume the slug is default; Personal Workspaces use user-specific slugs.
Password changes and recovery
Use Account → Password when you can still sign in. If you cannot, use Forgot your password? when server mail recovery is available. Email recovery depends on a configured mail service and an eligible verified address. Otherwise contact the server operator, not just a workspace owner.
When the server has a configured canonical HTTPS URL, the operator can issue a one-time link without choosing or viewing your new password:
sudo dtxwiki users issue-password-reset person@example.com --delivery link
The administrator-issued link expires in 30 minutes by default and requires an interactive terminal to display. Completing any password reset ends the user's browser sessions. For administrator/CLI recovery, PAT/MCP/OAuth credentials are revoked when the issuer or recipient requests it; if compromise is suspected, the operator should use --revoke-api-tokens. In contrast, recovery started through public Forgot your password? always revokes those credentials on completion. Reconnect AI apps after that recovery.
SMTP is optional for the administrator's explicit --delivery link route, but the HTTPS representative URL is still required. A default local HTTP installation does not have that recovery-link mode configured. Email self-service recovery additionally requires SMTP setup and a verified account email; configuring mail does not retroactively verify every account.
Settings → User accounts is a server-administrator surface for account lookup and recovery. Server administration does not automatically add that person to every workspace.
AI access has one more boundary
An AI app needs both your workspace membership and a credential that allows that workspace and action. Adding a workspace to an access key does not bypass your role. Removing workspace access from the key stops that connection reaching it. See Connect an AI app.
Implementation evidence: account and membership commands, member/access screen labels, recovery UI, recovery and credential revocation.