> For the complete documentation index, see [llms.txt](https://docs.codemash.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.codemash.io/cloud/project/settings/admin-portal.md).

# Admin Portal

**Where:** Project → Settings → Admin Portal · `/projects/<project>/settings?tab=Admin Portal`

The Admin Portal signs your end users in to a per-project portal. Its backend authenticates as a dedicated **service user** and reads the portal layout with an API key you issue on this tab.

{% hint style="info" %}
Screenshot TODO — capture comes from testing-plan area **17-project-settings**.
{% endhint %}

## Admin Portal service user

Create a service user under [Membership → Users](/cloud/membership/users.md) (role `AdminPortalManager`), paste its id (`usr_…`) into **Service user id**, and press **Assign service user**. A badge shows **Assigned** or **Not set**; once assigned, the current id is shown with a copy button and you can **Reassign** to a different service user.

## API keys

This section appears once a service user is assigned. Keys follow a two-key model:

* At most **two** keys per service user — delete one before issuing a new one (the tab warns when you hit the limit).
* **Issue key** creates a key, with an optional **Key name** (default `Admin Portal key`). The plaintext is shown **once**, right after issuing — copy it before leaving the page; the server stores only a hash.
* Put the key in your self-hosted portal's `API_KEY` environment variable.
* The list shows each key's name, its first characters, the created date, an expiry date if set, and an inactive marker. **Delete** (with an inline confirm) is permanent and stops any deployment still using that key.

There is no enable/disable switch — the portal works as long as at least one valid key exists.

## What end users see before sign-in

The tab notes that brand, auth options and legal documents on the portal's sign-in screen are controlled by the expose toggles on the **Access** tab; this tab only manages the service user and its keys.

## API reference

Endpoints: [assign-admin-portal-service-user](/api-reference/account/projects/assign-admin-portal-service-user.md), [get-admin-portal-structure](/api-reference/account/projects/get-admin-portal-structure.md).