Account Management is where administrators create users, set roles and status, adjust subscription or balance, and run security actions. Sign-in methods, registration, email verification, and identity providers live in Login & Auth.
Where to find it#
Open the admin console and select Accounts. The toolbar has search, Role and Status filters, a Subscription filter in period billing, sorting, Import, and Create.
Search matches username, display name, email, and Public ID.
| Column | Meaning |
|---|---|
| ID | User ID. |
| Info | Avatar, display name, and username. |
| Role | User role, editable inline. |
| Status | Account status, editable inline. |
| Subscription | Plan or tier, shown in period billing. |
| Balance | Billing account balance, shown when billing is not self. |
| 2FA | Whether two-factor authentication is enabled. |
| Timezone | Account timezone. |
| Last active | Last activity time. |
Sort options are ID newest first, ID oldest first, Last login, Recently updated, and Display name A-Z.
Create a user#
- Click Create.
- Fill in Username, Display name, Password, and Email.
- In period billing, choose a Subscription plan and, for non-Free plans, an Expiration date.
- Click Create.
| Field | Rule |
|---|---|
| Username | 3 to 16 characters, lowercase letters, numbers, _ or -, not reserved, and no @. |
| Display name | Optional, 3 to 16 characters. |
| Password | At least 8 characters and not digits only, up to 128 characters. |
| Subscription plan | Required in period billing. Non-Free plans require an expiration date. |
Edit a user#
Click the settings button on a row to open Manage user. The sheet is grouped into Profile, Access & region, Billing, Security, and System.
| Section | Editable items |
|---|---|
| Profile | Display name, email, phone, preferences. Username is read-only. |
| Access & region | Status, role, timezone, language. When status changes, a Reason field appears. |
| Billing | Subscription plan and expiration in period billing; account balance when billing is not self. Billing status is read-only. |
| Security | Two-factor state and recovery code count, last login, last active. |
| System | Public ID, created at, updated at. |
Click Save to apply changes. Balance changes are recorded with the description "Balance set by an administrator in user management".
Change role and status#
Roles and status can be changed inline from the table or in the user sheet.
| Role | Notes |
|---|---|
user | Standard account. |
admin | Can access the admin console. |
superadmin | Full access, including content moderation. Only superadmins can manage superadmin accounts. |
| Status | Meaning |
|---|---|
| Pending | Account created but not activated. |
| Active | Normal sign-in. |
| Locked | Sign-in blocked, typically after failed attempts. |
| Suspended | Temporarily blocked by an administrator. |
| Deactivated | Account disabled. |
Add a reason when you change status in the sheet so later audits can explain the change.
Run security actions#
Open More actions at the bottom of the user sheet.
| Action | Effect |
|---|---|
| Reset password | Sets a new password. The user must change it on the next sign-in. |
| Reset 2FA | Clears two-factor configuration and revokes active sessions. The user must bind it again. |
| Revoke sessions | Signs the user out of all devices. |
| Delete | Permanently deletes the user record and primary user data. |
Reset 2FA and revoke sessions require confirmation. Delete is permanent and cannot be undone.
Bulk actions#
Select users with the checkboxes, then apply Role, Status, Timezone, or Balance, or click Delete. Every bulk action shows a confirmation with the selected count.
- Balance bulk edits are available only when billing is not self, and the value must be a non-negative number.
- Users already at the target role, status, timezone, or balance are skipped.
- Partial failures keep the failed users selected so you can retry.
Import OpenWebUI users#
- Click Import, then OpenWebUI.
- Enter the DB connection string, for example
postgres://...or/data/openwebui.db. - Set the Credit multiplier.
- Click Preview to run a dry run, then Import.
Dedupe is by email; existing users are not modified or overwritten. The preview shows scanned, importable, existing emails, duplicate source emails, invalid emails, and invalid rows.
Troubleshooting#
| What you see | What to check |
|---|---|
| Failed to load users | Refresh. If the session expired, sign in again. |
| Failed to create user | Check username length, display name length, and the password policy. |
| Non-Free subscriptions require an expiration time. | Set an expiration date for the selected plan. |
| Failed to update role or status | Check that you have permission to manage the target account. |
| Cannot select a superadmin row | Only superadmins can manage superadmin accounts. |
| OpenWebUI import failed | Check the connection string and that the source database is reachable. |