How do users, roles, two-factor login and API keys work?
BackupWall has three roles: Admin, Reseller and User. Administrators manage users under Settings → Users, anyone can turn on authenticator-app two-factor login, and API keys give scripts full access to an account. There is no password-reset command, so keep a second admin.
Roles
| Role | What it can do |
|---|---|
| Admin | Full access including user management. |
| Reseller | Sees and restores the accounts of one panel reseller. A reseller login is tied to a panel reseller name. |
| User | Standard access to backups and restores. |
Account owners using the cPanel or DirectAdmin plugins do not need a BackupWall login: the plugin passes their panel session, and they can act only on their own account.
Add and manage users
- Open Settings → Users (administrators only).
- Create a user with a Username, a Password, an optional Email address and a role. For Reseller, enter the Reseller name of the panel reseller.
- You cannot delete your own account.
A user who appears in the audit log cannot be hard-deleted; the console deactivates users instead.
Passwords and lockout
- Passwords must have at least 12 characters (Settings → Profile → Change password).
- There is no forgotten-password flow and no command that resets a lost admin password. Make a second admin.
- 10 failed logins lock that username for 15 minutes, then 30, doubling up to 24 hours. Anyone who can reach port 8087 and knows the username can keep it locked, so restrict the port to your own addresses. Open sessions and API keys keep working.
Two-factor login
- Open Settings → Security.
- Under Two-factor authentication, add an authenticator app (Google Authenticator, Authy, 1Password or similar) and enter the 6-digit code to confirm.
There are no recovery codes and no admin reset. A lost authenticator means editing the database by hand.
API keys
Open Settings → API keys to create a key. A key authenticates API requests without a password and has full access to your account, so treat it like a password. Send it as the X-API-Key header. The plugin installers also create an API key inside BackupWall; delete it here when you remove a plugin.
Sessions
Sign out ends your session and revokes the refresh token and the download links made in that login; the access token stays valid for up to 15 minutes. Inside WHM and DirectAdmin there is no Sign out button: use the panel's own logout.