Local identities and roles
EPAdmin is installation administration; EmailaPanel Customer access is account-scoped. An Orbit marketplace identity or purchased licence does not sign in to either. Additional local administrators start with no hosting/server permissions. Default login uses locally enrolled credentials; an optional machine-root authentication mode is a separate installed policy, not a reason to distribute Linux root credentials.
MFA and fresh verification
The interface supports the installed authenticator/passkey methods, single-use recovery codes and protected recovery. Enrol the authenticator through begin/first-code completion, retain recovery codes privately and test sign-in. Passkeys use WebAuthn begin/finish challenges and the actual browser origin. Complete required sign-in checks before expecting a workspace.
Confirming the current password refreshes an already complete sign-in for 15 minutes; it does not turn incomplete MFA into full assurance. A sensitive form that asks for verification must be explicitly submitted again after verification; writes are not automatically replayed. Mandatory installation MFA cannot be disabled through a Customer preference.
Administrator grants
| Grant | Purpose |
|---|---|
hosting:read, hosting:manage |
Read or change owned hosting resources. |
server:read, server:manage |
Inspect or change server services/settings. |
security:read, security:manage |
Inspect security/audit or make protected security changes. |
identity:manage |
Manage local identities and delegated grants. |
notifications:manage |
Configure Panel notification SMTP. |
installation:manage |
Installation metadata, migration, licensing and Plugin Library. |
Managing a category permits its corresponding reads, but the Admin role itself grants none. Delegate only rights you currently hold. The installation owner's grants are protected from browser changes. Saving another administrator's permissions revokes their sessions and API tokens.
Sessions and Customer View
Security lists only your own sessions with namespace, creation/last-active/expiry and current-session marker. Revoking the current session signs it out; revoking another stops new use. Password reset/MFA security changes can revoke sessions/tokens according to the confirmed server result. Customer Active Sessions is never an administrator-wide session browser.
Admin View is an expiring audited read-only Customer session with a banner and explicit exit. It cannot issue tokens or perform normal writes. Recovering an identity uses configured SMTP or a protected one-use local grant, not password retrieval. A general Admin Profile editor, panel-branding editor and Customer language selection are not implemented in the menu catalogue.