Users and Roles

Odeion uses an invite-based registration system: new accounts are created only by redeeming an invite code. All user management happens in Admin > Users.

Roles

Four roles form a hierarchy; each role includes everything below it.

Capability	Viewer	Curator	Mod	Admin
Browse, search, and watch the library	Yes	Yes	Yes	Yes
Watch progress, playlists, personal settings	Yes	Yes	Yes	Yes
Join Watch Together sessions	Yes	Yes	Yes	Yes
Request content via Sonarr/Radarr		Yes	Yes	Yes
Create and manage invites			viewer/curator only	All roles
View the admin panel			Read-only	Full
Change settings, manage users, libraries, backups				Yes

Invitations

Mods and admins create invites from Admin > Users, choosing the granted role, expiry, and use count. See Invites and Registration for details, including the OAuth signup path and rate limiting.

Managing Users

Admins can manage any user from Admin > Users:

Action	Effect
Change role	Promote or demote between viewer, curator, mod, and admin.
Lock / unlock	A locked account cannot sign in, use its sessions, or use its API keys. Useful for suspending a user without deleting their history.
Download access	Toggle whether the user can download transcoded media files. Enabled by default.
API keys	Toggle whether the user may create API keys. Disabled by default.
Change username	Update the account’s username.
Generate password reset link	One-time link the user redeems to set a new password.
Delete account	Permanently removes the user and their data.

Password Resets and Locked Accounts

Three flows cover lost passwords and lockouts:

• An admin generates a reset link from this page (valid 24 hours, single use).
• The user redeems it at the link to set a new password.
• If the only admin is locked out, the odeion reset-password CLI command on the server host issues a link and clears the account lock in one step.

Details on all three, including what a reset does and does not do, are on Password Reset and Rate Limiting and Account Locking.