Accounts and sign-in
Operator bootstrap, email/password auth, invites, sessions, and password reset.
Brain uses Better Auth email/password sessions stored in your Postgres. Chats and MCP tokens belong to the signed-in user (and their active workspace).
First operator (bootstrap)
On an empty database:
- Open
/setup - Create the operator account (name, email, password)
- Sign in and continue to
/chat
In production, set BRAIN_BOOTSTRAP_TOKEN and provide it at setup (or run node scripts/bootstrap-operator.mjs). Local/dev may allow bootstrap without a token when unset.
Only one first user can win the bootstrap race — parallel attempts serialize so a single operator is created.
Sign in and sign up
| Page | Purpose |
|---|---|
/sign-in | Email + password; Continue with company SSO when licensed |
/sign-up | Create an account when instance policy allows open signup |
/forgot-password | Request a reset link (when policy allows) |
/reset-password | Set a new password from the email link |
/invite/[token] | Accept a workspace invite (register or join) |
Default signup mode is invite-only. Instance admins can change this under Instance policies (subject to license entitlements).
Account settings (/settings/account)
Profile
- Display name (1–80 characters)
- Email is read-only (sign-in email)
- Change password — current + new + confirm (min 8 characters). Optional Sign out other devices (default on) revokes other sessions after the change
SSO-only users may not have a local password to change.
Sessions
- List devices (user agent, IP, last active)
- Revoke a single other device
- Sign out other devices (keep this one)
- Sign out everywhere (including this device →
/sign-in)
Current device is labeled This device and cannot be revoked alone.
Password reset
Self-serve forgot-password needs:
- Instance policy allowing forgot password
- Not SSO-only mode
- SMTP configured (
BRAIN_EMAIL_FROM+BRAIN_SMTP_*) — see Environment variables
Instance admins can still reset passwords from /settings/instance without SMTP — Instance users.
Theme
The docs site has a light/dark/system control that stores brain-theme in local storage. The signed-in app follows system preference via bootstrap — there is no separate Appearance page in account settings.