PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUptime Kuma’s documented native setup creates one local account during initial configuration; it does not provide a dependable built-in workflow for adding separate users, assigning roles, or limiting monitors by person. If several people need access, first confirm the exact version, protect the shared data store, and treat any LDAP, SSO, BetterAuth, or reverse-proxy arrangement as a separately validated access layer rather than a shipped Uptime Kuma feature.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What user management looks like in Uptime Kuma today
Uptime Kuma is self-hosted monitoring software. In the documented setup, the first-run wizard creates a single local username and password for the installation. That account is the identity used to enter the web application and manage monitors.
As an Amazon Associate I earn from qualifying purchases.
Project issue #7203 describes the single-user limitation directly. Earlier issues #128 and #2143 also record teams sharing one login because separate accounts and session control were unavailable at the time those issues were filed. Those reports describe the product state represented by their versions; verify the release you are deploying before relying on any account behavior.
There is no documented, version-independent Settings > Users administration page that you can safely assume exists. A request for basic user management proposes allowing one person to add monitors without changing or deleting another person’s monitors, but that proposal is not documentation of a shipped feature (issue #7203 and related project discussion).
#1 Best Overall
- Used Book in Good Condition
- You can create the initial local account during setup.
- You should not promise that a second local account can be added from the native interface.
- Roles, per-monitor permissions, LDAP, Active Directory, SSO, and BetterAuth are not established as built-in capabilities in the documented setup.
- Sharing the administrator password gives people the same authority and does not create individual accountability.
First, identify the installation you are managing
Account behavior can change between releases, so record the exact Uptime Kuma version before giving anyone access. Also record whether the service runs in Docker or another self-hosted arrangement, where its data directory is mounted, and which reverse proxy or identity service (if any) sits in front of it. A click path copied from a different release can be misleading, especially if a community build or an unverified plugin adds screens that are absent from the project’s documented baseline.
Check the deployment boundary
- The official project repository documents a Docker image named
louislam/uptime-kuma. - The web application is commonly exposed on port
3001. - The persistent application data path inside the container is
/app/data.
Those details describe the deployment layout, not a promise about a particular image tag or release. Pin and record the tag you actually run, then keep that record with your backup and change-management notes.
Creating the initial account
On a new installation, open the Uptime Kuma web application at the address and port you configured, commonly port 3001, and complete the first-run setup. The wizard creates the local account that will administer the instance. Use a unique, long password and store it in an organizational password manager rather than in a team chat or a deployment file that is readable by every operator.
- Start the service and confirm that the web application responds on the configured host and port.
- Complete the first-run account form before adding monitors or inviting operators to use the system.
- Enable the available second-factor option for that account if your deployed version offers it.
- Record the version, container image tag, data location, and recovery contact in your operations documentation.
- Test a sign-in and, separately, the ability to restore the data directory from a backup.
These steps create the one documented local identity. They do not create a team directory, a role hierarchy, or separate monitor ownership.
Why you should not look for a built-in “Add user” screen
Instructions that tell you to open a native user-management page are unsafe unless they have been verified against the exact release you run. The project records instead show an open request for user management with roles and privileges. The proposed goal is meaningful separation: for example, one operator could add or edit a monitor without being able to alter another operator’s monitors. That proposal is not a reliable click-by-click workflow in the documented product.
If a later release or downstream package displays a user screen, check its release documentation and test what the account can actually do before treating it as a permission system. Confirm whether a new identity has its own session, whether it can be disabled, which monitors it can change, and whether actions are attributed to that identity. A screen that accepts another username is not, by itself, proof of least-privilege authorization.
Protect the Docker data directory before changing access
Uptime Kuma stores its application state under /app/data in the documented Docker layout. Mount that path to durable storage so a container replacement does not remove the local account, monitors, notification settings, and other state. The installation documentation also warns that POSIX file locks are needed to avoid SQLite corruption.
Operational checks
- Use one persistent volume or bind mount for
/app/data; do not leave it only in the container’s writable layer. - Ensure the host filesystem supports POSIX file locking. Avoid storage arrangements that silently drop or emulate locks.
- Back up the data while the service is in a consistent state, and verify that a restore can be read by a test instance.
- Restrict host and volume permissions so ordinary users cannot copy the database and inspect or replace it.
- Document who can restart the container, replace the image, or restore the volume. Those host-level powers can bypass any web login.
A persistent volume preserves the one local account; it does not turn that account into multiple identities. File permissions and container access are part of user management because anyone who can replace the data or service can effectively take over the administrator account.
What to do when several people need access
There are three distinct goals, and they should not be conflated:
- Separate identities: each person signs in with a different credential.
- Least privilege: an identity can perform only the actions it needs, such as editing a monitor without deleting others.
- Auditability: logs can attribute an action to a person rather than to a shared password.
The native single-account model fails the first two goals and makes the third unreliable. A reverse proxy or external identity service may provide a different login experience, but it does not automatically add per-monitor authorization inside Uptime Kuma. Validate the complete request path and the application’s authorization behavior before calling such a design multi-user support.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Approach | Separate identities | Least privilege or per-monitor control | Compatibility | Auditability | Recovery if an identity provider fails |
|---|---|---|---|---|---|
| Native local account | One documented account | Not provided by the documented setup | Baseline behavior; verify the exact release | A shared login cannot reliably attribute actions | Local sign-in remains available while the application and data are healthy |
| External identity layer in front of Uptime Kuma | Depends on the chosen layer and its integration | Not established for Uptime Kuma; must be tested | Requires version, proxy, and session validation | The edge may identify a connection; in-application attribution is not established | Depends on a tested local fallback and the proxy design |
| Prospective native LDAP, SSO, or role support | Requested, not documented as shipped | Requested, not documented as shipped | Unavailable as a documented baseline feature | Would depend on the eventual implementation | Issue #5359 discusses a local fallback as a requested capability |
LDAP, Active Directory, SSO, and BetterAuth: what is actually established
Do not describe these as built-in Uptime Kuma integrations without release-specific evidence. Issue #5359 requests LDAP features including group filtering, role mapping, and a local fallback. Issue #6200 asks whether BetterAuth should provide multi-user support, roles, and external authentication. These are prospective directions recorded in open project requests, not a supported configuration procedure.
An external authentication layer can still be evaluated as an architectural option, but keep the boundary explicit:
- Determine whether the layer authenticates users, authorizes requests, or both.
- Test what username, headers, cookies, or sessions reach Uptime Kuma.
- Verify whether every person still ends up operating through the same local account.
- Check whether disabling a person at the identity provider immediately blocks existing sessions.
- Document a break-glass path that does not depend on the identity provider being online.
Until those tests pass for your exact versions, describe the arrangement as an access layer in front of Uptime Kuma, not as native role-based user management.
How the internal Socket.IO authentication works
Uptime Kuma’s internal API documentation describes authentication over Socket.IO. A client connects and then sends a login event containing a username and password; a two-factor token can optionally be included. When a user selected “Remember Me” during a successful login, the client can later use loginByToken with the token issued from that session.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →This documentation is specifically about an internal API. It warns that the interface is not officially supported for third-party integrations and may change without notice. Do not build a production identity bridge around undocumented event names, token formats, or database assumptions without accepting that maintenance risk.
Security implications
- Store credentials and remember-me tokens as secrets. Treat a token as account access until it is expired or revoked by the application.
- Use TLS at the public boundary so passwords and session material are not exposed in transit.
- Do not infer permissions from the presence of a successful Socket.IO login; the documented model still centers on one local account.
- Do not expose the internal Socket.IO interface directly to untrusted networks merely to obtain a second login method.
Practical policy when a shared administrator account is unavoidable
If your current deployment supports only one local identity, sharing it is an operational compromise, not a permission design. Reduce the risk while you plan a better boundary:
- Keep the password in a vault with named access and an access review schedule.
- Require each operator to authenticate to the vault with their own identity before retrieving the shared credential.
- Change the password when an operator leaves the team or no longer needs access.
- Record planned monitor changes in a ticket or change log that names the person and time.
- Limit host, container, volume, and backup access to a smaller administrator group.
- Use the application’s available two-factor protection on the local account.
These controls improve accountability around the password, but they cannot produce in-app per-user history or prevent one authorized operator from changing another operator’s monitors.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting common user-management problems
“I cannot find Settings > Users.”
That absence is consistent with the documented single-account model. Confirm the exact release and package you deployed. Do not edit the database or install an unverified plugin just to create a second identity; first establish that the feature is supported for that version.
“A reverse proxy authenticates people, but Uptime Kuma still shows one account.”
Authentication at the proxy and authorization inside the application are separate. If every request is accepted under the same local Uptime Kuma account, the proxy has not created per-monitor permissions. Treat proxy logs as edge-access records unless you have verified that application actions carry and retain the user identity.
“The identity provider is down.”
Use the break-glass path you documented before deployment. If no local fallback exists, the external layer may prevent access even though Uptime Kuma itself is healthy. Issue #5359’s requested local fallback illustrates why this recovery decision must be designed rather than assumed.
“The login token or API script stopped working.”
The Socket.IO interface is internal, unofficial for third-party integrations, and subject to change. Check the deployed version and application logs, then update the client to match the current implementation. Avoid treating an undocumented event or token format as a stable public API.
“The instance lost monitors or reports SQLite errors after a container change.”
Check that /app/data is mounted to the intended persistent volume and that the storage supports POSIX file locks. Restore a verified backup to a test instance before making further changes. Repeatedly starting multiple containers against one SQLite data directory can create corruption if locking is not honored.
Free tools Windows power users keep installed
One-click scans. No signup required.
“The administrator password is lost.”
Follow the recovery procedure documented for your exact release and deployment. Do not assume that a community database edit, an API call, or a token copied from another session is supported. Preserve the data volume before attempting recovery so you can return to a known backup if the attempt fails.
A decision checklist for teams
- Need only one operator? Use the documented local account, protect it with a vault and available two-factor protection, and secure the data volume.
- Need named logins but not monitor-level permissions? Evaluate an external identity layer, then test whether it gives Uptime Kuma distinct sessions or merely gates one shared account.
- Need per-monitor ownership or role separation? The documented native setup does not establish that capability. Do not promise it to stakeholders; track the relevant project requests and reassess after a release-specific verification.
- Need LDAP, Active Directory, SSO, or BetterAuth? Treat each as prospective until the exact Uptime Kuma release and integration documentation confirm support.
- Need reliable recovery? Maintain a tested local or break-glass path, a versioned backup of
/app/data, and a written procedure for an identity-provider outage.
The safe answer to “How do I add another user?” is therefore: you cannot rely on a documented native method in the current single-account model. Confirm your version, keep the Uptime Kuma data persistent and protected, and validate any external authentication design as a separate system with its own authorization and recovery behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
