Less guessing.
More getting things done.

Choose Create account from the home or sign-in page. Email registration requires mail delivery to be configured and registration to be open. Confirm your email before signing in. New accounts receive a private workspace, not system-administrator access.

Yes, when the administrator configures a Discord OAuth application. Existing users connect Discord in Account > Security. New users may choose Continue with Discord on the registration page. Discord registration requires a verified Discord email.

No. Panel sign-in uses a Discord application client ID and client secret. A bot token belongs only in the bot connection settings. Never share either kind of credential.

Accounts are never merged just because email addresses match. Sign in to the existing panel account, open Account > Security and connect Discord there. This prevents an unrelated identity from taking over an account.

Check spam and the address you entered. Ask the administrator to inspect Accounts & email > Delivery history. Sent means the provider accepted the message, not that it reached your inbox. Resend is limited to reduce spam. Verification links last 24 hours; password-reset links last 30 minutes.

Use Forgot password on the sign-in page. Email recovery is available only for verified, unambiguous addresses and a configured mail provider. A successful reset revokes existing sessions and API keys created by your account. It does not delete your bots or workspace.

Existing users, passwords, workspaces and credentials remain. Old email addresses are not assumed to be verified. You can still sign in as before and verify your address from Account > Security to enable email recovery.

Open Account > Security. Revoke one other browser session or sign out all other sessions. Revocation takes effect on the next request. The notification inbox records account-security changes.

All services is a searchable directory. It retains Discord, bots, hosting, Trackmania, Dedimania, ManiaExchange, events, tickets, integrations, command library, team access, monitoring and administration according to your permissions.

No. The update targets the existing /opt/control-deck installation and keeps the control-deck systemd service. Run the updater from a separate extracted folder. Never overwrite the live data directory with files from an archive.

Only supported, permission-checked bot actions such as status, start, stop, restart, sync and deploy. The console records requests and results. It is not a Linux shell and cannot execute arbitrary code. Discord slash commands still run inside Discord.

Stopped is a real worker state. A bot can be intentionally stopped. Starting a worker still requires a valid token, correct Discord configuration and the necessary bot permissions.

Saved workflow definitions and supported manual actions remain available. A full automatic trigger-evaluation engine is not implemented in this release. Do not rely on saved triggers to run unattended.

Open API keys in a workspace where your role has api.manage. Choose read or control and an expiration period. The full key is displayed once; only its hash is stored. Keep it in your own secret manager, not in a public frontend.

A control key permits supported writes only when its creator still has the relevant workspace and resource permissions. Read keys cannot run writes. Stop, restart, deployment and messaging require explicit confirmation. Write requests also require an Idempotency-Key UUID.

401 means the key is missing, invalid, revoked, expired, or its account is inactive. 403 means the key scope or its creator permissions do not permit the action. A key never grants more access than its creator currently has.

Use a UUID in the Idempotency-Key header and keep the same key and payload for retries of the same request. Finished responses are replayed for 24 hours. A different payload with the same ID is rejected. An in-progress or unknown result returns 409; inspect the worker instead of blindly retrying.

A system owner opens Administration > Accounts & email. Configure SMTP with verified TLS or Resend, save, send a test email, then open registration. Credentials are encrypted with the existing application encryption key. SMTP supports AUTH PLAIN and LOGIN, not provider OAuth SMTP authentication.

For the 404bot.de deployment, use https://404bot.de/auth/discord/callback in the Discord Developer Portal. The admin settings page shows the exact URL derived from this installation BASE_URL. The scheme, hostname and path must match.

Yes. System owners can add, edit, hide or delete entries in Administration > FAQ editor. Answers are plain text and escaped before display. Changes appear publicly without restarting the application.

No. The main workspace focuses on bot workers, command execution, support, events and service connections. Trackmania, Dedimania and ManiaExchange remain in Optional integrations with existing configuration intact.

Native bot workers currently run Discord bots. Generic connections can check approved public HTTPS endpoints or send confirmed JSON webhooks. Other chat networks need an external adapter; native Telegram, Slack or WhatsApp runtimes are not included.

Use the offline legacy importer with the original workspace-based database and its encryption key. The updater first backs up the destination. It preserves existing rows, remaps relational IDs where needed and checks encrypted credentials. Identity conflicts abort instead of silently merging accounts. Results appear in Administration > Data & imports.

No. Sign in at /login with your local username and password. Discord is optional. Imported users retain their original password hashes and must sign in again. The current installation local accounts remain unchanged.

The generic HTTPS connector is restricted to public port-443 endpoints approved by a system owner. DNS results are checked and pinned, redirects are refused, and internal or reserved addresses are blocked. This is separate from existing authenticated hosting and game-server integrations.