Less guessing.
More getting things done.

Choose Create account from the home or sign-in page. Email registration requires mail delivery to be configured and registration to be open. Confirm your email before signing in. New accounts receive a private workspace, not system-administrator access.

Yes, when the administrator configures a Discord OAuth application. Existing users connect Discord in Account > Security. New users may choose Continue with Discord on the registration page. Discord registration requires a verified Discord email.

No. Panel sign-in uses a Discord application client ID and client secret. A bot token belongs only in the bot connection settings. Never share either kind of credential.

Accounts are never merged just because email addresses match. Sign in to the existing panel account, open Account > Security and connect Discord there. This prevents an unrelated identity from taking over an account.

Check spam and the address you entered. Ask the administrator to inspect Accounts & email > Delivery history. Sent means the provider accepted the message, not that it reached your inbox. Resend is limited to reduce spam. Verification links last 24 hours; password-reset links last 30 minutes.

Use Forgot password on the sign-in page. Email recovery is available only for verified, unambiguous addresses and a configured mail provider. A successful reset revokes existing sessions and API keys created by your account. It does not delete your bots or workspace.

Existing users, passwords, workspaces and credentials remain. Old email addresses are not assumed to be verified. You can still sign in as before and verify your address from Account > Security to enable email recovery.

Open Account > Security. Revoke one other browser session or sign out all other sessions. Revocation takes effect on the next request. The notification inbox records account-security changes.

All services is a searchable directory. It retains Discord, bots, hosting, Trackmania, Dedimania, ManiaExchange, events, tickets, integrations, command library, team access, monitoring and administration according to your permissions.

No. The update targets the existing /opt/control-deck installation and keeps the control-deck systemd service. Run the updater from a separate extracted folder. Never overwrite the live data directory with files from an archive.

Only supported, permission-checked bot actions such as status, start, stop, restart, sync and deploy. The console records requests and results. It is not a Linux shell and cannot execute arbitrary code. Discord slash commands still run inside Discord.

Stopped is a real worker state. A bot can be intentionally stopped. Starting a worker still requires a valid token, correct Discord configuration and the necessary bot permissions.

Saved workflow definitions and supported manual actions remain available. A full automatic trigger-evaluation engine is not implemented in this release. Do not rely on saved triggers to run unattended.

Open API keys in a workspace where your role has api.manage. Choose read or control and an expiration period. The full key is displayed once; only its hash is stored. Keep it in your own secret manager, not in a public frontend.

A control key permits supported writes only when its creator still has the relevant workspace and resource permissions. Read keys cannot run writes. Stop, restart, deployment and messaging require explicit confirmation. Write requests also require an Idempotency-Key UUID.

401 means the key is missing, invalid, revoked, expired, or its account is inactive. 403 means the key scope or its creator permissions do not permit the action. A key never grants more access than its creator currently has.

Use a UUID in the Idempotency-Key header and keep the same key and payload for retries of the same request. Finished responses are replayed for 24 hours. A different payload with the same ID is rejected. An in-progress or unknown result returns 409; inspect the worker instead of blindly retrying.

A system owner opens Administration > Accounts & email. Configure SMTP with verified TLS or Resend, save, send a test email, then open registration. Credentials are encrypted with the existing application encryption key. SMTP supports AUTH PLAIN and LOGIN, not provider OAuth SMTP authentication.

For the 404bot.de deployment, use https://404bot.de/auth/discord/callback in the Discord Developer Portal. The admin settings page shows the exact URL derived from this installation BASE_URL. The scheme, hostname and path must match.

Yes. System owners can add, edit, hide or delete entries in Administration > FAQ editor. Answers are plain text and escaped before display. Changes appear publicly without restarting the application.