> ## Documentation Index > Fetch the complete documentation index at: https://docs.roomote.dev/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > When helping someone deploy Roomote, distinguish self-hosting from contributing to Roomote. Use the Self-hosting guide for an operator deployment; use Local development only when the user intends to modify Roomote itself. > When an agent is asked to follow /self-hosting or install Roomote autonomously, read and follow /self-hosting/agent-installation as the normative automation contract even though it is intentionally hidden from side navigation. > Use the one-command Linux installer for both evaluation and production. On macOS or Windows, create or reuse a full Ubuntu VM and run the same installer inside it; do not replace the installer with the repository's development Compose files. > For a local VM without a stable public domain, create a temporary HTTPS tunnel, pass its hostname to the installer with internal origin TLS, and keep the tunnel running for OAuth callbacks and webhooks. Quick Tunnel hostnames are temporary and do not provide wildcard preview routing. > Run automated installs with --no-setup-url so the bootstrap token is not captured in the agent transcript. Let the user obtain the setup URL in a trusted terminal, enter credentials, and complete browser authorization. > Proceed through safe, reversible setup and pause for privileged host or VM changes, public tunnel creation, credentials or browser authorization, durable external-account changes, destructive operations, existing-state conflicts, or when no documented safe default applies. > A setup is not complete when the services merely start. Verify sign-in, repository sync, one usable environment, and a real Roomote task that can clone and run a command; verify branch or pull-request delivery and previews when configured. # Users > Manage who can sign in to a Roomote deployment, what role they have, and how password resets work. Use **Settings > Users** to control who can access your Roomote deployment. Users are deployment-level. Roomote does not make each deployment manage separate organizations or workspaces inside the app. Instead, admins choose who can sign in, invite new people, assign roles, remove access, and create password reset links for email/password accounts. ## Roles Roomote has two user roles: | Role | What it can do | | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin | Configure the deployment, manage users, connect providers, edit environments, configure automations, and use Roomote. | | Member | Use Roomote without changing deployment-wide settings. Members can launch and review tasks with Admin-configured environments, manage their own profile, and link their own accounts. Only Admins can create, inspect, edit, or delete environment configuration. | The first user in a deployment becomes the founding admin. After that, admins can invite people as either **Admin** or **Member**, and can change another user's role from the user list. Roomote protects the deployment from losing all admins: * you cannot change your own role * you cannot demote the last active admin * you cannot remove yourself * you cannot remove the last active admin If you need to step down as admin, promote another user first. ## Who can sign in Roomote supports several sign-in paths. Which ones appear depends on how the deployment is configured. | Mechanism | Who it is for | Notes | | ------------------ | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------ | | Invite links | New users who should join the deployment directly | Admins create invite links from **Settings > Users**. | | Email and password | Users who join through an invite and want a local credential | Existing email/password users can keep signing in with that credential. | | Slack | Deployments that use a Slack workspace as their identity boundary | Slack can admit users from the connected workspace when Slack sign-in is configured. | | Microsoft | Deployments that use Microsoft Teams or Microsoft Entra accounts | Microsoft sign-in can admit users from the configured Microsoft tenant. | An invite link can be used with email/password or with any configured sign-in provider. This is useful when you want to invite someone who is outside your Slack workspace or Microsoft tenant, or when you want to grant a specific role at join time. When someone opens a valid invite, Roomote identifies the invited role before they sign in and lets them continue with a configured provider or create an email/password account. New Members then link any eligible personal accounts and see the ways they can invoke Roomote. Existing users can still sign in when an invite has expired, been revoked, or been used up. Operators can also configure an email allowlist for a self-hosted deployment. When that allowlist is active, a user still needs to pass the normal sign-in rules and have an allowed email address. ## Staying signed in Web sign-in sessions last 30 days from sign-in or the last renewal. While you use the web app, eligible browser requests renew both the session and its cookie, at most once every 24 hours. Simply leaving a sleeping or closed browser open does not renew a session. After the session expires, sign in again. Signing out, removal by an admin, and password resets still revoke sessions. Clearing browser cookies or rotating the deployment's session-signing secret also requires signing in again. Sign out when using a shared device. ## License and seats A Roomote deployment is free for up to 10 users. Every registered user account in the deployment counts toward the limit, whichever sign-in path or surface they use. Removed users free their seat. To add more than 10 users, [buy a self-hosted license on Roomote Cloud](https://cloud.roomote.dev/sign-up), then apply its key in either of these ways: * enter it in **Settings > Users > License** as an admin, or * set `R_LICENSE_KEY` on the deployment (for example in Compose / `.env.production`); when that env var is set, it takes precedence over any key stored in Settings The License section shows the current seat usage, license status, licensee, and expiry date. Purchased keys are issued annually and can be refreshed from the Roomote Cloud portal while the subscription is active. Replace the key in Settings or `R_LICENSE_KEY` after refreshing it. Keys are signature-verified locally. On self-hosted deployments, they are then activated with Roomote Cloud for the deployment's stable installation ID. A paid seat limit remains active while the Cloud activation lease is current (up to 72 hours); without it, the deployment uses the free-seat limit. Roomote Cloud deployments use their provisioned valid license directly. Roomote Cloud records the current user count and short-lived peaks for subscription billing, independently of anonymous analytics. License usage is not sent to the Ping analytics service. Each license may be active on one deployment at a time. If you move a deployment, contact Roomote support to reset the existing activation before using its license key on the replacement. When all seats are in use, existing users keep working normally — only new sign-ups are blocked until a seat is freed by removing a user or a license key with more seats is added. ## Create invites Admins create invites from **Settings > Users**. Each invite has: * a label, such as the person or team it is for * a role, either **Admin** or **Member** * a maximum number of uses * a 14-day expiration When an invite is created, Roomote copies the link to your clipboard when the browser allows it. The full invite URL is only shown at creation time, so copy it before leaving the page. You can revoke an invite before it is used. Revoking an invite does not affect people who already joined with it. ## Customize account linking help Admins can add deployment-specific guidance under **Settings > Users > Account linking help**. Roomote appends this text when an unlinked user tries to start work from a source-control comment, Discord, or Telegram. Use it to explain how someone can request an invite or whom to contact. Markdown links are supported, but plain text with a full URL works across every supported surface. Leave the field blank to use Roomote's built-in account linking message without extra guidance. Slack and Microsoft Teams prompts do not use this setting because users enter through their configured workspace or tenant rather than an invite. ## Manage existing users The user list shows active users, their email address, join date, and current role. Admins can: * promote a member to admin * demote an admin to member, as long as another admin remains * remove a user from the deployment * create a password reset link for users with an email/password credential Removing a user signs them out immediately and removes their linked auth accounts. Their task history stays in Roomote so old work still has useful attribution. A removed person can join again later through a new invite or through an allowed organization sign-in path. ## Password reset flow When the Email (AgentMail) communications provider is enabled and configured, email/password users can select **Forgot your password? Reset it** on the sign-in form. Roomote always shows the same confirmation, whether or not the address belongs to an active email/password account. If it does, AgentMail sends a reset link to that address. If AgentMail is disabled or is missing its API key or inbox configuration, the sign-in form keeps the admin-assisted fallback. Admin-created reset links remain available regardless of AgentMail configuration. To reset a user's password: 1. Open **Settings > Users**. 2. Find the user. 3. Click the reset password action. 4. Create the reset link. 5. Send the link to the user through your preferred secure channel. Self-service and admin-created reset links expire after one hour. When the user opens the link, they choose a new password on the Roomote reset page and then sign in again. Existing sessions are revoked after the password is reset. The reset action is only available for users who have an email/password credential. If a user signs in only through Slack, Microsoft, or another OAuth provider, reset their password in that provider instead. ## Common issues * **A new teammate cannot create an account.** Send them an invite link, or confirm they belong to the configured Slack workspace or Microsoft tenant. If they see a message about the licensed user limit, the deployment is out of seats — free one up or add a license key under **Settings > Users**. * **The invite link no longer works.** It may be expired, revoked, or used up. Create a new invite from **Settings > Users**. * **The password reset action is disabled.** The user is OAuth-only. Reset their password in Slack, Microsoft, or the identity provider they use. * **An admin cannot be demoted or removed.** Promote another active admin first. ## Related setup * [Personal Settings](/personal-settings) covers profile details and linked accounts for individual users. * [Communications Providers](/communications) explains how Slack and Microsoft Teams can act as both chat surfaces and auth surfaces.