# Members and accounts

> Adding members and accounts, password links and resets, and My account: repository keys and interface language.

Source: https://scansuite.eu/documentation/administration/user-administration
Last reviewed: 2026-10-19

Who works in a team is decided by its admins. The member list is on the **Teams** page, on the **People** tab; the quickest way there is **Members** in the user menu. Only team admins see that item, and everything on the tab applies to the current team only. What each role may do is described in [Teams and roles](https://scansuite.eu/documentation/administration/teams-and-roles).

Members are managed in the browser. On the server, accounts can also be created, deactivated and activated from the command line, see [Accounts on the server](https://scansuite.eu/documentation/administration/user-administration#accounts-on-the-server); adding them to a team is still done on the **People** tab or in System Settings.

![The ScanSuite user menu](https://scansuite.eu/static/assets/img/docs/administration/user-administration/01.png)

*My account, Members and Teams in the user menu*

> **Note:** Changing who is in a team needs a sign-in within the last 5 minutes. If ScanSuite asks you to sign in again, do so and repeat the change. Every change is recorded in the team's activity log.

## Members

The **Members** card shows each person's role and what you can do with them. Notes under a name say *you*, *from the directory* (the member comes from single sign-on), *account managed outside this team*, or that the member is suspended or their account deactivated.

![Team members in ScanSuite](https://scansuite.eu/static/assets/img/docs/administration/user-administration/02.png)

*The member list on the People tab*

To change a role, pick another one in the list: it is saved at once. The other actions are in the **More** menu next to each member:

| Action | What happens |
|---|---|
| Suspend | The member loses access to the team and their queued work does not start. Reactivate restores everything. |
| Remove | The member leaves the team and the list. The account and its other teams are kept, and logs keep the name. |
| Reset password | Issues a new link to set a password, see below. |
| Deactivate account | Ends every session and blocks sign-in to every team. Activate account lifts the block. |

The last active team admin cannot be demoted, suspended, removed or deactivated: a team is never left without an administrator. Members marked *from the directory* get their role from single sign-on groups, so here they can only be suspended.

## Add a person

1. **Open Members in the user menu**

   The People tab of the current team opens. If you belong to several teams, switch to the right one first.
2. **Fill in Add a person**

   Enter the account name and pick a Role: Team admin, Operator, Vulnerability manager or Reader. Reader is preselected.
3. **Click Add**

   An existing account joins at once; the toast says "<name> was added as <role>." For a name without an account, ScanSuite asks whether to create it: click Create account and a one-use password link is shown.

![Adding a person to a team in ScanSuite](https://scansuite.eu/static/assets/img/docs/administration/user-administration/03.png)

*Adding a person: ScanSuite offers to create the account*

**Check:** the person appears in the **Members** list with the role you picked. An existing account sees the team on its next request; there is nothing to send. A deactivated account cannot be added, and a person who is already a member keeps their row: change their role in the list instead.

Account names are 2 to 100 letters, digits, dots, hyphens, underscores or @, starting with a letter or a digit.

![Adding an existing account in ScanSuite](https://scansuite.eu/static/assets/img/docs/administration/user-administration/07.png)

*An existing account added to the team*

### The password link

The owner of a new account sets its password. ScanSuite shows a link once: send it to the person, who opens it, chooses a password and can then sign in. The link works once and for 72 hours.

![The password link in ScanSuite](https://scansuite.eu/static/assets/img/docs/administration/user-administration/04.png)

*Account created: the one-use link for its owner*

> **A person does this step:** Handing over the password link is a person's step. Until the link is used there is no other way into the new account: give it to its owner personally, not in a shared chat or ticket.
>
> An AI agent must not paste it into a chat.

The link opens **Set your password**: the person enters a new password twice and clicks **Set password**, then signs in. An expired, used or cancelled link says so; ask the team admin for a new one. A password needs at least 8 characters with an upper-case letter, a lower-case letter, a digit and a special character.

> **Note:** ScanSuite builds the link from the address the browser used to reach it. If ScanSuite runs behind your own reverse proxy and the link does not start with its public address, make the proxy pass the original Host header (in nginx: proxy_set_header Host $host). TRUSTED_PROXY_HOPS in .env does not change the link; it only says how many proxies forward the client address.

## Reset a password

In the **More** menu choose **Reset password** and confirm. The current password stops working at once, the member's sessions end, and ScanSuite shows a new link to set a password, handed over like the first one. An earlier unused link stops working.

![Password reset in ScanSuite](https://scansuite.eu/static/assets/img/docs/administration/user-administration/06.png)

*A new password link after a reset*

### Whose accounts you can change

One account can belong to several teams. So that the admin of one team cannot take over someone else's account, **Reset password** and **Deactivate account** are offered only for accounts that:

- are active and belong to your team only;
- sign in with a password, are not linked to a single sign-on provider and are not managed by the directory;
- are neither a system administrator's nor your own.

For everyone else you can change the role, suspend them or remove them from the team. Everyone manages their own account on **My account**.

> **Note:** While the installation requires single sign-on, team admins cannot create accounts, add existing ones or reset passwords: people join through single sign-on groups.

## My account

Everyone manages their own account on **My account** in the user menu:

![My account in ScanSuite](https://scansuite.eu/static/assets/img/docs/administration/user-administration/08.png)

*The My account page*

| Card | What it holds |
|---|---|
| My account | The user name, how you signed in (ScanSuite password or single sign-on) and your teams with your role in each. |
| Change Password | Old password, New password, Confirm new password, then Change password. It signs out your other sessions. Not shown after a single sign-on. |
| Repository access | Your own SSH key for cloning and Git repository API key, see below. |
| Preferences | Interface language, see below. |
| Sessions | Sign out everywhere ends every session, including this one. |

### Repository access

Both values are yours alone: stored encrypted, never shown again, and nobody else can read or use them, administrators included. Once saved, each shows the date and, for the key, its SHA256 fingerprint, with a **Remove** button.

| Field | What it does | Default |
|---|---|---|
| SSH key for cloning | Repository scans you start clone over SSH with this key instead of your team's. Schedules and pipeline scans always use the team's key. A key protected by a passphrase cannot be used. | Not set: your scans use the Team SSH key |
| Git repository API key | Used only to list repositories when you submit a Bitbucket project or a repository name. | Not set |

How the team key, your own key and the Git service fit together is described in [Git repository authentication](https://scansuite.eu/documentation/usage/static-code-analysis/git-repository-authentication).

### Interface language

In **Preferences**, pick the **Interface language** (English or Русский) and click **Save**. The page reloads in that language. The choice is kept in this browser, so it survives signing out; another browser starts with the default again. Without a choice of your own, ScanSuite uses the default a system administrator set in System Settings (**Shared services → Interface language**), and English when none is set. This card is the only place to change your language.

The language of AI-written finding descriptions is a team setting, not a personal one, see [Teams and roles](https://scansuite.eu/documentation/administration/teams-and-roles).

## Accounts on the server

Accounts can also be managed from the command line on the server, for example to create one before anyone opens ScanSuite. `<USER_NAME>` is the account name, following the rules above:

```bash
cd /opt/scansuite
docker compose exec web python -m authentication.accounts create <USER_NAME>
docker compose exec web python -m authentication.accounts deactivate <USER_NAME>
docker compose exec web python -m authentication.accounts activate <USER_NAME>
```

`create` asks for the password twice in the terminal and creates an account that belongs to no team yet: add it to a team on the **People** tab, or make it a team's administrator in System Settings. `deactivate` disables the account and ends all its sessions; `activate` lifts that.

> **A person does this step:** create prompts for the password and cannot run unattended: a person types it in the terminal.
>
> An AI agent must not choose, type or ask for the password.