Accounts

People, roles, one-time passwords and machine keys.

Sign-in must be enabled in Settings → Security for any of this to take effect. Until then everyone is an administrator.

Roles

Role	Can
Viewer	See jobs and builds their role allows.
Operator	Also run jobs.
Administrator	Everything, including settings, accounts and installing plugins.

Those are defaults. Each job additionally carries its own view role and run role, so a deployment job can be administrator-only while everything else stays visible. A job you cannot see returns 404, not 403 — the identifier does not confirm it exists.

Passwords

Stored as PBKDF2-SHA256. Sessions live in a database table, so signing out invalidates server-side rather than just dropping a cookie. Stored with 600,000 iterations; minimum length is 12 characters.

One-time passwords

TOTP, enrolled per account, with backup codes you can regenerate. Once Require OTP for all accounts is on, an account that has not enrolled can still sign in — but cannot turn OTP off.

API keys

For programs and AI agents. Format:

walis_<prefix>_<secret>

• Only a domain-separated SHA-256 lookup hash is stored. The plaintext is shown once, at creation. A fixed-cost hash is correct for a 124-bit machine-generated secret; passwords, which are neither, still use PBKDF2.
• The prefix is what the lookup uses; it is not secret.
• A key carries a role, and AuthenticationMiddleware synthesises a session from it. HasOtp is treated as true — a machine cannot produce a one-time password.
• A key cannot create another key. Escalation via a leaked key stops there.

Keys can be disabled without deleting them, which keeps the audit trail intact. Last used is the fastest way to find keys nobody needs any more.

Deleting accounts

Walis refuses to delete the last account. If it did not, enabling sign-in with no accounts left would lock everyone out of a service that has no password-reset path.