# Let someone else in

> Source: https://www.allsweb.com/sixpanel/docs/share-access
> Markdown for agents: https://www.allsweb.com/sixpanel/docs/share-access.md
> Publisher: AllsWeb (www.allsweb.com)

Part of: SixPanel documentation

**What this page is for.** Give a developer, a helper or a visitor a way into
the panel without handing over your own login.

**You need**

- The panel open, on the **Security** page.

There are two ways, and they are not the same thing.

| | Temporary login | Public demo login |
|---|---|---|
| Who is it for | one person you trust for a while | anyone you send the link to |
| Can it change anything | yes, day-to-day work | no, nothing at all |
| How long | 1 hour, 8 hours, 24 hours or 7 days | until you switch it off |
| Sees your secrets | no | no |

Never give anyone your own username and password. Both ways below end on their
own, and both can be ended by you in one click.

---

## Temporary logins

A temporary login is a second login with its own name and its own password. It
can run the site — deploy code, restart a service, read a log, look at the
database pages — and it cannot touch anything that decides who gets in, and
cannot take your data away with it.

### Create one

1. Open **Security** → **Temporary logins**.
2. In **What is it for?**, write something you will recognise later, for
   example `developer fixing checkout`.
3. Choose **How long**: 1 hour, 8 hours, 24 hours or 7 days.
4. Press **Create temporary login**.

The panel makes the name for you — `temp1`, `temp2`, and so on — and generates
the password.

> **Save this now.** The panel shows a box called **Send these three lines**
> holding the panel link, the username and the password. The password exists
> only in that box. Nobody, including you, can read it again. If you close the
> box too early, delete that login and make a new one.

Copy the three lines and send them to the person who needs them. They sign in
on the same login page you use.

A temporary login is **not** asked for a 6-digit code. That is on purpose: the
person you invited does not have your phone. What keeps it safe is the short
list of things it may do, not a second factor.

You can have up to 20 temporary logins at once.

### What a temporary login can do

- Deploy and update the code, and roll back.
- Start, stop and restart services, and watch their logs.
- Read files and browse folders.
- Look at the database pages, the health tab and the activity of the site.

### What a temporary login can never do

The panel refuses these, and says why in the message:

- Change your username, your password, your 6-digit code, the signed-in
  devices, the login address list, other temporary logins or the demo login.
- See or change the secret panel address.
- Reveal a stored secret on the **App .env** page, or open any `.env` file in
  the file manager.
- See the backup password, restore a backup, or change where backups go.
- Download a copy of the database, import a database, or open phpMyAdmin.
- Create or delete a project.
- Change or delete a file, upload a file, or change permissions.
- Update the server itself, or change where alert emails go.
- Create a scheduled task that runs on the server itself.
- Change the Cloudflare API token.

### End it early

In the **Temporary logins** table, press **Delete** on the row. The login stops
working at once, and whoever is using it is signed out on their next click.

The table also shows when it ends and when it was last used, so you can see
whether an invitation was ever accepted.

Expired logins are removed by the panel by itself. You do not have to tidy up.

Over SSH, when you cannot open the panel:

```bash
sudo sixpanel temp-login              # list them
sudo sixpanel temp-login revoke-all   # delete every one of them
```

There is no way to create one over SSH, because the password has to be shown on
a screen exactly once and then never again.

---

## The public demo login

This is for showing the panel to somebody — a client, a buyer, a forum thread.
It signs them in as a visitor who can look and cannot touch.

> **Everything a demo visitor can see is published.** The demo password is
> meant to be shared, so treat every screen it reaches as if it were on your
> website. Leave the demo **off** on a live project.

### Switch it on

1. **Security** → **Public demo login**.
2. Optionally type a note. It is shown on the login page, for example
   `Demo project — data resets nightly`.
3. Press **Switch the demo on** and confirm.

The panel then shows three things: the **demo link**, the **demo username**
(`demo`) and the **demo password**. The demo link is your normal panel link with
`#demo` on the end — opening it fills the login form in by itself, so the person
you sent it to only has to press **Sign in**.

**New demo password** replaces the password. The old one stops working at once.

A demo session lasts 2 hours and then asks for the password again.

### What the demo shows

The dashboard, the project list, domains and certificates, the health tab, the
services and whether they are running, the disk and database figures, and the
shape of your settings.

### What the demo never shows

Every password, key and token is removed before the answer leaves the server.
On top of that, whole pages are refused outright:

- the activity log,
- job logs and the live output of anything running,
- the scheduled-task pages and their logs,
- a service's live log,
- file contents, file downloads and file search,
- database downloads and phpMyAdmin,
- the backup password and where your backups go,
- the email-alert settings,
- everything about who gets in: signed-in devices, the login address list, the
  temporary logins, and the secret panel address.

On the **App .env** page a demo visitor sees only the harmless settings. Every
other value is blank, including your site address.

And every attempt to change something is refused, whatever it is.

### Switch it off

Press **Switch the demo off**. Everyone using it is signed out at once.

Over SSH:

```bash
sudo sixpanel demo off
```

There is no `demo on` over SSH. Switching it on publishes a login, so that
decision belongs in the panel, where the warning is on the screen in front of
you.

---

## How to check it worked

- **Security** shows a temporary login in its table, or the demo as on.
- Open the demo link in a private browser window. It signs you in, the top of
  the page says the session is read only, and every button that changes
  something is gone.
- The **Activity log** has a row for the temporary login being created, or the
  demo login being used.

## If it went wrong

- **The person says "wrong username or password"** — the temporary login has
  already expired, or the three lines were copied with a line missing. Delete it
  and create a new one.
- **They see "this is the read-only demo"** — they are signed in with the demo
  login, not the temporary one. Send them the temporary login's three lines.
- **They cannot do something they need to do** — read the list above. If the
  work really needs it, do that one step yourself; do not hand over your own
  login.
- **You want everyone out, now** — `sudo sixpanel temp-login revoke-all` and
  `sudo sixpanel demo off`. Your own login is untouched.

Everything else about who can reach this panel: **[Security](https://www.allsweb.com/sixpanel/docs/security)**.