Staff Accounts · BGPVR Operator guide

Create a permission profile

Staff → "Permission Profiles" tab → "Add Profile" (top right) → set "Profile Name" (placeholder: e.g. Support Agent) and tick the permissions you want, then save. Real permissions are Manage Clients, Manage Channels, Manage Relay Streams, Manage DVR, Manage VOD, Manage Series, Manage Events, Manage Packages, Manage Profiles, Manage EPG, Manage Promos. Each profile card lists its granted permissions as badges; the pencil edits, the trash deletes.

Staff → "Staff Accounts" tab → "Add Account" → Username, Password (minimum 6 characters), "Permission Profile" (or "— No profile —") and "Account enabled". Editing an account leaves the password field blank to keep the current one. The table shows the profile name and Active / Disabled status.

The sidebar shows a staff login only the areas its permission profile grants, and every change a staff login makes is checked against that profile: a login with only Manage Clients, for example, can edit clients, messages and the sign-up settings, but not channels. A change outside the profile is refused with "Permission denied". Every staff login can still post operator messages, clear idle timeshift buffers and press "Run Now" for the stream health monitor on Monitor › Technical, use the Dashboard's signal check and exclude an automated client in Analytics; saving the monitor's settings needs Manage Channels or Manage Relay Streams. Whatever the profile, these stay with an admin login: admin accounts (list, add, delete, change password), staff accounts and permission profiles; activating and deactivating the licence (staff see the licence tier, with the key masked); Softcam; API keys and the webhook secret; backups; purging accounts and flagging them inactive (the Clients page's "Inactive / Purge" tab is hidden from staff); the server storage paths (timeshift, DVR recordings, VOD library, VOD HLS cache, series, backup folder, YouTube cookies file, camd.socket); the EPG store, adding an EPG grabber source or changing its command, and giving an EPG source an address that is not an http(s) URL; adding AI jobs by hand and the AI chat; a channel's "Pornographic content" mark; and on Nodes, the SSH tunnels, host access, the node terminal and its "Terminal audit log", "Test", "Remove" and sending jobs to a node. Staff still see the node list with each node's state (Monitor › Technical), and staff with Manage EPG can add and change XMLTV sources whose address is an http(s) URL (TV Guide → "EPG Sources"). Secret settings reach a staff login masked (********), and staff cannot change the secrets that check incoming webhooks, payment callbacks and invite codes. Staff with Manage Clients can set or correct a client's date of birth when the client asks, but never see it.

Suspend a staff member without deleting them

Staff → Staff Accounts → pencil on the row → untick "Account enabled" → save. The row flips to "Disabled" and the login stops working, while the account and its profile assignment survive. Use the trash button only for permanent removal (a confirm dialog names the user).

Add or remove an admin account

Staff → "Admin Users" tab → "Add Admin" → Username + Password. Use "Change Password" on a row to reset one, and the trash to delete. The very first named admin you create retires the built-in default admin account by deleting it (unless you name the new account "admin", in which case the default flag is simply cleared).

Staff → Admin Users → the "2FA" button, which only appears on YOUR OWN row → "Set Up Authenticator App" → scan the QR (or copy the manual key) into Google Authenticator/Authy/1Password → enter the 6-digit code → "Enable 2FA". Eight recovery codes are displayed once and never again. Afterwards the same button offers "Regenerate Recovery Codes" (invalidates all existing ones) and "Disable Two-Factor Authentication" (needs a TOTP or recovery code). A shield badge next to a username means 2FA is on.

Rescue an admin who lost their authenticator

Staff → Admin Users → "Reset 2FA" on that admin's row (shown only for OTHER admins who have 2FA enabled) → confirm. They can then log in with just their password until they set 2FA up again. You cannot use this on yourself — use the 2FA button's Disable flow, which requires a code.

See revenue and Record payments (2.9.401)

"See revenue" opens Revenue, a client's Payments tab and the CSV export, read only. "Record payments" records cash and bank payments and cancels or refunds the ones its holder recorded, within 24 hours (admins any time). A permission taken away, a disabled, deleted or renamed login stops at once (the person signs in again).

Library rights for staff (2.9.447)

Library needs either right: Manage Movies (it was called Manage VOD Library) or Manage Series. They stay separate rights and no profile changes. A staff login sees only the tabs its rights allow, so with one right it sees one tab, and an old link to the other tab lands on the one it has.

What each staff role can open (2.9.452)

The server now checks a staff login's rights when it reads, not only when it changes something. A page or tab is open to the logins whose sidebar shows it: Clients, Signup & Referrals and every list of clients need Manage Clients (also a package's Clients tab), Channels needs Manage Channels, Recordings Manage DVR, Films Manage VOD, Series Manage Series, Live events Manage Events, Packages and Plans Manage Packages, Revenue See revenue. Every staff login keeps the Dashboard, Monitor, the TV Guide, Analytics, Devices, Messages and Support, and the small lists that pickers on those pages use (channels, packages, stream profiles, recording profiles). Settings, Tuners, Nodes, the EPG Manager, Staff and Licence stay with an admin. When a staff login opens something its role does not cover, the page says "Your role can't open this" calmly; give the right in Staff → Permission Profiles. Logins without Manage Clients no longer get client names in the Messages and Support pickers, the STB Allocate customer search, or the list of recordings in progress without Manage DVR. Admins are not affected, nor are viewers' apps, My Account, Kodi, MAG or Xtream.

Console passwords (admins and staff) need at least 10 characters when they are set or changed; a password that already works keeps working. A password change, or deleting a login, ends that login's sessions at once on every device. Every console sign-in, failed sign-in, blocked address, wrong 2FA code and Settings save (the names of the settings, never their values) is kept for 180 days; an admin reads it at /api/admin/auth-events. After 10 failed sign-ins within 15 minutes the alert Telegram chat (Settings > Notifications) gets one message. A new install has no admin / admin: the suite prints a one-time setup code to its container log (also in /data/setup_code).

Watch out

The profile editor renders a twelfth toggle, "Manage Modules", but the backend only persists the eleven keys in PERMISSION_KEYS — manage_modules is silently dropped on save, so no staff profile can ever unlock the Modules page.
Deleting a permission profile does not delete its accounts: it sets their profile_id to NULL. Those staff can still log in but arrive with zero permissions and an almost empty sidebar.
Admin password rules are inconsistent with the UI: the modal hint says "Minimum 6 characters", but creating an admin or changing an admin password is rejected by the backend below 8 characters. Staff accounts really are minimum 6.
Deleting the last remaining admin account is refused ("Cannot delete the last admin account").
The first-run login (user admin with the one-time setup code the suite prints to its container log; it is also in /data/setup_code: docker exec bgpvr cat /data/setup_code) can only create your first real admin, and only once: as soon as a real admin exists, that login can no longer create or list admin accounts, even in a session that was opened before.
Admin accounts (list, add, change password, delete), staff accounts, permission profiles and the 2FA settings answer only an admin login; a staff login gets "Admin access required".
Give staff accounts only the permissions they need, and keep the admin login for yourself. Update to the latest suite version to get every security fix.
Recovery codes are shown exactly once, at enable time and after a regenerate. Regenerating invalidates every previously issued code immediately.
Console sessions (2.9.346): a sign-in lasts 24 hours and renews itself while you use the console (a key press, the mouse or a touch in the last 30 minutes), for up to 7 days after you typed the password; then sign in again. When the console has been left alone, it shows "Your session ends in N min" with "Stay signed in" 10 minutes before the end. Changing an account's password, setting up or switching off an admin's 2FA, disabling or deleting a staff account, or changing a staff account's permission profile stops that account's sessions from renewing, so they end within 24 hours. A session opened before 2.9.346 does not renew: sign in once more after the update.
A person's name (2.9.371): staff and admin accounts can have a Name (optional, up to 80 characters; Staff → edit, or Name on an admin). Change logs such as Modules → Recent changes show "Name (username)"; a line keeps the name the person had at the time of the change.

Create a permission profile

Create a staff login

See what a staff login can and cannot do