Accounts
Synthseek supports two ways to sign in.
Local accounts. An email, a username, and a password. Created by an administrator, or by you during first-run setup.
Plex. Sign in with your Plex account. Administrators can also import members straight from their Plex server, which creates accounts for people who already have access to the media you are building.
A member can link Plex to an existing local account, and sign in either way afterwards. An account without a password is asked for an email and one before disconnecting Plex, and signs in with those afterwards.
Roles
| Role | Can do |
|---|---|
| Admin | Everything. Manage members, all settings, integrations, engine tuning, jobs, logs, and the review and quarantine queues. |
| Trusted | Everything a user can do. Requests are never held for approval, and member quotas do not apply. |
| User | Search, request, manage their own library and playlists, connect their own discovery and library-source accounts, and set their own profile, theme, language, and notifications. |
A plain member, as these pages call one, has the User role. Administrator-only sections are hidden from members entirely, not shown and disabled. The first account created is the instance owner, shown as Owner, and cannot be demoted or deleted.
What is shared and what is not
Per member:
- Their own requests, which show who made them.
- Their own playlists.
- Their own connected accounts: Spotify, Last.fm, ListenBrainz, Plex, Navidrome, Jellyfin.
- Their own discovery mixes.
- Their own profile, theme, and language.
- Their own API keys, assistant connections, and music-app credentials.
- Their own notification destinations, and what each one receives.
Shared across the instance:
- The music library on disk. Everyone’s downloads go into the same library paths, and an administrator decides which path each request goes to.
- The download queue.
- Every other setting.
The approval queue
Off by default. When Require approval for members is enabled, anything a plain member requests is held rather than downloaded.
- Held requests sit in the
pending_approvalstate and are not queued. - An administrator approves or rejects them.
- Trusted members and administrators bypass the gate entirely.
- The gate applies however a request arrives, including when an album or playlist fills in, a library sync, a discovery playlist and an assistant.
Give the gate a purpose by promoting the people you do not want to review to trusted, rather than turning the gate off.
Download quotas
Off by default. An administrator can cap how much each member downloads, from Settings, then Members & access.
- Tracks. New tracks a member can request within a rolling number of days. Requests waiting for approval count. Retries and quality upgrades do not.
- Storage. Space a member’s music can take, counting downloads still on their way. A member’s own retries and resumes are checked against it too.
- Whole library. Downloads stop once the music in the library reaches this size. It applies to everyone, administrators included.
Trusted members and administrators are not limited per member. An administrator can give one member their own limits from the member’s edit dialog, and those replace the shared ones.
A request that would go over a quota is refused. Automatic requests, such as a library sync or a discovery playlist, are skipped and logged instead. Each member sees their own usage under Settings, then Account.
Managing members
Settings, then Members & access, administrators only.
- Add a local member, or import from Plex.
- Change a member’s role.
- Set a member’s own download quotas.
- Remove a member.
- See who owns what.
Sessions
Sessions last thirty days by default and are stored server-side, so revoking one takes effect immediately. A background job clears expired sessions.
Set COOKIE_SECURE=true when running behind an HTTPS reverse proxy.