Managing Users

User management happens on the Users tab, which is visible only to admins. The tab lists every account with its username, role, enabled state, assignment counts, and a truncated view of its API key.

Creating a user

1. Click Add User at the top of the Users tab.
2. Enter a username. Usernames are case-insensitive and must be unique. Minimum length is 2 characters.
3. Enter a password (minimum 4 characters).
4. Choose a role — Admin, Operator, or Viewer. See Roles and permissions.
5. Click Create.

The new account is immediately active. Operators and Viewers start with no assignments, which means they see no players or zones until you assign some — see Player and zone assignments.

An API key is not generated automatically. Click Regenerate Key on the row if the user needs one.

Editing a user

Click the edit icon on a row to change the user's role or toggle Enabled. Username is fixed for the lifetime of the account — create a new user and delete the old one if you need to rename.

A few guard rails apply:

• You cannot change your own role. Log in as a different admin to demote yourself.
• You cannot disable or demote the last enabled admin. MZAP blocks the change and surfaces an error so you can't lock yourself out.

Resetting a password

Click the key icon on a row and enter the new password. The old password is replaced immediately; existing sessions for that user remain valid until the user logs out or the workspace is locked.

Non-admin users can change their own password from the user menu but cannot change anyone else's.

Disabling vs. deleting

Disable an account to block login without losing its configuration. The user's assignments, API key, and password hash stay intact, so you can re-enable the account later and everything resumes. Disabled users also cannot authenticate with their API key.

Delete an account to remove it permanently. Deleting a user:

• Invalidates every active session for that user immediately.
• Revokes the user's API key.
• Does not remove the user's entry from any workspace assignment lists — stale entries are simply ignored. Re-creating a user with the same username restores their assignments.

Two guards prevent foot-guns:

• You cannot delete your own account.
• You cannot delete the last enabled admin.

Hiding sections from a user

To declutter the interface for a specific Operator or Viewer, hide the sidebar sections they don't need:

1. On the Users tab, click the user's Assignments cell.
2. Open the Features tab.
3. Untick the sections to hide — Matrix, Jingles, Playlists, Library, Radio Browser, and Scheduler. Zones and Players are always shown.
4. Click Save.

The unticked sections disappear from that user's sidebar on the desktop and from the navigation drawer in the mobile layout.

• This is a tidy-up, not a permission. A hidden section is still reachable through the API, an API key, or the MCP integration with whatever access the user's role already grants. Use roles and assignments to control what a user may actually do.
• The list can only remove sections, never add them — a section the user's role does not allow stays hidden regardless of this tab.
• Admins always see every section; the Features tab is not offered for admin accounts.
• The setting is stored with the user account, so it applies in every workspace.
• The change reaches a signed-in user the next time the app checks their status — on reload, when a workspace loads, or when they sign in again.

Pairing a phone or tablet for a user

Each row on the Users tab has a QR icon that opens the pairing code for that user, for the MZAP Remote mobile app. The dialog shows the code, a network-address picker when the PC has more than one address, and a warning naming the user and role the code grants — anyone who scans it gets that user's level of access.

• The code carries the user's existing API key. To revoke a paired device, regenerate that user's API key.
• The key is fetched only when the dialog opens, not when the page loads.
• The icon is disabled, with a tooltip explaining why, while network access is off or a restart is pending, and for a disabled user.
• The AI Assistant user can't be paired with a phone.

The same code is also available under Settings → Pair mobile device.

The AI Assistant user

Clicking Connect AI apps under Settings → MCP server adds an AI Assistant user. AI apps use its API key to control MZAP.

• It is an Admin by default. Change its role, or its assigned players and zones, to limit what AI apps can do.
• It cannot sign in and has no password. Its key works only for AI apps, not for the REST API.
• Disabling it disconnects every AI app.
• It does not count as an Admin when you turn on authentication: you need another Admin user for that.

Toggling global authentication

The header of the Users tab contains the Enable Authentication / Disable Authentication button.

• Enable is only available when at least one enabled admin user exists, other than the AI Assistant.
• Disable prompts for confirmation. Once disabled, the login dialog stops appearing and every request is treated as fully privileged. Existing user accounts are preserved — enabling auth again reactivates them immediately.

API equivalents

Everything above is exposed on the API for scripting bulk changes or integrating with an external identity system.

Operation	Endpoint
List users	GET /api/users
Create user	POST /api/users
Update role, enabled state, or hidden sections	PUT /api/users/{id}
Change password	PUT /api/users/{id}/password
Delete user	DELETE /api/users/{id}
Get a user's API key	GET /api/users/{id}/api-key
Regenerate API key	POST /api/users/{id}/regenerate-key
Toggle global auth	PUT /api/settings with authEnabled

Hidden sections are set with a hiddenFeatures array on PUT /api/users/{id} using the keys matrix, jingles, playlists, library, radio, and scheduler — omit the field to leave it unchanged, or send [] to show everything again. Unknown keys are ignored. GET /api/users, GET /api/auth/status, and POST /api/auth/login return the list.

All of these require an admin token except change password, which a user may call for their own account. Full request and response schemas are in the API Reference.