Super Admin
System-wide administration for self-hosted deploymentsEdit
Super Admin provides platform-level management for self-hosted deployments, including user management, organization oversight, scheduler control, and system health monitoring.
Enable Super Admin
There are two ways to enable super admin access:
Recommended
Run the bootstrap script inside the app container:
docker compose exec app node scripts/bootstrap-admin.js admin@yourdomain.comBootstrap is manual — run the script explicitly. For convenience, the script also reads SUPER_ADMIN_EMAIL from the environment as a fallback if no argument is provided, but it does not auto-promote on application startup.
Set SUPER_ADMIN_EMAIL and run the bootstrap script:
SUPER_ADMIN_EMAIL=admin@yourdomain.com
docker compose exec app node scripts/bootstrap-admin.jsIf SUPER_ADMIN_EMAIL is set and no email argument is provided, the script uses the environment variable value.
To revoke the system-level super admin role:
docker compose exec app node scripts/revoke-admin.js admin@yourdomain.comThis changes only the user's system role back to project_viewer and invalidates active sessions for that user. Organization memberships and project assignments are managed separately.
Overview
The Super Admin dashboard provides a system-wide view of all organizations, users, and queue status.
Organizations
View and manage all organizations in the system. See member counts, project counts, and organization status.
Users
Manage all users system-wide. View user details, organization memberships, and account status.
Queue Management
Monitor BullMQ queues for test execution, monitoring, and background jobs. View queue health, pending jobs, and processing status.
Locations
Manage geographic locations for multi-region monitoring and performance testing. Locations determine where workers run and which queues are created.
Adding a Location
- Navigate to Super Admin → Locations tab
- Click Add Location
- Fill in the fields described below and click Save
| Field | Required | Description |
|---|---|---|
| Code | Yes | Unique identifier used in queue names (e.g. us-east). Lowercase, 2–50 characters, letters/digits/hyphens only, no consecutive hyphens. Reserved codes (global, all, default, none, any, local) are blocked. |
| Name | Yes | Human-readable display name (e.g. "US East"). |
| Region | No | Geographic description (e.g. "Ashburn, Virginia"). |
| Flag | No | Emoji flag for the UI (e.g. 🇺🇸). |
| Coordinates | No | Latitude/longitude for map visualization. |
| Default | No | Set as the default K6 job execution location. |
| Enabled | No | Activate the location and create its queues. |
Location Status
| Status | Meaning |
|---|---|
| Active | Location is enabled and has workers connected (heartbeat detected) |
| Offline | Location is enabled but no workers are currently connected |
| Disabled | Location is toggled off — no queues are created |
Worker presence is detected automatically via heartbeat. Deploy a worker with the matching WORKER_LOCATION to bring a location online. See Multi-Location Deployment for setup instructions.
Default Location
The default location determines where K6 job executions run. Only one location can be default at a time — toggling a new default automatically clears the previous one.
Project Restrictions
Organization admins can restrict which locations a project is allowed to use. See Project Location Restrictions for details.
Capabilities
| Feature | Description |
|---|---|
| System Statistics | View total users, organizations, projects, jobs, tests, monitors, and runs |
| Organizations | View and manage all organizations |
| Users | Manage all users system-wide, ban/unban accounts |
| Impersonation | Log in as any user for troubleshooting |
| Queue Monitoring | Real-time BullMQ queue stats via Bull Dashboard |
| Location Management | Add, edit, enable/disable geographic locations for multi-region deployments |
User Management
Manage all users across the platform:
- View Details — See user profile, email, and organization memberships
- Ban/Unban — Suspend accounts with a reason (banned users cannot log in)
- Impersonate — Log in as any user for troubleshooting
- Go to Super Admin → Users
- Find the user and click the menu (⋮)
- Select Impersonate
- If the user belongs to multiple organizations, select which one to impersonate into
- Click Impersonate User to confirm
Using Impersonation:
- a banner at the bottom shows "Impersonating" with the user's email
- Click Stop to return to your admin session
- You see the platform exactly as the user would
Security Notice: All impersonation sessions are logged for audit purposes. The original admin ID is preserved throughout the session.
To suspend a user account:
- Go to Super Admin → Users
- Find the user and click the menu (⋮)
- Select Ban User
- Enter a reason for the ban (minimum 20 characters)
- Click Ban User to confirm
Reversible Action: Banning is reversible. The user will be unable to sign in until unbanned, but all their data is preserved. To unban, click Unban from the same menu.
Banned users see a "User is banned" message when attempting to log in.
Security
- Single Admin — Only one super admin email is supported per deployment
- Validation — Multiple emails in
SUPER_ADMIN_EMAILwill cause a startup error - Audit Trail — All super admin actions are logged with timestamps
- Session Tracking — Impersonation sessions preserve the original admin ID for accountability