Admin Guide

Everything an admin needs to configure and manage the app.

Becoming an Admin

UPDATE profiles SET is_admin = true WHERE email = 'your@email.com';

Admin accounts bypass all rate limits and usage limits.

Provider Management

Settings → Provider Management

Adding a provider

Click Add Provider, enter your API key, click Save, then Test to verify.

Security

Keys are encrypted with AES-256-GCM and never sent to the client (displayed as ••••xxxx). ENCRYPTION_KEY is required.

Custom OpenAI-compatible endpoints

Supports OpenRouter, xAI, Ollama, LM Studio, and any OpenAI-compatible proxy.

Model Management

Settings → Model Management

Fields: Model ID, Display Name, Provider, Type, Input/Output Price, Default, Sort Order.

Model routing

• anthropic/* → Anthropic SDK
• google/* → Google AI SDK
• openai/*, openrouter/*, xai/*, custom → OpenAI-compatible adapter

Special-purpose models

Usage Limits

Settings → Usage Limits

Settings: Monthly Budget, Daily Conversation Limit, Warning Threshold (default 80%).

Enforcement: Budget check runs before every AI request. Conversation count is checked per-day. Admin accounts bypass all limits.

Per-user overrides and global defaults are both supported.

Rate Limiting

In-memory sliding window per user per category.

Usage Overview

Settings → Usage Overview

Shows: total spend, per-user breakdown, model usage, and spending trends. Click any user row for a detailed view.

User Management

Managed through Supabase SQL.

View all users

SELECT id, email, is_admin, created_at
FROM profiles
ORDER BY created_at DESC;

Grant or revoke admin

-- Grant
UPDATE profiles SET is_admin = true WHERE email = 'user@example.com';

-- Revoke
UPDATE profiles SET is_admin = false WHERE email = 'user@example.com';

Set a per-user monthly budget

UPDATE usage_limits
SET monthly_budget = 10.00
WHERE user_id = (SELECT id FROM profiles WHERE email = 'user@example.com');

Delete a user

-- Deletes profile and cascades to all user data
DELETE FROM auth.users WHERE email = 'user@example.com';

Controlling access

• SIGNUP_SECRET — share only with intended users
• Disable signups — remove or unset SIGNUP_SECRET
• OAuth — OAuth sign-in bypasses SIGNUP_SECRET; configure carefully

App Configuration

Priority: Admin Settings (DB) → Environment Variables → Hardcoded Defaults.

Database settings are cached for 5 minutes.

Environment variable reference