> For the complete documentation index, see [llms.txt](https://wiki.crosswatch.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.crosswatch.app/crosswatch/settings/ui-settings/security.md).

# Security

Configure local login, managed users, two-factor authentication, external sign-in, and trusted reverse proxies.

Use this page to control who can sign in and how CW handles sessions.

### Local login

#### Username

Set the local CW admin username used on the login page.

#### New password

Set a new local CW password.

* Leave this blank to keep the current password
* Minimum length: `8`

#### Confirm password

Repeat the new password exactly.

CW will not save if the password fields do not match.

<figure><img src="https://565675962-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3rh5THg1PdhVsBt3GALo%2Fuploads%2Fw0TlinBsijz6HqGMuL89%2Fimage.png?alt=media&amp;token=01462994-2526-4575-a102-4e4e04f5eb2d" alt=""><figcaption></figcaption></figure>

### User Manager

Use **User Manager** to create and manage managed-user login accounts.

<figure><img src="https://565675962-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3rh5THg1PdhVsBt3GALo%2Fuploads%2FIj7G0TDLe7vRZFUCuc0T%2Fimage.png?alt=media&amp;token=b7a5e1bd-1565-460e-a904-643b36b83d31" alt="" width="375"><figcaption></figcaption></figure>

The administrator account always appears here. It has access to the complete CrossWatch installation. It is not restricted to a User Profile.

Managed users require a **User Profile**. A User Profile defines the resources delegated to an account.

```
User Profile = delegated resource scope
User Manager = login account and access mode
```

Create provider instances and synchronization resources before creating the account.

```
Provider instances
        ↓
Sync Pairs, Watchers, and Webhooks
        ↓
User Profile
        ↓
User Manager
        ↓
Managed user account
```

When no User Profiles exist, create one before adding a managed user.

#### Create and change users

Each managed user requires a username, password, User Profile, and access mode.

User Manager can change a managed user's:

* Username or password
* Assigned User Profile
* **Read Only** or **Full Access** access mode
* Enabled or disabled state

Changing the User Profile changes the account's resource scope. Changing access mode changes what the account may do within that scope.

Disable an account to prevent sign-in without removing its profile or resources. Deleting an account removes only its login. It does not delete delegated provider instances, pairs, Watchers, or Webhooks.

See [Managed users](/crosswatch/settings/connections/managed-users.md) for the delegation model and setup workflow.

### Two-factor authentication

Two-factor authentication (2FA) adds a six-digit authenticator-code prompt to an account.

The administrator configures it for the administrator and managed-user accounts.

2FA protects account authentication. It does not change the User Profile or Access Mode.

Related: [Two-factor authentication](/crosswatch/settings/ui-settings/security/two-factor-authentication.md).

### Session

#### Session caching

Choose how long the login session lasts.

* `Enabled` — keeps you signed in for the number of days you choose
* `Browser session only` — signs you out when the browser fully closes

This only affects the CW web session.

It does not change provider tokens.

#### Cached for days

Set how long a remembered session stays valid.

* Only used when `Session caching` is enabled
* Range: `1` to `365`

<figure><img src="https://565675962-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3rh5THg1PdhVsBt3GALo%2Fuploads%2FwBdVJhpoXppfNItumFUu%2Fimage.png?alt=media&amp;token=9c1ff4de-4c48-4e66-91b4-927871282bb5" alt=""><figcaption></figcaption></figure>

### External sign-in

Plex and OIDC sign-in are optional.

They add an external sign-in option to the login page.

Your local CW username and password stay as the fallback sign-in method.

#### Plex

* **Link Plex account** — link one Plex account for web sign-in
* **Unlink** — remove Plex sign-in from the login page

Related: [Plex SSO](/crosswatch/settings/ui-settings/security/plex-sso.md).

#### OIDC

OIDC authenticates CrossWatch accounts through an OpenID Connect provider.

Configure the provider once, then link an identity to each CrossWatch account.

Related: [OIDC sign-in](/crosswatch/settings/ui-settings/security/oidc-sign-in.md).

### Current session

This section shows the browser session you are currently using to access CW. If your account has other active browser sessions, CW shows those separately so it is clear which session is current and which sessions are not.

#### Log out

Use **Log out** to end only the session for the browser you are using right now.

<figure><img src="https://565675962-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3rh5THg1PdhVsBt3GALo%2Fuploads%2FcHtVmGMuc2tkeFzWsYqY%2Fimage.png?alt=media&amp;token=2dee9f62-600f-43b5-8c3f-cc03368c9614" alt=""><figcaption></figcaption></figure>

#### Other active sessions

If the same account is signed in from other browsers or devices, CW shows a compact summary of those sessions here.

#### Log out other sessions

Use **Log out other sessions** to sign out every other active browser session while keeping your current browser signed in. This is useful when you want to remove stale, duplicate, or forgotten logins without signing yourself out.

<figure><img src="https://565675962-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3rh5THg1PdhVsBt3GALo%2Fuploads%2FdQBCk3EmfbEb3yBOSlAn%2Fimage.png?alt=media&amp;token=8d0b2f5a-0afc-4ff6-b9b6-f85e46447959" alt="" width="375"><figcaption></figcaption></figure>

### Reverse proxy

#### Trusted reverse proxies (optional)

Use this only when CW sits behind a reverse proxy and you want correct client IP handling for login protection and rate limiting.

Enter proxy IP addresses or CIDR ranges separated by `;`.

Example:

```
127.0.0.1;192.168.2.1;192.168.2.0/16
```

{% hint style="warning" %}
Add the proxy server IPs here.

Do not add the IPs of end users connecting through the proxy.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://wiki.crosswatch.app/crosswatch/settings/ui-settings/security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.