Vodmill docs
 v1.0.0
Get help
● Set up · Day one

First steps
owner, secret key, first account.

What to do right after the server starts: create the console owner with the one-time setup code, secure the secret key, go through the setup list, create your first app account, and decide whether strangers may sign up.

Console at /adminApp at /app

01Create the console owner

The console at https://your-domain/admin is where you, the operator, run the service. Your customers never see it, and it has its own accounts, separate from the app's. On the first start the server log shows a one-time setup code:

[admin] No owner account yet. Open /admin and create it with this one-time setup code:

    XXXX-XXXX-XXXX-XXXX

[admin] The code is shown once, here only. Each start before the owner exists adds a new code; any printed code works until the owner is created.
  1. Find the code journalctl -u vodmill | grep -A 3 "setup code" (systemd) or docker logs vodmill (Docker).
  2. Open /admin The first screen asks for the code, your e-mail and a password.
  3. Sign in You land on the console's Overview. Turn on two-factor sign-in under Security & alerts.

Lost the owner password later? On the server, in the product folder:

cd /opt/vodmill
node --env-file=.env dist/src/server/recover-owner.js                    # lists the console members
node --env-file=.env dist/src/server/recover-owner.js you@agency.com     # prints a new one-time password
# Docker:
docker exec vodmill node dist/src/server/recover-owner.js you@agency.com

Add --reset-2fa to also remove two-factor sign-in. Access to the server is the authorisation: anyone who can run this command owns the console, so protect SSH.

02Secure the secret key

ADMIN_SECRET_KEY (64 hex characters) seals every API key you save in the console. If you did not set it in .env, the server generated one into DATA_DIR/.admin-secret-key and warned in the log (src/server/config.ts):

[vodmill] ADMIN_SECRET_KEY is not set: using a generated key in /opt/vodmill/data/.admin-secret-key.
[vodmill] Copy it into .env as ADMIN_SECRET_KEY and back it up: without it the saved API keys cannot be read.
  1. Read the generated key sudo cat /opt/vodmill/data/.admin-secret-key (Docker: docker exec vodmill cat /app/data/.admin-secret-key).
  2. Copy it into .env as ADMIN_SECRET_KEY=… and restart: sudo systemctl restart vodmill.
  3. Back it up in your password manager, separately from the server.
Do not lose it

A backup restored with a different key starts fine, but every saved API key has to be entered again, and connected YouTube channels and webhook secrets become unreadable. Never paste this key into a support request.

03Go through the setup list

The console's Get started page and Overview list what is still missing. In order:

  1. Brand: product name, accent colour, support e-mail (White label).
  2. Server: the public URL (https://…). Already set, and shown locked, when PUBLIC_URL is in .env.
  3. Transcription: the provider, and its key under Integrations (AI and transcription).
  4. AI: the model, once the Anthropic key is in.
  5. E-mail: the sender address for invites and password resets (needs the Resend key).
  6. Plans, Credit packs, Credits (Plans and credits).

Then open System health: it shows ffmpeg and ffprobe, free disk in DATA_DIR, the databases, every missing key with what it switches on, and the last backup. The whole console is described in Operator console.

04Create your first app account

The app (/app) has its own accounts. Two ways to get the first one.

From the server, with create-user.js:

cd /opt/vodmill
node --env-file=.env dist/src/server/create-user.js you@agency.com "Your name" --staff --credits 500
# Docker:
docker exec vodmill node dist/src/server/create-user.js you@agency.com "Your name" --staff --credits 500

It creates the account and its own workspace, adds the starting credits, and prints a one-time password:

Created you@agency.com in workspace "Your name's workspace" with 500 credits.
One-time password (shown once): …
Sign in at /app and keep it somewhere safe.
OptionEffect
--staffA staff account: owner of every workspace. Leave it out for a normal customer account.
--credits NStarting credits for the new workspace, shown in its history as "Operator: starting credits".

When you run the command as root and the service runs as the vodmill user, use sudo -u vodmill node … so the database files keep their owner.

From the console: Users, "Invite staff (e-mail)". You get a link to set a password. It is e-mailed when e-mail is set up, and always shown on the page.

Then open /app, sign in, and change the password under your account.

05Sign-up open or closed

Console, Product, Access:

ModeSettingWhat happens
Agency mode (default)"Anyone can sign up" OffOnly people you invite get an account. You create one workspace per client on the console's Workspaces page and invite people from the app's Team page. A sign-up attempt answers "Sign-up is by invitation."
Self-serve"Anyone can sign up" OnAnyone can create an account. They get their own workspace on the free plan, plus "Credits a new self-serve workspace gets" (0 by default).

The same section has:

  • Announcement banner: a line of text at the top of every app page.
  • Maintenance mode and Maintenance message: everyone except staff sees the message instead of the app; sign-in stays open (src/server/app.ts).
  • Blocked countries and Country header set by your proxy: visitors from the listed countries are refused by the app. This works only when a proxy in front of the server reports the visitor's country and you name its header (Security).

If campaigns are part of your offer, clippers need accounts too, so you will usually open sign-up. Before you go live, set up backups (Backups and restore).