Users, roles and access

Account model#

Every regular viewing session belongs to a Finetic user. Accounts keep progress, favourites, track preferences, devices and history separate while the underlying catalogue remains shared.

Fixed roles#

Permissions are checked by server middleware. Navigation visibility improves clarity but is not relied upon for access control.

Creating a user#

Open Admin → Users, choose Create user, set a unique username and display name, assign a role and choose media access. New non-administrator accounts should receive explicit assignments rather than silently inheriting everything.

Email invitation is available only when SMTP is completely configured. If it is unavailable, the control remains disabled and explains which administrator configuration is missing.

Account status#

Disabled accounts cannot create new authenticated sessions. Existing sessions can be revoked from the user detail view. Protect the final enabled administrator: Finetic prevents actions that would leave the server without a manageable account.

Devices and sessions#

Sessions record creation time, last activity and a useful client identity. A user can revoke another session or sign out everywhere else. Administrators can revoke sessions for an account without learning its password.

Fire TV and Android use revocable device credentials created through pairing. Removing a television from Devices & Sessions prevents it from refreshing access.

Security events#

Recent login attempts, password changes, session revocation and administrator account actions are retained according to security policy. IP retention is configurable; removing IP addresses reduces diagnostic detail but improves privacy.

Practical household setup#

• Keep one named administrator for normal server management.
• Give each viewer a separate user account so progress remains useful.
• Use restricted accounts for children or limited libraries.
• Use guest sharing—not a reusable household password—for temporary external access.