> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Server admin console

> Configure instance-wide settings and manage users from the Server Console

The Server Console is where a server administrator manages the settings, users, and resources of an entire Infisical instance.

> [!NOTE]
>
> The first user to set up an account on your Infisical instance becomes the
> server administrator.

## Accessing the server console

Select **Server Console** in the top navigation bar. The button is only shown to server administrators.

![Access the Server Console](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/admin-panels/access-server-admin-panel.png)

The console opens on **General**. The sidebar holds the rest of the instance settings.

## General

Instance-wide settings for signups, the default organization, LDAP email trust, the notices users see, and allowed storage hostnames.

![General settings](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/admin-panels/admin-panel-general.png)

![Notice settings](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/admin-panels/admin-panel-general-1.png)

### Allow user signups

**Signup mode** controls who can self-serve create an account on your instance. **Anyone** lets every visitor who reaches the instance sign up. **Disabled** blocks direct signup and OAuth account creation; SCIM and LDAP provisioning still create accounts, and existing users can still be invited to an organization.

### Allowed email domains

When **Signup mode** is **Anyone**, **Allowed email domains** limits signups to the domains you list, such as your company's. Leave it blank to allow any domain.

### Default organization

If you use SAML, LDAP, or OIDC for a single organization on your instance, set **Organization** to that organization. Users then skip entering the organization slug at login.

### Trust LDAP emails

By default, users provisioned through LDAP have to verify their email address on first login, which prevents email spoofing. Turn on **Trust LDAP emails** to skip that step for LDAP users across every organization on this instance.

For SAML and OIDC, email verification is skipped automatically when an organization [enforces SSO](https://infisical.com/docs/documentation/platform/sso/overview.md#sso-enforcement).

### Notices

Users see **Auth consent content** on the login page. Use it for anything they should read before signing in, such as a maintenance message or an access notice. HTML, Markdown, and plain text all work, so you can style it:

```
**You are entering a confidential website**
```

```html theme={"dark"}
<div style="font-weight: bold;">You are entering a confidential website</div>
```

![Auth consent content on the login page](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/admin-panels/auth-consent-usage.png)

**Page frame content** appears as a header and a footer on every page a signed-in user opens. It accepts the same formats.

![Page frame content on a signed-in page](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/admin-panels/page-frame-usage.png)

Select **Save** to apply either change.

### Allowed storage hostnames

If you store [PAM session recordings](https://infisical.com/docs/documentation/platform/pam/sessions/external-storage.md) on your own S3-compatible server, such as MinIO, add the server's hostname under **Hostnames** and select **Save**. Include the port if it isn't 443, such as `minio.example.com:9000`, and make sure the server accepts HTTPS connections. If the hostname resolves to a private IP address, also set [`S3_COMPATIBLE_STORAGE_ALLOW_INTERNAL_IP`](https://infisical.com/docs/self-hosting/configuration/envars#param-s3-compatible-storage-allow-internal-ip) to `true`.

An S3-Compatible Storage connection can then use the server as its endpoint, and browsers can play back recordings stored there. If the server expects a signing region other than `us-east-1`, as Garage does, enter it under **Region** on the connection.

## Authentication

Use **Login Methods** to choose the login methods available on the instance. Turn a method off here and no organization can use it.

![Authentication settings](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/admin-panels/admin-panel-auths.png)

## Resource overview

**Resource Overview** lists the organizations, users, machine identities, and email domains on the instance. Each list has its own entry in the sidebar.

On **Users**, search for a user by name or email, filter the list down to server admins, and select the three dot menu on a row to remove the user or change their server admin access.

![User identities in the Server Console](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/admin-panels/admin-panel-users.png)

## Access control

**Access Control** lists the server administrators of the instance. Select **Add Admin** to grant server admin access to an existing user.

## Other sections

The remaining sidebar entries have their own guides:

* **Encryption**: the KMS encryption strategy and the root encryption keys. See [Rotating the encryption key](https://infisical.com/docs/self-hosting/guides/rotating-the-encryption-key.md).
* **Environment Variables**: overrides for instance configuration, so you can change a value without redeploying. See [Environment variables](https://infisical.com/docs/self-hosting/configuration/envars.md#environment-variable-overrides).
* **Integrations**: the instance-wide settings for Slack and Microsoft Teams.
* **Caching**: invalidate the encrypted secrets cache.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.