docs: Add multiuser documentation and reposition Workflows by lstein · Pull Request #9099 · invoke-ai/InvokeAI

lstein · 2026-04-30T19:10:06Z

Summary

This PR migrates the multiuser documentation from docs-old into the new astro docs directory. It also moves the Workflows section into Features, which seems to be a more appropriate place for it than at the top level.

For convenience, this PR also updates the make docs Makefile target.

Related Issues / Discussions

QA Instructions

make docs will fire up astro
Browse the reorganized Features section.
Check for broken images and links.

Merge Plan

Simple merge.

Checklist

The PR has a short but descriptive title, suitable for a changelog
Tests added / updated (if applicable)
❗Changes to a redux slice have a corresponding migration
Documentation added / updated (if applicable)
Updated What's New copy (if doing a release after this PR)

joshistoast

Good overall add, but needs some updates.

Notes:

I added some quick suggestions for reordering to keep the non subgrouped docs links at the top of the respective parent group.
Lots of areas where the <Steps> component can be used for those instructional step-by-step ordered lists.
I think we should move the spec to the corresponding invoke dir as a feature readme, as opposed to being a docs page.
Found a couple broken links and left the fix suggestions.
The multi user docs leaves a lot of "not right now, but in the future for sure" promises, maybe it'd be better to just say "Not at this time, create an issue if this is important to you" verbiage?
There seemed to be an instance or two of inconsistency between existence of a feature. For example the user vs administrative docs seem to have different opinions on the existence of a user management webui. And there is also documentation now of a board having a desciption- which unless I'm mistaken doesn't exist.
I can have my LLM do another pass over this to see if I missed anything, but this was everything I found initially.

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

lstein · 2026-04-30T23:30:40Z

Thanks for the thorough review. There was a lot more cruft in the docs than I realized. I've implemented all the suggested changes and removed redundant and out-of-date content. Let me know if I missed anything.

joshistoast

PR remains inconsistent with real behavior. Features that don't exist, incorrect endpoints, inaccurate and conflicting feature behaviors, etc.

Also we should document GET /api/v1/auth/status

joshistoast · 2026-05-06T18:56:10Z

+**User Management:**
+
+```python
+GET    /api/v1/users           # List users (admin only)


These all should begin with /api/v1/auth/users

Fixed. Thank you.

joshistoast · 2026-05-06T18:57:06Z

+**Model Management (Write Operations):**
+
+```python
+POST   /api/v1/models/install          # Install model (admin only)


These are all /api/v2/models

joshistoast · 2026-05-06T18:57:23Z

+**Model Management (Read Operations):**
+
+```python
+GET /api/v1/models/                    # List models (all users)


/api/v2/models

joshistoast · 2026-05-06T19:00:48Z

+
+#### Change Password
+
+**Endpoint:** `POST /api/v1/auth/change-password`


This does not exist

Removed docs.

joshistoast · 2026-05-06T19:01:25Z

+
+#### List Users
+
+**Endpoint:** `GET /api/v1/users`


Suggested change

**Endpoint:** `GET /api/v1/users`

**Endpoint:** `GET /api/v1/auth/users`

joshistoast · 2026-05-06T19:19:11Z

+4. Cancel stuck or problematic tasks
+</Steps>
+
+**User Statistics:**


Can't find this feature

Yeah, never got implemented, like a number of other nice to have features. Removed.

joshistoast · 2026-05-06T19:20:26Z

+- Full model management (add, delete, configure models)
+- Create and manage user accounts
+- View and manage all users' generation queues
+- View and manage all users' boards, images, and workflows (including system-owned legacy content)


Suggested change

- View and manage all users' boards, images, and workflows (including system-owned legacy content)

- View and manage all users' boards, images, and workflows

joshistoast · 2026-05-06T19:23:40Z

+
+**Response:**
+
+```json


Returns a plain array, no pagination

Shape needs to be:

[ { "user_id": "string", "email": "string", "display_name": "string", "is_admin": false, "is_active": true, "created_at": "2026-05-07T21:12:09.008Z", "updated_at": "2026-05-07T21:12:09.008Z", "last_login_at": "2026-05-07T21:12:09.008Z" } ]

Returns a plain array without items

joshistoast · 2026-05-06T19:25:08Z

+      "display_name": "John Doe",
+      "is_admin": false,
+      "is_active": true,
+      "created_at": "2024-01-15T10:00:00Z",


Add updated_at field below here

joshistoast · 2026-05-06T19:29:27Z

+
+**Firewall Rules:**
+
+It is best to restrict access to trusted networks and remote IP addresses, or use a VPN to connect to your home network. Rate limit connections to InvokeAI's authentication endpoint `http://your.host:9090/login`.


Login endpoint is /api/v1/auth/login

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

joshistoast

Found a few more things, clarified another thing. We're getting closer.

joshistoast · 2026-05-07T21:13:11Z

+
+**Response:**
+
+```json


Shape needs to be:

[ { "user_id": "string", "email": "string", "display_name": "string", "is_admin": false, "is_active": true, "created_at": "2026-05-07T21:12:09.008Z", "updated_at": "2026-05-07T21:12:09.008Z", "last_login_at": "2026-05-07T21:12:09.008Z" } ]

Returns a plain array without items

joshistoast · 2026-05-07T22:00:30Z

+# Session configuration (multi-user mode only)
+jwt_secret_key: "your-secret-key-here"  # Auto-generated if not specified
+jwt_token_expiry_hours: 24  # Default session timeout
+jwt_remember_me_days: 7  # "Remember me" duration


Suggested change

# Session configuration (multi-user mode only)

jwt_secret_key: "your-secret-key-here" # Auto-generated if not specified

jwt_token_expiry_hours: 24 # Default session timeout

jwt_remember_me_days: 7 # "Remember me" duration

# Optional password policy

strict_password_checking: true # Enforce uppercase/lowercase/number requirements

These seem to still be present

joshistoast · 2026-05-07T22:03:34Z

+
+4. Restart InvokeAI
+
+**Alternative:** Remove `jwt_secret_key` from config to trigger setup wizard (will create new admin).


Suggested change

**Alternative:** Remove `jwt_secret_key` from config to trigger setup wizard (will create new admin).

**Alternative:** There is no supported config-based shortcut to rerun the setup wizard once an administrator already exists. If the admin password is lost, reset it directly in the database or by using the user-management tooling.

Fixed, and gave the correct recipe for reentering setup mode.

joshistoast · 2026-05-07T22:11:04Z

+# Before (single-user)
+GET /api/v1/boards/  # Returns all boards
+
+# After (multi-user)
+GET /api/v1/boards/  # Returns only current user's boards


Suggested change

# Before (single-user)

GET /api/v1/boards/ # Returns all boards

# After (multi-user)

GET /api/v1/boards/ # Returns only current user's boards

# Before (single-user)

GET /api/v1/boards/?all=true # Returns all boards

# After (multi-user)

GET /api/v1/boards/?all=true # Returns boards the current user can access, including their own boards plus shared/public boards; admins can see all boards

joshistoast · 2026-05-07T22:13:24Z

+**Generate Image:**
+
+```bash
+curl -X POST http://localhost:9090/api/v1/sessions/ \


This endpoint does not exist

Something was hallucinating. Wouldn't it be nice to have a simple image generation endpoint?

It would be

joshistoast · 2026-05-07T22:14:46Z

+cors_origins:
+  - "http://localhost:3000"
+  - "https://myapp.example.com"


Suggested change

cors_origins:

- "http://localhost:3000"

- "https://myapp.example.com"

allow_origins:

- "http://localhost:3000"

- "https://myapp.example.com"

allow_credentials: true

allow_methods:

- "*"

allow_headers:

- "*"

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

…er' into lstein/docs/multiuser

… password requirement

joshistoast

Almost there, found a few more discrepancies, and some were even from my own suggestions (left suggested fixes for those). Clarified what happens to boards on multiuser switching edge cases, a typo here or there, and highlighted some api response docs

joshistoast · 2026-05-09T23:17:50Z

+
+**Response:**
+
+```json


joshistoast · 2026-05-09T23:23:26Z

+```json
+{
+  "success": true
+}
+```


On success it returns a 204 No Content not a json with status. If there's an error the response is 422 with json:

{ "detail": [ { "loc": [ "string", 0 ], "msg": "string", "type": "string" } ] }

joshistoast · 2026-05-09T23:25:06Z

+<Steps>
+1. Enter your email address (this will be your login name)
+2. Create a display name (this will be the name other users see)
+3. Choose a strong password. The following criteria are required with `strict_password_checking_enabled: true`.


Suggested change

3. Choose a strong password. The following criteria are required with `strict_password_checking_enabled: true`.

3. Choose a strong password. The following criteria are required with `strict_password_checking: true`.

My bad on my last suggestion lol

joshistoast · 2026-05-09T23:25:33Z

+5. Click **Create Administrator Account**
+</Steps>
+
+With `strict_password_checking_enabled` disabled, you'll be warned if you choose a


Suggested change

With `strict_password_checking_enabled` disabled, you'll be warned if you choose a

With `strict_password_checking` disabled, you'll be warned if you choose a

My bad on my earlier suggestion

joshistoast · 2026-05-09T23:39:19Z

+- `shared` -- read/write to the owner and administrator, read-only to everyone else
+- `public` -- read/write by everyone
+
+#### List One Boards


Suggested change

#### List One Boards

#### Get One Board

joshistoast · 2026-05-09T23:45:17Z

+JWT secrets are generated automatically and stored in the
+database. You can hard-code a secret as shown above for
+development/testing purposes. Session lifetimes default to 24 hours by
+default, or 7 days when the user selects "Remember me", unless
+manually overridden in `invokeai.yaml` as shown above.


Suggested change

JWT secrets are generated automatically and stored in the

database. You can hard-code a secret as shown above for

development/testing purposes. Session lifetimes default to 24 hours by

default, or 7 days when the user selects "Remember me", unless

manually overridden in `invokeai.yaml` as shown above.

JWT secrets are generated automatically and stored in the database. Session lifetimes default to 24 hours, or 7 days when the user selects "Remember me". See Secret Key Management below if you need to rotate the JWT secret.

This is technically more correct, since there's no manual override 'above'. My bad.

joshistoast · 2026-05-09T23:49:09Z

+
+### Going From Multi-User to Single-User Mode
+
+If an InvokeAI instance was in multiuser mode and then restarted in single user mode (by setting `multiuser: false` in the configuration file), all users' boards will be consolidated in one place. Any images that were in "Uncategorized" will be merged together into a single Uncategorized board. If, at a later date, the server is restarted in multi-user mode, the boards and images will be separated and restored to their owners.


Suggested change

If an InvokeAI instance was in multiuser mode and then restarted in single user mode (by setting `multiuser: false` in the configuration file), all users' boards will be consolidated in one place. Any images that were in "Uncategorized" will be merged together into a single Uncategorized board. If, at a later date, the server is restarted in multi-user mode, the boards and images will be separated and restored to their owners.

If an InvokeAI instance was in multiuser mode and then restarted in single user mode (by setting `multiuser: false` in the configuration file), all users' boards will be consolidated in one place. Any images that were in "Uncategorized" will be merged together into a single Uncategorized board. If, at a later date, the server is restarted in multi-user mode, the boards and images will be assigned to the internal 'system' user. Admins can access this legacy content, and will not be restored to original owners.

joshistoast · 2026-05-09T23:52:20Z

+def is_multiuser_enabled(base_url):
+    """Check if multi-user mode is enabled (authentication required)."""
+    response = requests.get(f"{base_url}/api/v1/boards/")
+    return response.status_code == 401  # 401 = auth required


Suggested change

def is_multiuser_enabled(base_url):

"""Check if multi-user mode is enabled (authentication required)."""

response = requests.get(f"{base_url}/api/v1/boards/")

return response.status_code == 401 # 401 = auth required

def is_multiuser_enabled(base_url):

response = requests.get(f"{base_url}/api/v1/auth/status")

response.raise_for_status()

return response.json()["multiuser_enabled"]

This is exposed in the auth status like so

joshistoast · 2026-05-09T23:54:43Z

+
+### Adding and Modifying Users
+
+If you are logged in as Administrator, you can add additional users. Click on the small "person silhouette" icon at the bottom left of the main Invoke screen and select "User Management:"


Suggested change

If you are logged in as Administrator, you can add additional users. Click on the small "person silhouette" icon at the bottom left of the main Invoke screen and select "User Management:"

If you are logged in as Administrator, you can add additional users. Click on the small "person silhouette" icon at the bottom left of the main Invoke screen and select "User Management"

lstein added 2 commits April 30, 2026 15:06

docs: added multi-user mode and moved workflows under features

2742dca

docs: finish moving workflows under features/

8e293ee

lstein assigned joshistoast Apr 30, 2026

lstein requested a review from joshistoast April 30, 2026 19:10

github-actions Bot added Root docs PRs that change docs labels Apr 30, 2026

lstein added the v6.13.x label Apr 30, 2026

lstein added this to Invoke - Community Roadmap Apr 30, 2026

lstein moved this to 6.13.x Theme: MODELS in Invoke - Community Roadmap Apr 30, 2026

joshistoast requested changes Apr 30, 2026

View reviewed changes

lstein and others added 3 commits April 30, 2026 17:16

Update docs/src/content/docs/features/Canvas/text-tool.mdx

74c1e47

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

Update docs/src/content/docs/features/hotkeys.mdx

5f2f56d

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

docs(multiuser): fix links, remove redundant sections

04bfde9

lstein added 2 commits April 30, 2026 20:03

Merge branch 'main' into lstein/docs/multiuser

b41f73e

Merge branch 'main' into lstein/docs/multiuser

b2e3f6c

joshistoast requested changes May 6, 2026

View reviewed changes

lstein and others added 4 commits May 6, 2026 22:38

Merge branch 'main' into lstein/docs/multiuser

f69dfed

Update docs/src/content/docs/features/Multi-User Mode/api-guide.mdx

1fe91a2

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

docs(multiuser): address issues raised in 6 May review

4ea31ed

docs(multiuser): fix merge conflicts

aa746a8

joshistoast requested changes May 7, 2026

View reviewed changes

lstein and others added 5 commits May 7, 2026 20:42

Update docs/src/content/docs/features/Multi-User Mode/api-guide.mdx

a3e1868

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

Update docs/src/content/docs/features/Multi-User Mode/api-guide.mdx

d7da02d

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

docs(multiuser): more doc fixes

471dd52

Merge remote-tracking branch 'refs/remotes/origin/lstein/docs/multius…

2ccfd0a

…er' into lstein/docs/multiuser

Merge branch 'main' into lstein/docs/multiuser

3463c79

lstein requested a review from joshistoast May 9, 2026 14:27

docs(multiuser): remove outdated jwt config entries and reword strong…

0863f51

… password requirement

lstein force-pushed the lstein/docs/multiuser branch from ffee730 to 0863f51 Compare May 9, 2026 22:24

joshistoast requested changes May 9, 2026

View reviewed changes


		#### Change Password

		Endpoint: `POST /api/v1/auth/change-password`

	Endpoint: `GET /api/v1/users`
	Endpoint: `GET /api/v1/auth/users`

	- View and manage all users' boards, images, and workflows (including system-owned legacy content)
	- View and manage all users' boards, images, and workflows


		Firewall Rules:

		It is best to restrict access to trusted networks and remote IP addresses, or use a VPN to connect to your home network. Rate limit connections to InvokeAI's authentication endpoint `http://your.host:9090/login`.


		4. Restart InvokeAI

		Alternative: Remove `jwt_secret_key` from config to trigger setup wizard (will create new admin).

	Alternative: Remove `jwt_secret_key` from config to trigger setup wizard (will create new admin).
	Alternative: There is no supported config-based shortcut to rerun the setup wizard once an administrator already exists. If the admin password is lost, reset it directly in the database or by using the user-management tooling.

	3. Choose a strong password. The following criteria are required with `strict_password_checking_enabled: true`.
	3. Choose a strong password. The following criteria are required with `strict_password_checking: true`.

	With `strict_password_checking_enabled` disabled, you'll be warned if you choose a
	With `strict_password_checking` disabled, you'll be warned if you choose a


		### Going From Multi-User to Single-User Mode

		If an InvokeAI instance was in multiuser mode and then restarted in single user mode (by setting `multiuser: false` in the configuration file), all users' boards will be consolidated in one place. Any images that were in "Uncategorized" will be merged together into a single Uncategorized board. If, at a later date, the server is restarted in multi-user mode, the boards and images will be separated and restored to their owners.


		### Adding and Modifying Users

		If you are logged in as Administrator, you can add additional users. Click on the small "person silhouette" icon at the bottom left of the main Invoke screen and select "User Management:"


		Response:

		```json


		Response:

		```json


		Response:

		```json

Conversation

lstein commented Apr 30, 2026

Summary

Related Issues / Discussions

QA Instructions

Merge Plan

Checklist

Uh oh!

joshistoast left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lstein commented Apr 30, 2026

Uh oh!

joshistoast left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joshistoast left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment