Manual: administration and access
Roles, permissions, sign-in and Keycloak, accounts, API keys and the other settings.
Workspace roles
Each person has one role in the workspace. Roles don’t add up.
| Role | What they can do |
|---|---|
| Administrador (Administrator, and the owner) | Everything: settings, sign-in, accounts, AI, integrations. Reads and edits any document. |
| Gestor (Manager) | Invites members (not as administrator or AI manager), manages groups, document types, look, printing, emojis and import; creates skills and views the agent list. Reads and edits any document. Doesn’t touch sign-in, accounts, AI provider, semantic search, MCP, webhooks, telemetry, statistics, embeds or installation. |
| Gestor de IA (AI manager) | Configures provider, models, skills, agents, MCP and semantic search. Otherwise, counts as a member. |
| Membro (Member) | Uses the wiki according to each collection’s permissions. |
The workspace must always have at least one administrator. Only an administrator grants or removes the administrator and AI manager roles. Personal ClickUp, GitLab and GitHub tokens live in Configurações → Integrações (Settings → Integrations), for any role.
Per-collection permissions
In Configurar projeto (Configure project — the collection’s gear), Acesso (Access) section, give people or groups one of these roles:
| Collection role | Can |
|---|---|
| Owner (administra) | Edit and manage the collection’s access |
| Editor | Create and edit documents |
| Comentarista (Commenter) | Read and comment |
| Leitor (Reader) | Read only |
- When a person has more than one permission (direct and through a group), the highest wins.
- In a public collection, anyone not on the list gets the default role — out of the box, Editar (Edit). You can lower it all the way to Nada (só quem está na lista) (Nothing — only those on the list).
- Workspace administrators and managers read and edit any document, even in a closed collection. The AI manager doesn’t.
Members, invitations and groups
- Configurações → Membros (Members): invite by email and choose the role. An invitation is valid for 7 days. If the installation has SMTP, the email goes out on its own; the link also shows up right away, for you to copy and send.
- Configurações → Grupos (Groups): put people together (e.g. “Legal”) to grant access to collections in one go.
- Configurações → Contas (Accounts, administrator): block whoever shouldn’t sign in anymore. The block applies to every sign-in method and to the person’s API keys, and nothing they wrote is deleted. Unblock whenever you want.
How people sign in
In Configurações → Authentication:
- Iniciar Sessão (Sign in): turn E-mail (sign-in link), Passkeys and the single sign-on (SSO) switch on or off. Rótulo do botão (Button label) sets the SSO button text on the sign-in screen (empty = “Entrar com SSO”).
- Cadastro de membros (Member signup): with Cadastro autônomo (self-signup) on, anyone with an email from an allowed domain gets in through the email link without an invitation. Off, the email link only works for people who were invited.
- Restrictions: the list of domínios permitidos (allowed domains). An empty list accepts any domain. To restrict, add the domains before turning on self-signup or SSO.
SSO doesn’t depend on invitations. Anyone who authenticates on your Keycloak gets a member account on first sign-in, as long as the email domain is allowed. In that case, what controls entry is Keycloak itself and the domain list.
Each person registers their own passkeys in Configurações → Passkeys.
When SSO is available, the sign-in screen shows only the SSO button. To also show
email and passkey, the installation sets MOSTRAR_LOGIN_SEM_SSO=true.
Keycloak (SSO) from the settings screen
The Keycloak section, below “Iniciar Sessão”, configures the installation’s single sign-on without touching the server:
| Field | What it is |
|---|---|
| Emissor (issuer) | The realm address, e.g. https://auth.suaempresa.com/realms/empresa |
| Client ID and secret | The client created in Keycloak for the wiki |
| Apps aceitos pelo token (apps accepted by token) | The Keycloak clients (e.g. the desktop app) that may use their own token on the chat API |
| Limite por pessoa and limite por app (per-person and per-app limit) | Requests per minute for those apps (default 30 and 300) |
- Next to each field it shows where the value comes from: this screen, an environment
variable or
appsettings.json. The value saved on the screen takes priority. - A blank field on the screen goes back to the environment’s value. To turn off SSO from the server, the variable must exist and be empty (see Self-host).
- Before saving a new issuer, the wiki checks that it responds. If it doesn’t, nothing is saved. Testar (Test) checks the connection of what is already saved.
- The secret never comes back to the screen: it only shows whether one is stored.
- The change takes effect immediately, without a restart.
Since this configuration applies to the whole installation, any administrator can see it, but only someone who is an administrator of every workspace can edit it.
API keys
Each person generates their own keys in Configurações → APIs & Acesso (API &
Access). The key starts with nwk_, is shown only once when created and can expire in
7, 30 or 90 days, on a date, or never. It only works on the MCP server.
| Scope | Grants |
|---|---|
docs:ler | Read documents, search, ask |
docs:escrever | All of the above, plus create and change |
| (none) | The full access of the key’s owner |
The screen lists three more scopes (colecoes:gerenciar, exportacoes,
workspace:admin) that have no effect yet: a key with only those calls no tool at
all. Use docs:ler, docs:escrever or none.
The key never goes beyond the permissions of whoever created it. Revoke it at any time.
Other settings
| Where | What for |
|---|---|
| Detalhes (Details) | Look, name and logo on the sign-in screen, editor behavior and the NextBoard module |
| Impressão (Printing) | Header, footer, margins and text of the printed page and the PDF |
| Tipos de documento (Document types) | The team’s templates (see the AI manual) |
| Emojis | The team’s own emojis, for document and collection icons |
| Importar (Import) | Bring in Markdown, Confluence or another Next Wiki |
| Webhooks | Notify other systems on every change (see the API) |
| Telemetria (Telemetry) | Send errors to your OpenTelemetry collector |
| Estatísticas (Statistics) | Who uses it, and which projects, skills, agents and models |
| IA → LLM | Each workspace’s provider, key and model |
| IA → MCP | How to connect AI clients to this wiki’s MCP. The registry of external MCP servers that the screen also offers doesn’t give agents tools yet. |
| Embeds | Which services can be embedded in documents |
| Instalação (Installation) | The installed version, with a notice when a new one is out |
| Integrações (Integrations, personal) | Your ClickUp, GitLab and GitHub tokens |
Notifications: the bell currently notifies you when a NextBoard card is assigned to you. The switches on the notifications screen (document published, comment, mention…) don’t trigger notices yet.
Exportar (Export — the whole workspace) and Documentos compartilhados (Shared documents) are still under construction. To export today, use PDF or Word on each document.