Admin
Your whole account in one place — every workspace, every bot, made and renamed and deleted from inside the app — behind a password that is yours alone and appears in nobody’s user list, not even your own app’s.
The account behind your token
Every workspace and every bot on your own account, made, renamed, deleted and handed out from inside the app you just scaffolded. The operator’s view of the whole deployment, in the deployment itself.
Lists the whole account
Every workspace the token holds, each with how many bots it has against what its plan allows. The one this app was built on comes first and says so.
Makes a bot
Named, in a workspace you pick, and — where your app has accounts of its own — handed to one of them on the way in. Switch the whole app to it from the topbar the moment the dialog closes.
Renames and deletes
The name is editable in the drawer, and a delete takes the bot’s flows, contacts and conversations with it. The last bot in a workspace is refused the first time, with what it would cost.
Opens one bot in full
Its id, when it was made, its time zone, country and industry, the channels connected to it, and the teammates it belongs to. And what your credentials are actually allowed to do to it.
Hands a bot to a person
Who in your app reaches which bot, granted and revoked one person at a time. Owners and admins already reach every bot in their workspace by role, so they hold no grant at all.
Says what is broken
Whether the token is still accepted, which fence is in force and how many bots it holds, whether the database answers. And the proxy’s own list of what this deployment is missing.
A door that is not an identity
The password sits beside the token in the server-only half of the environment, so the panel opens on a deployment that has no accounts at all and on one whose accounts belong to its customers. Whoever can read that file already holds the token, so the panel grants nothing the credential did not.
Your users never see it
It is nowhere in the navigation, before you unlock it or after, so a customer signed into your app has no door to find and nothing to ask about. You get in by typing /admin, and nothing on screen ever advertises that it is there.
A delete that says what it costs
Chatfuel deletes a workspace when its last bot goes — verified live, twice — so that delete is refused the first time, with the sentence saying what goes with it, and allowed on a second, deliberate click. The workspace this app is built on is refused however many times you ask.
A secret is a yes or a no
The token, the service-role key and the admin password are reported as present or absent and nothing more, because a value on a browser screen makes that screen as sensitive as the environment file. The variable’s name is there, since an operator fixing a deployment needs to know which one to set.
Open it, read it, change it
Three tabs behind one password. Every question they ask needs the master token, so all of it is asked on the server and none of it from the browser.
Open /admin
There is no menu item; the address is the way in. The password buys one signed, HttpOnly cookie good for twelve hours, and nothing else is written to the browser.
Read the account
The workspaces on a rail with their bot counts against the plan, one workspace’s bots beside them, and one bot in a drawer over both. Health is a tab of its own because the token check is a real round trip to Chatfuel, asked when you open it rather than on every load.
Change it
Create, rename, delete, grant, revoke — the bot in Chatfuel and its row in your own database, each in the order that leaves neither side holding a bot the other has forgotten. The proxy’s workspace fence and auth gate are then cleared whole, so a bot the panel just made is not refused by the app for the next minute.
Three tabs, and what each answers
The first is the address itself: /admin is the bots. The Access tab exists only where the deployment has a database, and the server decides that rather than the browser guessing it from an environment variable.
| Name | What it shows |
|---|---|
| Bots | The default tab. |
| Workspaces | Every workspace on the account, on a rail, each with how many bots it holds against what its plan allows. This deployment’s own comes first, then the ones with bots in them, then the rest by name. |
| Bots | The chosen workspace’s bots beside the rail — name and id. Open one to look at it, or point the whole app at it. |
| One bot | A drawer over both: its id, when it was made, its workspace, time zone, country and industry, the channels connected to it, the teammates it belongs to, and what your credentials may do to it. |
| New bot | A name and a workspace, and where the app has accounts of its own, the account to hand it to. A workspace with no room left is offered and refused by the server rather than hidden. |
| Rename and delete | The name is edited in place. A delete confirms, and a last-bot delete confirms twice — the second time with the sentence the server just wrote. |
| Access | Only where this deployment has a database. |
| Everyone in the app | Every account across every workspace the app has — the view no signed-in person has, because no signed-in person belongs to more than one. |
| The bots they reach | Per person. Owners and admins reach every bot in their workspace by role and hold no grant rows, so their column says that instead of listing bots nothing could revoke. |
| Grant and revoke | One bot and one person at a time. The proxy’s auth gate is cleared straight after, because somebody’s reachable bots just changed. |
| Health | |
| Whether it still works | The token check is a live query to Chatfuel, asked when the tab is opened rather than on every load — the other two tabs have no use for it. |
| What is missing | Every secret as present or absent, every resolved name in full, and the proxy’s own list of configuration problems above the tiles. |
What the health page reports
Ten lines that answer “can this deployment do what it is supposed to right now”. Every secret among them is a yes or a no; the value never leaves the server.
| Name | Where it comes from | What it says |
|---|---|---|
| Tiles | ||
| Chatfuel token | Whether the token is set at all, and whether a live query carrying it just came back. | Accepted, Refused or Missing |
| Account | The name and email the token answers with — which Chatfuel this is. | The account behind the token |
| Bot fence | Which fence is in force, and how many bots it is holding at this moment. | Off, a count, or Unavailable |
| Sign-in | The proxy’s auth mode, which is what the Accounts module turns on. | On, off or misconfigured |
| Database | Configured, holding a service-role key, and answering a ping that reads no rows on purpose — so a migration problem is not reported as an outage. | Yes, No, or Not configured |
| Publish queue | Whether its routes are mounted on this deployment. | Yes or No |
| Configuration | Resolved, and named rather than printed. | |
| Chatfuel API | The base URL every upstream call is going to. | The URL in force |
| Token variable | Which environment name the token is read from. | A name, never a value |
| Home workspace | The workspace this deployment was built on, and the one it protects. | Its id, when set |
| Outbound | Whether calls leave directly or through a proxy the environment names. | The route out |
What it holds
The door’s numbers are the module’s own, chosen against a host that answers each request from a fresh instance: a throttle kept in one process’s memory has nothing to share its counters in, so the length of the secret is what actually stands between the panel and a guess.
| Admin password, minimum | 16 characters |
| A generated one | 32 characters |
| One unlock lasts | 12 hours |
| Pause on every attempt, right or wrong | 250 ms |
| Wrong answers before the wait starts | 3 |
| Longest wait after that | 5 minutes |
| Callers the throttle tracks before it sweeps | 1,000 |
| Any name you type | 120 characters |
| A bot or workspace id | 64 characters |
| The token check on the health page | 10 seconds |
FAQs
No, and you do not need an account in your own app either. The deployment holds one master token for one Chatfuel account, so there is no second Chatfuel login to check; and the app’s own accounts belong to its customers, who are not the operator. The credential is a password in the server half of the environment, beside the token — whoever can read that file already holds the token, so the panel grants nothing the credential did not. That is also why the admin routes deliberately skip the proxy’s auth gate and workspace fence: those exist to keep a request away from bots that are not the caller’s, and the account-wide view they withhold is the entire point of this panel. The route module says so at the top.