docs: Add multiuser documentation and reposition Workflows by lstein · Pull Request #9099 · invoke-ai/InvokeAI

lstein · 2026-04-30T19:10:06Z

Summary

This PR migrates the multiuser documentation from docs-old into the new astro docs directory. It also moves the Workflows section into Features, which seems to be a more appropriate place for it than at the top level.

For convenience, this PR also updates the make docs Makefile target.

Related Issues / Discussions

QA Instructions

make docs will fire up astro
Browse the reorganized Features section.
Check for broken images and links.

Merge Plan

Simple merge.

Checklist

The PR has a short but descriptive title, suitable for a changelog
Tests added / updated (if applicable)
❗Changes to a redux slice have a corresponding migration
Documentation added / updated (if applicable)
Updated What's New copy (if doing a release after this PR)

joshistoast

Good overall add, but needs some updates.

Notes:

I added some quick suggestions for reordering to keep the non subgrouped docs links at the top of the respective parent group.
Lots of areas where the <Steps> component can be used for those instructional step-by-step ordered lists.
I think we should move the spec to the corresponding invoke dir as a feature readme, as opposed to being a docs page.
Found a couple broken links and left the fix suggestions.
The multi user docs leaves a lot of "not right now, but in the future for sure" promises, maybe it'd be better to just say "Not at this time, create an issue if this is important to you" verbiage?
There seemed to be an instance or two of inconsistency between existence of a feature. For example the user vs administrative docs seem to have different opinions on the existence of a user management webui. And there is also documentation now of a board having a desciption- which unless I'm mistaken doesn't exist.
I can have my LLM do another pass over this to see if I missed anything, but this was everything I found initially.

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

lstein · 2026-04-30T23:30:40Z

Thanks for the thorough review. There was a lot more cruft in the docs than I realized. I've implemented all the suggested changes and removed redundant and out-of-date content. Let me know if I missed anything.

joshistoast

PR remains inconsistent with real behavior. Features that don't exist, incorrect endpoints, inaccurate and conflicting feature behaviors, etc.

Also we should document GET /api/v1/auth/status

joshistoast · 2026-05-06T18:56:10Z

+**User Management:**
+
+```python
+GET    /api/v1/users           # List users (admin only)


These all should begin with /api/v1/auth/users

Fixed. Thank you.

joshistoast · 2026-05-06T18:57:06Z

+**Model Management (Write Operations):**
+
+```python
+POST   /api/v1/models/install          # Install model (admin only)


These are all /api/v2/models

joshistoast · 2026-05-06T18:57:23Z

+**Model Management (Read Operations):**
+
+```python
+GET /api/v1/models/                    # List models (all users)


/api/v2/models

joshistoast · 2026-05-06T19:00:48Z

+
+#### Change Password
+
+**Endpoint:** `POST /api/v1/auth/change-password`


This does not exist

Removed docs.

joshistoast · 2026-05-06T19:01:25Z

+
+#### List Users
+
+**Endpoint:** `GET /api/v1/users`


Suggested change

**Endpoint:** `GET /api/v1/users`

**Endpoint:** `GET /api/v1/auth/users`

joshistoast · 2026-05-06T19:19:11Z

+4. Cancel stuck or problematic tasks
+</Steps>
+
+**User Statistics:**


Can't find this feature

Yeah, never got implemented, like a number of other nice to have features. Removed.

joshistoast · 2026-05-06T19:20:26Z

+- Full model management (add, delete, configure models)
+- Create and manage user accounts
+- View and manage all users' generation queues
+- View and manage all users' boards, images, and workflows (including system-owned legacy content)


Suggested change

- View and manage all users' boards, images, and workflows (including system-owned legacy content)

- View and manage all users' boards, images, and workflows

joshistoast · 2026-05-06T19:23:40Z

+
+**Response:**
+
+```json


Returns a plain array, no pagination

Shape needs to be:

[ { "user_id": "string", "email": "string", "display_name": "string", "is_admin": false, "is_active": true, "created_at": "2026-05-07T21:12:09.008Z", "updated_at": "2026-05-07T21:12:09.008Z", "last_login_at": "2026-05-07T21:12:09.008Z" } ]

Returns a plain array without items

joshistoast · 2026-05-06T19:25:08Z

+      "display_name": "John Doe",
+      "is_admin": false,
+      "is_active": true,
+      "created_at": "2024-01-15T10:00:00Z",


Add updated_at field below here

joshistoast · 2026-05-06T19:29:27Z

+
+**Firewall Rules:**
+
+It is best to restrict access to trusted networks and remote IP addresses, or use a VPN to connect to your home network. Rate limit connections to InvokeAI's authentication endpoint `http://your.host:9090/login`.


Login endpoint is /api/v1/auth/login

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

joshistoast

Found a few more things, clarified another thing. We're getting closer.

joshistoast · 2026-05-07T21:13:11Z

+
+**Response:**
+
+```json


Shape needs to be:

[ { "user_id": "string", "email": "string", "display_name": "string", "is_admin": false, "is_active": true, "created_at": "2026-05-07T21:12:09.008Z", "updated_at": "2026-05-07T21:12:09.008Z", "last_login_at": "2026-05-07T21:12:09.008Z" } ]

Returns a plain array without items

joshistoast · 2026-05-07T22:00:30Z

+# Session configuration (multi-user mode only)
+jwt_secret_key: "your-secret-key-here"  # Auto-generated if not specified
+jwt_token_expiry_hours: 24  # Default session timeout
+jwt_remember_me_days: 7  # "Remember me" duration


Suggested change

# Session configuration (multi-user mode only)

jwt_secret_key: "your-secret-key-here" # Auto-generated if not specified

jwt_token_expiry_hours: 24 # Default session timeout

jwt_remember_me_days: 7 # "Remember me" duration

# Optional password policy

strict_password_checking: true # Enforce uppercase/lowercase/number requirements

joshistoast · 2026-05-07T22:00:45Z

+jwt_token_expiry_hours: 24  # Default session timeout
+jwt_remember_me_days: 7  # "Remember me" duration
+```
+


Suggested change

JWT secrets are generated automatically and stored in the database. Session lifetimes are currently fixed in code to 24 hours by default, or 7 days when the user selects "Remember me".

joshistoast · 2026-05-07T22:01:35Z

+the `invokeai.yaml` configuration file:
+
+```
+strict_password_checking: true`


Suggested change

strict_password_checking: true`

strict_password_checking: true

joshistoast · 2026-05-07T22:03:34Z

+
+4. Restart InvokeAI
+
+**Alternative:** Remove `jwt_secret_key` from config to trigger setup wizard (will create new admin).


Suggested change

**Alternative:** Remove `jwt_secret_key` from config to trigger setup wizard (will create new admin).

**Alternative:** There is no supported config-based shortcut to rerun the setup wizard once an administrator already exists. If the admin password is lost, reset it directly in the database or by using the user-management tooling.

Fixed, and gave the correct recipe for reentering setup mode.

joshistoast · 2026-05-07T22:11:04Z

+# Before (single-user)
+GET /api/v1/boards/  # Returns all boards
+
+# After (multi-user)
+GET /api/v1/boards/  # Returns only current user's boards


Suggested change

# Before (single-user)

GET /api/v1/boards/ # Returns all boards

# After (multi-user)

GET /api/v1/boards/ # Returns only current user's boards

# Before (single-user)

GET /api/v1/boards/?all=true # Returns all boards

# After (multi-user)

GET /api/v1/boards/?all=true # Returns boards the current user can access, including their own boards plus shared/public boards; admins can see all boards

joshistoast · 2026-05-07T22:13:24Z

+**Generate Image:**
+
+```bash
+curl -X POST http://localhost:9090/api/v1/sessions/ \


This endpoint does not exist

Something was hallucinating. Wouldn't it be nice to have a simple image generation endpoint?

joshistoast · 2026-05-07T22:14:46Z

+cors_origins:
+  - "http://localhost:3000"
+  - "https://myapp.example.com"


Suggested change

cors_origins:

- "http://localhost:3000"

- "https://myapp.example.com"

allow_origins:

- "http://localhost:3000"

- "https://myapp.example.com"

allow_credentials: true

allow_methods:

- "*"

allow_headers:

- "*"

joshistoast · 2026-05-07T22:18:39Z

+    - At least 8 characters long
+    - Contains uppercase letters
+    - Contains lowercase letters
+    - Contains numbers


Suggested change

- At least 8 characters long

- Contains uppercase letters

- Contains lowercase letters

- Contains numbers

With `strict_password_checking_enabled: true`:

- At least 8 characters long

- Contains uppercase letters

- Contains lowercase letters

- Contains numbers

With `strict_password_checking_enabled` disabled, weaker passwords may still be accepted, but strong passwords are still strongly recommended.

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

…er' into lstein/docs/multiuser

lstein added 2 commits April 30, 2026 15:06

docs: added multi-user mode and moved workflows under features

2742dca

docs: finish moving workflows under features/

8e293ee

lstein assigned joshistoast Apr 30, 2026

lstein requested a review from joshistoast April 30, 2026 19:10

github-actions Bot added Root docs PRs that change docs labels Apr 30, 2026

lstein added the v6.13.x label Apr 30, 2026

lstein added this to Invoke - Community Roadmap Apr 30, 2026

lstein moved this to 6.13.x Theme: MODELS in Invoke - Community Roadmap Apr 30, 2026

joshistoast requested changes Apr 30, 2026

View reviewed changes

lstein and others added 3 commits April 30, 2026 17:16

Update docs/src/content/docs/features/Canvas/text-tool.mdx

74c1e47

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

Update docs/src/content/docs/features/hotkeys.mdx

5f2f56d

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

docs(multiuser): fix links, remove redundant sections

04bfde9

lstein added 2 commits April 30, 2026 20:03

Merge branch 'main' into lstein/docs/multiuser

b41f73e

Merge branch 'main' into lstein/docs/multiuser

b2e3f6c

joshistoast requested changes May 6, 2026

View reviewed changes

lstein and others added 4 commits May 6, 2026 22:38

Merge branch 'main' into lstein/docs/multiuser

f69dfed

Update docs/src/content/docs/features/Multi-User Mode/api-guide.mdx

1fe91a2

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

docs(multiuser): address issues raised in 6 May review

4ea31ed

docs(multiuser): fix merge conflicts

aa746a8

joshistoast requested changes May 7, 2026

View reviewed changes

lstein and others added 4 commits May 7, 2026 20:42

Update docs/src/content/docs/features/Multi-User Mode/api-guide.mdx

a3e1868

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

Update docs/src/content/docs/features/Multi-User Mode/api-guide.mdx

d7da02d

Co-authored-by: Josh Corbett <joshwcorbett@icloud.com>

docs(multiuser): more doc fixes

471dd52

Merge remote-tracking branch 'refs/remotes/origin/lstein/docs/multius…

2ccfd0a

…er' into lstein/docs/multiuser


		#### Change Password

		Endpoint: `POST /api/v1/auth/change-password`

	Endpoint: `GET /api/v1/users`
	Endpoint: `GET /api/v1/auth/users`

	- View and manage all users' boards, images, and workflows (including system-owned legacy content)
	- View and manage all users' boards, images, and workflows


		Firewall Rules:

		It is best to restrict access to trusted networks and remote IP addresses, or use a VPN to connect to your home network. Rate limit connections to InvokeAI's authentication endpoint `http://your.host:9090/login`.


	JWT secrets are generated automatically and stored in the database. Session lifetimes are currently fixed in code to 24 hours by default, or 7 days when the user selects "Remember me".

	strict_password_checking: true`
	strict_password_checking: true


		4. Restart InvokeAI

		Alternative: Remove `jwt_secret_key` from config to trigger setup wizard (will create new admin).

	Alternative: Remove `jwt_secret_key` from config to trigger setup wizard (will create new admin).
	Alternative: There is no supported config-based shortcut to rerun the setup wizard once an administrator already exists. If the admin password is lost, reset it directly in the database or by using the user-management tooling.


		Response:

		```json


		Response:

		```json

Conversation

lstein commented Apr 30, 2026

Summary

Related Issues / Discussions

QA Instructions

Merge Plan

Checklist

Uh oh!

joshistoast left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lstein commented Apr 30, 2026

Uh oh!

joshistoast left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joshistoast left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment