Skip to content

Authentication and Users

The Fast Video Cataloger Server supports multi-user authentication with role-based permissions. This allows you to control who can access your video catalog and what actions they can perform.

User Roles

The server supports three user roles with different permission levels:

Viewer -- Read-only access to the catalog. Can browse videos, actors, and tags but cannot make changes.

Editor -- Can add, edit, and delete content. This includes adding videos, creating actors, managing keywords, and editing video metadata.

Admin -- Full access including user management. Can create and delete user accounts, change roles, and configure authentication settings.

Roles are enforced on the server, not just in the user interface. Write operations over the REST API — adding videos, tagging, editing metadata, uploading, deleting — are rejected with 403 Forbidden for Viewer accounts, so a Viewer cannot author content by calling the API directly.

Scope of Permissions

A role applies to the whole catalog. It cannot be scoped to a folder, a tag, or any other subset of the content: every user who can log in can see every video in the catalog, and every Editor can change any of it.

There is also exactly one catalog per server — serverconfig.xml binds the service to a single <CatalogFile>, and that file has a fixed location, so one machine runs one server. Splitting content between groups of users means running a server on a separate machine, with its own catalog, for each group. See Working with more than one catalog for switching which catalog a server hosts.

If you need users to see only their own portion of a shared catalog — one team per site, or per client, for example — the current permission model cannot express that.

Enabling Authentication

Authentication can be enabled or disabled from the Server Setup application or by editing serverconfig.xml directly.

When authentication is disabled, all users have full access without logging in. This is useful for trusted local networks.

When authentication is enabled, users must log in with a username and password to access the catalog.

The Default Admin Account

Every catalog has a built-in admin account. It is created automatically, with the password admin, the first time the catalog is opened by a version of Fast Video Cataloger that supports user accounts — you do not create it yourself, and it is there even if you never set up any other accounts. It is the account the desktop application uses to connect to its own server, which is why sharing a catalog never asks you to log in.

Because the account exists, the server answers authenticationRequired: true from the start, and API requests need a credential even on a fresh setup. To log in as the administrator — over the REST API or from another machine — use admin with the password admin until you have changed it.

Change the password before making the server reachable from other machines. Anyone who can reach the port can otherwise log in as the administrator with the default password.

Creating API Keys

Scripts and AI assistants that run unattended should use an API key instead of a login — a session token expires after eight hours, a key does not. The simplest way to create one, and the way to create the first one, is from the desktop application that shares the catalog:

  1. Make sure the server is running (Start > Server)
  2. Open Start > Server and click Manage Users — the button is shown once the server is running
  3. Click "Create key...", choose a name, a role and a lifetime
  4. Copy the key when it is shown — it is shown once and cannot be recovered later

No password is needed for this: the desktop application is already connected to its own server as the administrator. Keys can also be created and revoked over the REST API — see the API Keys section of the REST API reference.

Creating User Accounts

User accounts are managed by Admin users. To create a new user:

  1. Log in to the server with an Admin account
  2. Open the user management interface
  3. Click "Add User"
  4. Enter the username (email address recommended)
  5. Set a temporary password
  6. Select the appropriate role (Viewer, Editor, or Admin)
  7. Click "Create"

The new user can then log in and change their password.

Changing Passwords

Users can change their own password after logging in:

  1. Log in with your current password
  2. Access account settings
  3. Enter your current password
  4. Enter and confirm your new password
  5. Click "Change Password"

Admins can also reset passwords for other users through the user management interface.

Session Tokens

When a user logs in, the server issues a session token. This token:

  • Is required for all authenticated API requests
  • Has an expiration time (configurable)
  • Can be invalidated by logging out
  • Should be kept secure and not shared

For REST API usage, include the token in the Authorization header:

Authorization: Bearer {your-session-token}

Authentication for File Access

When enabled: - Requests to /files/* endpoints require a valid session token - Token can be passed via Authorization header or query string (?token=...)

When disabled: - Files are accessible without authentication - Only recommended for trusted networks

WCF Service Authentication

The Fast Video Cataloger desktop client uses WCF services to communicate with the server. These services also respect authentication settings:

  • User Auth Service: /UserAuth/BasicHttpBinding_IUserAuthService
  • User Management Service: /UserManagement/BasicHttpBinding_IUserManagementService

Best Practices

  • Use strong passwords for all accounts
  • Create separate accounts for each user (don't share credentials)
  • Use the Viewer role for users who only need to browse
  • Limit the number of Admin accounts
  • Enable authentication when the server is accessible from untrusted networks
  • Regularly review user accounts and remove inactive users