Audience: Admin
Super-user login is a break-glass way to sign in to LokAkrt when you cannot use a normal Admin password.
It uses the same process-lifetime administration token as the setup wizard. Search logs for Administration token. A successful empty-email login issues a real LokAkrt session as the oldest enabled Admin. If no enabled Admin exists, LokAkrt creates or re-enables admin@lokakrt.com.
This is a login method, not a synthetic user. Role checks still require a user row.
Warning
Treat the administration token and server logs as secret. Restarting the API process rotates the token. On multi-replica deployments each process has its own token.
| Role | Purpose |
|---|---|
| Administrator / operator | Recover LokAkrt access when passwords are unknown or all Admins are disabled |
Authors should not use /login?super=1.
Administration token: <uuid> in the API console and log files./login?super=1 (email and Remember me are hidden).Opening /login?super=1 asks the server to reprint the token when recovery is enabled. Submitting a blank email with any password also reprints it (when recovery is enabled).
The token is never returned in an HTTP body.
Administration token./login?super=1.ORDER BY id).admin@lokakrt.com if that account was created / re-enabled).If every Admin is missing or disabled, recovery creates or re-enables admin@lokakrt.com (first name Administrator, Admin role, random password hash — not the administration token).
Re-enabling admin@lokakrt.com is intentional recovery. Disabling that user is not a kill switch. Use Settings → Server instead.
lokakrt.superUser.disable=true) and save.The change applies on save (config cache). No Express restart is required.
When recovery is disabled:
401 Invalid email/password!)./login?super=1 and blank-email POST).Startup only prints the administration token when database setup is still required. After setup, open /login?super=1 (or submit a blank-email login) to reprint it while recovery remains enabled.
| Problem | Cause | Solution |
|---|---|---|
| Token from yesterday does not work | Process restarted | Search current logs; restart rotates the token |
| Works on one host, not another | Multiple API replicas | Each process has its own token; use the log from the instance that handled the request |
Disabled admin@lokakrt.com but recovery still works |
That user is not the kill switch | Check Disable recovery login on Settings → Server |
| Recovery login rejected | Kill switch on, or wrong token | Confirm the Server toggle; reprint the token only if recovery is still enabled |
| Signed in but cannot change passwords | Not actually Admin | Recovery always uses an Admin row; check Users |