3200 is for the person who runs the Ragen installation — not for the people who use it. It gives you a cross-organisation view of everything: who is on the platform, how much they’re using, which connectors are failing, and what security events have occurred. The main app at :3000 handles day-to-day work inside a single organisation; the admin panel handles the infrastructure around all of them.
Who can access the admin panel
Access to the panel is controlled by the platform administrator role. This is different from being an organisation owner or admin inside the main app. The panel re-reads the role on every request, so revoking it takes effect immediately rather than waiting for a session to expire.Getting in
1
Create the first account
Create your platform administrator account by completing the first-run setup screen when you first deploy Ragen. That account is automatically granted the platform admin role.
2
Open the admin panel
Navigate to
http://localhost:3200 (or your deployed admin URL). Sign in with the same email and password you use for the main app.3
Grant access to others
From the Users section of the panel, find the account you want to promote and grant it the platform admin role. The account must already exist — the panel does not create accounts.
GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are configured. Password sign-in always works for the platform administrator regardless. See OAuth Sign-In for setup details.
Panel sections
Managing organisations
The Organizations section shows every organisation on your installation. Each organisation’s detail page lets you:- View and edit membership (add a user who already has an account, change their role, or remove them)
- Review the organisation’s settings, subscription limits, and storage usage
- Browse recent audit log entries for that organisation
Two membership changes are permanently refused: you cannot remove or demote the last owner of an organisation, and you cannot add an account that doesn’t exist yet. The panel manages membership — it does not create accounts.
Organization features
On the Features page, a feature is on or off for an organization. Each one is decided by the first of these four layers that sets it:- an override for that organization;
- the organization’s plan;
- the platform default;
- the built-in default.
The Add and remove documents, Create and delete projects, Change organization settings and Delete threads features exist so you can freeze an organization’s content and configuration while its members can still read and ask questions. A showcase organization is the typical case.
Managing API keys
The API Keys section lists every key across the installation. The Last Used column is the most important one: a key that has never been called is a good candidate for revocation. Two separate controls let you act on a key:Applying limit defaults to existing organisations
When you update a platform-wide default in Limits & Models, that default applies only to newly created organisations. Use Apply Defaults to propagate a change to existing organisations. The panel shows you exactly which values would change before writing anything.Apply Defaults raises and lowers values but never removes them — a blank default cannot be distinguished from “leave this organisation alone.” The fields it will skip are listed by name in the preview.
Exporting data
The Activity log, AI usage, disk usage, API keys, connectors, and incidents each export to CSV, honouring the filters currently on screen rather than dumping the whole table. Downloading an export is itself recorded in the activity log. CSV cells are protected against formula injection, so values beginning with= or @ cannot execute when the file is opened in a spreadsheet.
Activity log and security incidents
Every mutating action in the panel is recorded with before-and-after values. Sensitive fields (masked API key values, tokens) are redacted before the entry is written. Incidents is the security-event view. It shows failed sign-ins, brute-force detection, connector authorisation failures, rate-limit breaches, cross-organisation access attempts, and guardrail hits —GUARDRAIL_BLOCKED for a turn that was refused and GUARDRAIL_FLAGGED for one that was merely recorded or masked, filterable together as Any guardrail hit. You can mark events as resolved, and that resolution is recorded too.
Guardrail events carry the rule, its stage and action, and a match count — never the text that matched, and never a judge model’s reasoning. Event metadata is rendered in plain text to every operator who can open this page, so what a guardrail refused is not readable here. See Guardrails.
Configure email alerts for security events with
SECURITY_ALERT_EMAIL and SECURITY_ALERT_SEVERITY. The severity threshold defaults to critical. Alerts are deduplicated over 15 minutes and capped per hour to prevent alert flooding during an incident.SECURITY_ALERT_LOCALE sets the language of the alert body, one of the panel’s languages; it defaults to en. It is never taken from the request that raised the alert, because that request may be an attacker’s. The subject stays machine-readable in every language, for example [Ragen Security] CRITICAL: AUTH_LOGIN_FAILED, so mail filters keep working.