Using the Admin Panel for ONLYOFFICE Docs

First time installation

When you start the Admin Panel for the first time, it requires an initial setup:

1. Open the Admin Panel web interface.

   On the http://example.com/welcome page, click Admin Panel. In the dialog that appears, click Open Admin Panel.

2. Create the first administrator.

   The server automatically detects that no admin password is configured. A page opens with commands to create the first administrator. The first administrator can only be created from the host.

   

   Use the command that matches your installation:

   Linux:

   sudo documentserver-admin create-admin

   Docker:

   docker exec -it <container> documentserver-admin create-admin

   Replace <container> with the container ID or name. To find it, run docker ps.

   Kubernetes:

   kubectl exec -it <pod> -- documentserver-admin create-admin

   Replace <pod> with the pod name. To find it, run kubectl get pods.

   Windows:

   "%ProgramFiles%\ONLYOFFICE\DocumentServer\bin\documentserver-admin.bat" create-admin

   Follow the CLI prompts to set the administrator password.

3. Reload and log in.

   Reload the Admin Panel page, enter the password you created, and click Login.

   

   The runtime.json file will be created, which will contain the modified settings in the Admin Panel. It takes precedence over other configuration files such as local.json, default.json, production.json, etc.

   The runtime.json file can be found here:

   • For Linux - /var/www/onlyoffice/Data/runtime.json
   • For Docker - /var/www/onlyoffice/Data/runtime.json (first, enter the ONLYOFFICE Docs container using the docker exec -it <containerid> bash command)
   • For Windows - %ProgramData%/ONLYOFFICE/Data/runtime.json

     By default, ProgramData is a hidden folder in Windows Server, you can enable hidden items in the File Explorer options to see it.

Security notes

• The first administrator can only be created from the host using documentserver-admin create-admin.
• The administrator password is stored as passwordHash in runtime.json.
• No password is transmitted or logged — only secure hashes are stored.

Session details

• Sessions use secure HTTP-only cookies.
• They expire automatically after 1 hour of inactivity.
• SameSite=Strict protection is applied against CSRF attacks.

Password hash details

• Algorithm: PBKDF2-SHA256 (600,000 iterations, OWASP 2023).
• Cross-platform: The hash can be generated via Python or Node.js.

Generate password hash externally

OpenSSL 3.0+ (recommended - MCF format):

PASSWORD="YourPassword"; I=600000; S=$(openssl rand -base64 16 | tr -d '\n'); H=$(openssl kdf -binary -keylen 32 -kdfopt digest:SHA256 -kdfopt pass:UTF8:"$PASSWORD" -kdfopt salt:base64:"$S" -kdfopt iter:$I PBKDF2 | base64 | tr -d '\n'); echo "\$pbkdf2-sha256\$$I\$$S\$$H"

Node.js:

node -e "const crypto=require('crypto');const p=process.argv[1];const s=crypto.randomBytes(16);const sb=s.toString('base64').replace(/\+/g,'.').replace(/=/g,'');crypto.pbkdf2(p,s,600000,32,'sha256',(e,k)=>{const h=k.toString('base64').replace(/\+/g,'.').replace(/=/g,'');console.log('\$pbkdf2-sha256\$600000\$'+sb+'\$'+h)})" "YourPassword"

Check OpenSSL version:

openssl version
            # OpenSSL 3.0.0 or newer - ✓ Use openssl kdf command
            # OpenSSL 1.x - ✓ Use openssl keyutl command

Add the resulting hash to the runtime.json file:

{
            "adminPanel": {
            "passwordHash": "$pbkdf2-sha256$600000$..."
            }
            }

Admin Panel is not yet configured

Problem: The Admin Panel page still shows that no administrator account exists.

Solutions:

• Create the first administrator from the host with documentserver-admin create-admin.
• For Docker, run the command inside the ONLYOFFICE Docs container.docker exec -it documentserver-admin create-admin Replace <container> with the container ID or name from docker ps.
• After the CLI completes, reload the Admin Panel page and log in with the password you created.

Configuration

Using this tab, you can:

• View server configuration. The final configuration is displayed here with all parameters redefined through all config files. Sensitive parameters (passwords, keys, secrets) are shown as REDACTED.
• Copy the content of the config file.
• Reset all configuration settings to their default values. This action cannot be undone.

License

Using this tab, you can upload your product license and view the license information:

• Build: type (Enterprise Edition, Developer Edition), mode (trial, production), release date.
• License: start date, the date until which the license is valid.
• Connections limit for editors and live viewer.

Click the Buy Now button to purchase a license. You will be redirected to the corresponding page of the official ONLYOFFICE website.

To upload the license:

1. Click the Browse button to select the license file.
2. Click the Apply License button.

PDF Signing

Using this tab, you can add a PKCS#12 (.p12/.pfx) certificate for signing submitted PDF forms. Filled PDF forms will be signed when submitting them by clicking the Complete & Submit button.

To create a .p12/.pfx certificate using existing files (a private key and a .crt / .pem certificate), you can use openssl from the command line:

openssl pkcs12 -export -out certificate.pfx -inkey privatekey.key -in certificate.crt

To create a certificate from scratch:

1. Generate a private key:

   openssl genrsa -out privatekey.key 2048

2. Create a certificate signing request (CSR):

   openssl req -new -key privatekey.key -out request.csr

3. Generate a self-signed certificate:

   openssl x509 -req -days 365 -in request.csr -signkey privatekey.key -out certificate.crt

4. Create the PKCS#12 file:

   openssl pkcs12 -export -out certificate.pfx -inkey privatekey.key -in certificate.crt

Once you obtained your .p12/.pfx certificate, you can upload it to the 'Certificate File' field in the Admin Panel. If the certificate is password-protected, enter your password in the 'Certificate Passphrase' field. Then save the settings.

HTTPS / SSL

Using this tab, you can install a new CA-signed certificate from the letsencrypt.org service to enable the secure HTTPS protocol.

Ports 80 and 443 must be open in order to successfully generate Let's Encrypt certificates. An A record in your DNS entries must point your domain name to the IP address of the server where ONLYOFFICE Docs is installed.

1. Specify your domain name in the Domain field.
2. Specify your email address in the Email field.
3. Click the Install Certificate button.

Fonts

Using this tab, you can add new custom fonts:

1. Click the Browse button to select font files or drag and drop them here.
2. Click the Generate button.

Manage your added custom fonts:

• Filter all fonts by name to find the necessary one.
• Check the 'Show custom only' option to display only custom fonts in the list.
• Check the 'Mark all custom for deletion' option and click the Generate button to remove the selected custom fonts.

Services

Using this tab, you can enable or disable public API endpoints for specific services.

Disabling a service immediately rejects its public API requests with HTTP 403. Integrations that rely on the disabled endpoints will stop working until the service is re-enabled.

The following options are available:

• Conversion public API. Enable or disable the conversion endpoints. Disabling may break connectors that use the conversion service. Conversions initiated by the editors are not affected.
• Document Builder public API. Enable or disable the document generation endpoints.
• AI features. Enable or disable AI Tools in the editors and the /ai-proxy endpoint. Disabling removes AI Tools from the plugin list sent to the editors and rejects /ai-proxy requests.

Shutdown

Using this tab, you can forcefully disconnect ONLYOFFICE Docs users to avoid data loss when you need to stop ONLYOFFICE Docs for reasons such as application updates or server reboots.

1. Click the Shutdown button to block new editor connections and close existing sessions. When stopping the server in this way, users will be correctly disconnected from the editors, and their changes will be saved.
2. Click the Resume button to return server to normal mode and allow new editor connections.

Advanced Options

Using this tab, you can configure advanced security and document assembly options.

Disabling verification makes the server vulnerable to man-in-the-middle attacks. Use only as a temporary workaround when integrating with services that have self-signed or otherwise untrusted certificates. Re-enable once proper certificates are installed.

The following options are available:

• Verify TLS/SSL certificates (rejectUnauthorized). Validate remote certificates for outgoing HTTPS requests.
• Verify downloaded file integrity (checksumVerification). Check downloaded content against integrity headers.
• Assemble document in original format (assemblyFormatAsOrigin). Preserve the original document format during final assembly.

Network Requests

The Network Requests tab controls which callers may reach this server, and how outgoing connections are filtered.

The following options are available:

• Use IP filtering for requests. Apply the IP rules to incoming requests. When disabled, client addresses are not checked; outgoing WOPI destinations are still authorized by the same rules.
• Allow Private IP Addresses. Allow outgoing requests to private ranges and loopback. This does not make a WOPI host trusted.
• Allow Meta IP Addresses. Allow outgoing requests to 0.0.0.0 and ::. Cloud metadata and link-local addresses stay blocked for WOPI.