dockxo beta
Sign in Create account
FeaturesPricingBlogChangelogGet started Sign in
features/security-api
2FA, tokens, everything scriptablesince v0.2

Security & API

TOTP two-factor authentication, email confirmation, password reset and security notices by email, hashed personal API tokens, per-server agent tokens, signed webhooks and encrypted secrets. Everything the panel does goes through the same HTTP API, so scripts and CI can do it too.

  • TOTP two-factor auth (Google Authenticator, Authy…) with QR enrolment and recovery codes
  • Email confirmation for new accounts, one-hour single-use password reset links, security notices for new sign-ins, password and email changes, 2FA and token events
  • Personal API tokens (Authorization: Bearer dxt_…), stored hashed, revocable
  • Per-server agent tokens; enrollment tokens expire after 15 minutes until first use
  • GitHub webhooks verified with X-Hub-Signature-256
  • Env, GitHub tokens, registry and storage credentials encrypted with your DOCKXO_SECRET
  • Full HTTP API: projects, services, deploy (with ?wait=1), env PATCH, domains, jobs

Sign-in

A new account confirms its email address from a link before it can use the panel. Forgot password? on the sign-in page emails a reset link that works once, for one hour; the answer is the same whether or not the address has an account, and a reset signs every session out. Changing the account email needs the current password, and the old address is told.

Enable two-factor authentication under Settings: scan the QR code with any TOTP app, keep the one-time recovery codes, and every sign-in asks for the second step. API tokens are unaffected, so automation keeps working.

Security notices

The account address is told about a sign-in from a new browser or address, a password change or reset, an email change, two-factor turned on or off, new recovery codes and new API tokens. If one of those was not you, you know within a minute.

Tokens and secrets

Personal API tokens are created under Settings → API tokens and sent as Authorization: Bearer dxt_…. They are stored hashed and can be revoked at any time; a token has the same rights as your account. Agents authenticate with a per-server token. Env vars, GitHub tokens, registry passwords, Cloudflare tokens, storage secrets and Telegram bot tokens are encrypted with DOCKXO_SECRET before they are stored.

The API

Everything the panel does goes through the same HTTP API. A few examples:

export DOCKXO_PANEL=https://panel.dockxo.com
export DOCKXO_TOKEN=dxt_xxxxxxxxxxxxxxxx

# deploy and wait for the outcome + log
curl -s -X POST -H "Authorization: Bearer $DOCKXO_TOKEN" \
  "$DOCKXO_PANEL/api/services/api.shop/deploy?wait=1"

# set one env key in place
curl -s -X PATCH -H "Authorization: Bearer $DOCKXO_TOKEN" -H "Content-Type: application/json" \
  "$DOCKXO_PANEL/api/services/api.shop/env" -d '{ "set": { "FEATURE_X": "1" } }'

Services are addressable as <service>.<project> anywhere a route takes an id. Deploys accept noCache and wait=1. Projects, services, domains, expose, clone, migrate and jobs are all there.

Import from other panels

The zero-dependency dockxo-restore CLI imports a service backup from your machine (API token auth, volumes streamed through the panel), and the in-panel restore tool does the same from a bucket. Database backups (redis, postgres, mysql, mariadb, mongo) restore as image services with a data volume, credentials and an exposed port; a dotEnvPath setting is carried over.

← Migrate & clone The panel →