Features

Manage your product from one place

Give staff and company owners a shared administration panel inside Shellui. Manage membership, email, webhooks, and company access. Add your own tools alongside the built-in screens.

Open administration inside your app

Connect the Shellui admin app through backend.adminUrl and set its route with backend.adminPathname. Staff and company owners can then open Administration from the account menu.

The panel uses your identity-service backend and the existing Shellui session. Host the admin app yourself or use admin.shellui.com.

1. Connect the admin app

Set adminPathname and adminUrl on a Shellui identity backend.

2. Sign in as staff or owner

The shell makes administration available to staff and company owners. The identity backend checks permissions on administration requests.

3. Open Administration

Open the panel from the account menu. Individual screens have shell URLs such as /admin/users.

shellui.config.json

{
  "backend": {
    "type": "shellui",
    "url": "http://localhost:8000",
    "companyId": 1,
    "adminPathname": "/admin",
    "adminUrl": "http://localhost:5174",
    "login": {
      "methods": ["oauth"],
      "oauthProviders": ["github"]
    }
  }
}

Everyday administration tools

Manage accounts, sign-in, and company settings through the built-in screens. Connect storage to add file browsing and usage statistics. Connect email-service to add the Email section.

Users and invitations

View the member directory, invite someone by email, and remove a member from the company. Staff and superuser flags stay in Django admin. You cannot edit them here.

OAuth setup

Company owners add a sign-in provider from the catalog. The screen shows the callback URL and the redirect allowlist. System for Cross-domain Identity Management (SCIM) tokens are created here too. You see the secret once, and you can revoke it.

Storage and the event log

Browse company files when storage is connected. Identity, storage, and hosting each have a log list and a detail page. The dashboard warns when stored events are older than the company retention period.

One webhook system

identity-service, storage-service, hosting-service, and email-service send signed webhooks. Company owners manage rules and delivery logs for identity, storage, and hosting in this panel. email-service adds webhooks for messages, unsubscribes, and newsletter events. Open these screens from Email and webhooks.

Each delivery is signed in the Standard Webhooks style. You see the signing secret once, when you create or rotate it. A later view of the rule shows only a hint of the secret. The service image retries failed deliveries every minute, so you do not add cron.

Point a rule at an n8n Webhook node. You can send a test event from Administration while you connect the workflow. Older addresses that used #/actions redirect to the webhook pages.

n8n guide · Email rules · Sign-in privacy

Email in the same panel

The Email section has a template library, provider settings, statistics, broadcasts, and newsletters. You write an event email once, translate it in place, and recolor it with a Shellui theme. Preview and draft sends use catalog example values. You cannot paste a literal sign-in URL into a sign-in template.

The panel calls email-service with the identity JSON Web Token (JWT). The default origin is https://email.shellui.com, or email.url from the shell config. Provider saves omit credentials you did not change. You can set the application programming interface (API) key, and later reads omit it.

Run the services without cron

The identity, storage, and email images start a scheduler beside the web server. It retries webhooks every minute and purges expired data on an hourly run. hosting-service retries webhooks the same way.

The scheduler uses Redis (REDIS_URL), an in-memory store, for its lock. It skips a run when another container already holds that lock, so two replicas do not run the same job. A production container does not start without REDIS_URL.

Only staff read scheduled-job health on the dashboard:

Healthy
Overdue
Failing
Disabled

Company metrics in Prometheus, the metrics format, include only that company. Staff, or a token with global access, can still read the full series. Sign-in links stay out of webhook bodies and access logs.

Add the tools your team needs

Add billing, support, or other internal tools to the admin sidebar through the administration configuration. Shellui embeds each tool by default. For tools that block embedding, set openIn: "external" to open a new tab.

shellui.config.json

{
  "administration": {
    "title": {
      "en": "Applications",
      "fr": "Applications"
    },
    "navigation": [
      {
        "label": {
          "en": "Billing",
          "fr": "Facturation"
        },
        "path": "billing",
        "url": "https://billing.example.com/",
        "icon": "/icons/billing.svg"
      }
    ]
  }
}

Next, see how email sends sign-in mail, newsletters, and broadcasts.