Admin console overview

The admin console is a separate application at /admin/app, distinct from the main Elitea app. It is where an administrator manages the deployment as a whole: users, projects, authentication, the LLM proxy, budgets, branding, and platform-wide configuration.

Open the admin console

Sign in to Elitea, open the account menu at the bottom of the sidebar, and select Admin portal. The item is there only when your account holds an administration permission. You can also go to /admin/app directly. The console renders only if your account holds at least one administration-mode permission — otherwise you see an access-denied screen instead of an empty shell. Every individual page still enforces its own permission on the server on every request; the console’s own check only decides whether it is worth rendering the navigation at all.

Navigation groups

The sidebar has two groups. In a short window the links scroll, and your account stays at the bottom.

Account menu

Select your name at the bottom of the sidebar, or your picture when the sidebar is collapsed, to open the same account menu as in the Elitea app. It has Back to Elitea, which returns you to the app, the version line (the console’s version and the server’s; select it to copy it) and Sign out.

The console has no theme switch of its own. It uses the theme that you choose in the Elitea app, under Settings › Personalization or Appearance in the account menu, so the console and the app always look the same.

Users

Delete, promote, suspend, and review activity for any account.

Roles

The permission matrix, across the central, public, and support scopes.

Projects

Suspend, create, delete, and manage membership for every project.

Secrets

The global secret vault, merged into every project.

App Requests

Application access requests waiting on a decision.

Configuration

Authentication, LLM Proxy, MCP servers, banner, maintenance, e-mail, and more, as a set of schema-driven sections.

Branding

The white-label pack — colors, assets, and fonts.

E-mail

The outbound mail relay.

Features

Feature toggles: MCP exposure, publishing, analytics, Help Center, Support Assistant, Voice.

Service Descriptors

A read-only provider registry; most of it reports “not available” rather than data.

Toolkits

Which toolkit types this deployment offers, and to which projects.

LLM Governance

Budgets, rate limits, allowlists, credential policy, and routing rules the LLM gateway enforces.

Budgets

Per-project and per-member spend limits.

Audit Trail

The deployment-wide record of what happened.

Schedules & Tasks

Cron schedules and background job status.

Note

There is no LiteLLM section. LiteLLM has been replaced by a standalone gateway service; its former admin screen is gone rather than kept as a dead link. A “Service Descriptors” entry is present even though the legacy admin UI never linked to it — it now answers honestly that this platform has no external provider hub, which is more useful than a page nothing could reach.

What each page can and cannot decide

window-injected permission flags in the console are presentation only: they decide what the sidebar shows, never what a request is allowed to do. Every read and write is re-authorized on the server against the actual permission that route requires. A typed URL to a page your account cannot use still reaches it — and still gets refused there.