Security and user management

A BrewOS account holds the company's production, customer, stock and invoicing data. Security is based above all on keeping user credentials, roles and the access granted to outside applications up to date.

This guide collects the most important practices.

A username for everyone

Do not share one set of credentials between several people. Every user should have their own credentials, because:

each person can be given a role that suits their work,
the event log shows who made a change,
a departing employee's access can be closed without having to change other people's credentials,
strong authentication is per user.

The owner adds and removes users on the Settings > Users page. If a person needs BrewOS only as an employee on task lists, they do not need to be given an email address, in which case they cannot sign in. See Accounts and users.

Choose a suitable role

BrewOS has three roles: Owner, Basic user and Sales user. There are no more detailed access rights, for example per section: a basic user can use all of the account's functions except the settings, including invoicing and reports to the authorities.

Give the Owner role only to people who are responsible for the account's settings, users, integrations and BrewOS licence purchases.
A sales user can only access the sales catalogue, customers and shipments. Other pages, such as production, warehouses, invoicing and reports, do not open for them even with a direct address. On the customer's pages, however, they also see the customer's invoices and payments.

When a person's job changes, also check their role. Old rights easily remain in force if they are not reviewed regularly.

Passwords

The minimum length of a new password is 10 characters. Use a long password that you do not use in other services.
Passwords are not stored in plain text but as hashes, from which the password cannot be recovered.
If five sign-in attempts with the same email address fail from the same IP address within 15 minutes (a wrong password or a wrong OTP code), signing in is blocked for a while. The password reset link still works.
You can change your password on the My credentials page.
Password reset sends a sign-in link to your email that is valid for 24 hours. The link gets into the credentials without a password and without an OTP code. So whoever has access to your email can also get into your BrewOS credentials. Protect your email account well.
Use the option Remember me in this browser only on your own devices. A remembered sign-in stays valid as long as the service is used in the browser at least every 14 days.
On a shared device, always sign out with the sign out link in the top bar. The session does not end by itself even if the service is not used, only when you sign out or close the browser.

Enable strong authentication

BrewOS supports time-based one-time codes, i.e. TOTP authentication. Each user enables it themselves on the My credentials page. The owner cannot enforce it for others.

Strong authentication is especially recommended for owners and for users who handle invoicing, reports to the authorities or connected applications.

Read the detailed guide: Strong authentication.

Connected applications

An OAuth connection allows an outside application, for example an AI assistant, to act on the BrewOS account with your rights. That is why access should be managed carefully.

Grant access only to applications you need and trust.
Choose Read only if the application does not need to change data.
Revoke the application's access as soon as it is no longer needed.
Check the event log if you suspect unexpected use.

No fixed API keys are created for AI assistants; they are always connected with OAuth sign-in.

Each user sees and can revoke only the access they have granted themselves. The owner cannot see or revoke access granted by other users. When a user is removed from the account, all the access they have granted for this account stops working immediately.

Read the detailed guide: OAuth and the AI interface (MCP).

Webshop API keys

Your own webshop is connected to BrewOS with an API key that the owner creates on the Settings > Webshops page. The key is shown only once, and BrewOS stores only a hash of it.

Give the key only to the person building the webshop, and keep it in the webshop's settings, not for example in email.
If you replace a key, first create the new key, switch it into the webshop, and only then revoke the old one.
Revoke a key immediately if it may have fallen into the wrong hands or is no longer used.

See the technical description of the interface: Webshop API: developer guide.

Files and public addresses

Files stored in BrewOS open from a public address without signing in, and the addresses of products' default images are also passed to AI assistants and webshops. Do not store sensitive files in BrewOS. See Files.

When an employee leaves

When a person no longer needs access to the BrewOS account:

The owner removes the person on the Settings > Users page. Access ends immediately, and at the same time all application access the person granted for this account stops working.
If necessary, check the person's recent changes in the event log. Note that after removal only Deleted user is shown as the actor of their events, so it is worth doing the check before removal.
If the person used shared credentials for external services (for example the invoicing system), change them and update them in the settings.

The sign-in right cannot be removed in such a way that the person would remain a member of the account. A removed person is no longer shown on task lists. Their wage costs and earlier entries are kept.

Regular check

At least a few times a year, do a short security check:

Are the people on the user list still the right ones?
Do only those who need it have the owner role?
Is strong authentication enabled for key users?
Are there old or unrecognised applications on the Settings > AI agents page (each user for their own part)?
Are there valid API keys on the Settings > Webshops page that are no longer used?
Is there anything unusual in the event log?

Security is not a separate project but a small part of ordinary maintenance.

Page last updated 23 Oct 2026 11:24