# Using the Support Login Feature

**URL:** <https://speciforum.org/t/using-the-support-login-feature/2838>\
**Category:** Technical Docs\
**Tags:** Specify-7\
**Created:** [September 5, 2025, 9:10pm UTC](https://speciforum.org/t/using-the-support-login-feature/2838 "2025-09-05T21:10:45Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Grant](https://yyz1.discourse-cdn.com/flex029/user_avatar/speciforum.org/grant/32/4255_2.png) [@Grant](https://speciforum.org/u/Grant)\
**Post date:** [September 5, 2025, 9:10pm UTC](https://speciforum.org/t/using-the-support-login-feature/2838/1 "2025-09-05T21:10:45Z")

</div>

> 📖 This guide explains how to use the `support_login` management command, a secure feature intended for system administrators to gain temporary, one-time access to a user’s account for troubleshooting purposes.

* * *

## Enabling the Feature

> [!warning] This feature is disabled by default.
> 
> For security, you must explicitly enable this feature by setting the `ALLOW_SUPPORT_LOGIN` environment variable to `True`.
> 
> You can set this in your `docker-compose.yml` file for the `specify7` service. You can also configure the token’s lifespan using `SUPPORT_LOGIN_TTL` (default is 180 seconds).

```yml
# Example snippet for docker-compose.yml

services:
  specify7:
    image: specify/specify7:latest
    environment:
      - ALLOW_SUPPORT_LOGIN=True
      - SUPPORT_LOGIN_TTL=180 # Optional: Time in seconds token is valid (default: 180)
    # ... other settings

```

* * *

## How to Generate a Login Token

Follow these steps from a terminal on the host machine running your Docker instance.

1. **Enter the Specify 7 container:**

2. **Run the management command:**  
Inside the container’s shell, run the `support_login` command, replacing `target_username` with the username of the account you need to access.

3. **Copy the token URL:**  
The command will output a one-time-use URL. The token is only valid for the duration specified by `SUPPORT_LOGIN_TTL`.

4. **Use the login link:**  
Append the generated path (e.g., `/accounts/support_login/?token=...`) to your instance’s base URL and paste the complete URL into your browser to log in as that user.

* * *

## Administrator Best Practices

> [!danger] Important Security Recommendations
> 
> This feature is powerful. To maintain a secure instance, you **must** follow these security practices.
> 
> 1. **Change the `SECRET_KEY`:** Never use the default `SECRET_KEY`. Change it to a randomly generated, cryptographically secure value upon installation and rotate it periodically.
> 2. **Secure the Docker Network:** Ensure no unnecessary ports are exposed from your Docker containers to the host machine or the wider internet. Specifically, the **Redis** container should _only_ be accessible to other containers within the Docker network (like `specify7`), not to the outside world.
> 3. **Keep `SUPPORT_LOGIN_TTL` Small:** The default of `180` seconds (3 minutes) is recommended. A shorter time reduces the window for an attacker to intercept and use a generated token.
> 4. **Monitor Logs:** Regularly review your instance, database, and Redis logs for unauthorized access attempts or suspicious activity.

## Security & Technical Details

> [!info] How it Works (Technical Deep Dive)
> 
> This feature uses **Redis** and **JWT (JSON Web Tokens)** with **AES-GCM** encryption to ensure a secure, one-time login.
> 
> **1. Redis Cache**  
> The system uses the internal Redis cache to temporarily store a cryptographic “salt” and a verification key. This data is set to expire after the `SUPPORT_LOGIN_TTL` and is **deleted immediately after the token is successfully used once**. This makes the token truly single-use.
> 
> **2. Cryptography Workflow**
> 
> - **Token Generation:**
> 
> - **Token Parsing:**
> 
> This process ensures that an attacker would need to know the server’s `SECRET_KEY`, have read/write access to the Redis cache, _and_ intercept a valid token all within the short `SUPPORT_LOGIN_TTL` window.

* * *