Signing in, switching and finding your way

This page covers the three things you do every day: signing in, switching between accounts or roles, and getting around.

Signing in

You sign in on the address your hosting runs under. That is the address your hosting provider gave you — panel1.corecp.dev, say, or your reseller's own. The sign-in screen carries that provider's name, logo and colour; it is not a different product, it is the same panel under a different name.

1. Enter your email address and password.
2. If you have a passkey on this address, your browser or device asks for it.
3. If you have no passkey but do have two-step verification, enter the six-digit code from your app.
4. You land in the context you were in last time.

Three things worth knowing:

• One password, everywhere. Your email address is your identity. If you work with two hosting providers who both run CoreCP, that is one password — but on each address you only see what belongs there. Neither provider ever learns that you are the other one's customer.
• Paste always works. Password managers are not fought.
• Lost is not locked out. Setting up a passkey gives you recovery codes. Keep them; they are the way back when the device is gone.

If you forget your password, the panel sends a reset in the branding of the same address — never naming another provider.

Switching account or role

Top left, directly under the product name, is the account switcher. It is on every screen, deliberately: the context decides what every number on the page counts.

Each row shows:

• the name of the account or group;
• what you are there — Administrator, Reseller, User;
• temporary when your access has an end date.

Click a row to switch. You do not sign in again: you already held the authority of both contexts, and the panel changes hats. You land on the new context's overview — the page you were on would mean nothing there.

If you have only one context, the switcher is a label rather than a menu. There is nothing to choose, and the panel does not pretend otherwise.

Switching is off while you are signed in as somebody else. A bar at the top of the screen then says "you are signed in as …" with one button to stop. Stop first, switch after.

Next time you sign in, you come back to the context you used last.

What you can reach: the account, not the server

What a context lets you reach depends on two things — and since 10 August 2026 on exactly those two and no third:

1. the hosting account is in your realm (the root realm, or your reseller's);
2. it is yours, or one of your customers' if you are a reseller.

The machine the account sits on does not count. That sounds obvious and was not: until 10 August 2026 the machine was asked as a third ownership question, so the moment you were a customer of a reseller while the server sat in the root group, you got 403 node_out_of_scope on your own website — on mail, DNS, FTP, files, backups and WordPress alike. That is gone. For administrators and server administrators the machine still counts, because they manage machines; see Where a website is served.

Nothing became wider. If you notice otherwise — you can see something that is not yours, or you cannot reach something that is — report it, because then something is broken.

Checking what your session may do, from your own computer:

# sign in and keep the session
curl -sk -c /tmp/corecp.jar -X POST https://panel1.corecp.dev/api/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"owner@test100.nl","password":"..."}' >/dev/null

# who you are, and in which realm
curl -sk -b /tmp/corecp.jar https://panel1.corecp.dev/api/v1/auth/session | \
  python3 -c 'import json,sys;u=json.load(sys.stdin)["user"];print(u["email"],u["level"],u["organization_name"])'

owner@test100.nl user Reseller Test BV

# and which hosting accounts that yields
curl -sk -b /tmp/corecp.jar https://panel1.corecp.dev/api/v1/accounts | \
  python3 -c 'import json,sys;[print(r["account"]["username"]) for r in json.load(sys.stdin)]'

demo

One account, because one is yours — and it sits on a machine in the root realm, which you notice nowhere. A reseller sees more from the same command, an administrator sees all of them.

Finding your way

The skeleton is the same for everybody; you simply see fewer entries if you may do less.

⌘K (or Ctrl-K) opens the command palette. Type part of a name and you jump straight there: a hosting account, a server, or one of the actions — email, DNS, backups, a rollout, a terminal. It is an accelerator, not a hidden feature: everything in it is also in the menu.

The bell at the top right collects what happened: a rollout that halted, a task that finished, a backup that failed. A failure also appears once as a transient message; everything else waits quietly in the bell.

From the command line

If you would rather type, corectl on the panel server does the same:

# Which contexts does a person hold, and where are they now?
corecp-panel identity status

# Who may sign in as somebody else (the right is off per membership)?
corecp-panel admin impersonation list

# Grant (or withdraw) the right to sign in as somebody else
corecp-panel admin impersonation allow axel@xynta.nl

The API has the same two steps as the switcher:

# Which contexts do I have on this address?
curl -s https://panel1.corecp.dev/api/v1/auth/contexts \
  -H "Cookie: $COOKIE" | jq '.contexts[] | {label, level, membership_id}'

# Switch to one
curl -s -X POST https://panel1.corecp.dev/api/v1/auth/context \
  -H "Cookie: $COOKIE" -H "X-CoreCP-CSRF: $CSRF" \
  -H 'Content-Type: application/json' \
  -d '{"membership":"<membership_id>"}' | jq '.user.level'

The session you get back replaces the old one; the old one is revoked immediately.