keygen-admin

Lightweight web UI for managing Keygen CE licenses — create, suspend, reinstate, delete licenses, and deactivate machines. No database, talks straight to the Keygen REST API.

Built with Node.js/Express + htmx.

Stack

• Node.js (ESM)
• Express
• htmx (CDN)

---

1. Launch the Keygen CE instance

The API lives at ~/keygen-api. It runs via Docker Compose.

First-time setup

cd ~/keygen-api

# Copy and fill in the env file
cp .env.example .env  # or edit the existing .env directly

# Start Postgres + Redis
docker compose up -d postgres redis

# Run the Keygen setup wizard (creates the account + first admin user)
docker compose run --rm setup

# Start the API and worker
docker compose up -d web worker

After keygen:setup completes the API is reachable at http://api.localhost:3000.

Key .env values (keygen-api)

Variable	Purpose
KEYGEN_ACCOUNT_ID	The singleplayer account UUID — copy this into the admin panel config
KEYGEN_ADMIN_EMAIL	Admin login email
KEYGEN_ADMIN_PASSWORD	Admin login password
KEYGEN_MODE	Keep singleplayer for self-hosted CE
KEYGEN_EDITION	Keep CE
SECRET_KEY_BASE	Rails secret — generate with openssl rand -hex 64

Subsequent starts

cd ~/keygen-api
docker compose up -d

Stop

docker compose down

---

2. Generate an admin token

You need a bearer token to authenticate the admin panel against the API. Generate one with:

curl -s -X POST \
  -u "admin@example.com:<password>" \
  -H "Accept: application/vnd.api+json" \
  http://api.localhost:3000/v1/tokens \
  | jq -r '.data.attributes.token'

The token starts with admin- and ends with v3. Save it — it won't be shown again.

---

3. Configure and run keygen-admin

cd /path/to/keygen-admin

# Install dependencies (first time only)
npm install

# Run the interactive setup script to configure the environment
./setup.sh

Then start:

npm start          # production
npm run dev        # auto-restart on file changes

Open http://127.0.0.1:8080 in your browser.

---

Notes

• No auth built in — keep BIND_ADDR on 127.0.0.1 or put a reverse proxy with auth in front.
• License keys are masked in the list view; full key is shown on the detail page.
• Suspend/reinstate use htmx partial swaps (no full reload).