> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytebase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Recover Administrator Access

Use the interactive recovery command when a self-hosted deployment is locked
out because password sign-in is disabled, a user's password is unknown, or the
user was removed from the workspace IAM policy.

<Warning>
  Stop every Bytebase server connected to the metadata database before recovery.
  Restart all servers after recovery so they reload the updated settings and IAM
  policy.
</Warning>

## Before recovery

1. [Back up the metadata database](/get-started/self-host/upgrade#back-up-and-restore).
2. Stop every Bytebase server instance or replica.
3. Use the same Bytebase version and metadata connection configuration as the
   stopped deployment. Follow [Deploy with Docker](/get-started/self-host/deploy-with-docker)
   for embedded data and port configuration, or [Configure External
   PostgreSQL](/get-started/self-host/external-postgres) for `PG_URL`.

Recovery requires an interactive terminal and a metadata database containing
exactly one workspace, which must be active.

## Run recovery

```bash theme={null}
bytebase recovery
```

For embedded PostgreSQL, pass the deployment's `--data` and any custom `--port`.
For external PostgreSQL, provide the deployment's `PG_URL` and credentials.

The command displays:

```text theme={null}
Select a recovery action:
1. Enable password sign-in
2. Reset user password
q. Exit
```

### Enable password sign-in

Use this action when an existing administrator password is known but password
sign-in is disabled. The command verifies that a usable administrator identity
exists, then turns off **Disallow password sign-in**.

### Reset user password

Use this action for any existing, active end user. The user does not need to be
an administrator.

The command displays the workspace password requirements before accepting the
new password. If the user is not a workspace member, it can add one existing
role after confirmation. If password sign-in is disabled, run **Enable password
sign-in** in the same session.

Recovery does not create or reactivate users, create or edit roles, clear MFA,
revoke tokens, or repair an identity provider.

## After recovery

1. Exit recovery and restart every Bytebase server.
2. Sign in through `/auth` and verify the recovered account's access.
3. Repair and test the identity provider.
4. Re-enable **Disallow password sign-in** if it was enabled before the outage.
5. Review the warning-level recovery audit events.