Skip to main content
Version: Beta

Security

Companion has a number of features that help you limit casual access to the admin interface and control surfaces. Although none of these features makes an installation secure, they can help to stop casual browsers.

No single page of the Admin interface is dedicated to security, so this help section attempts to gather the features in a single place.

  1. Admin Password, Settings > Advanced (Admin UI Password): If enabled, Companion will require a password to view any of the configuration pages
  2. Surface Lockscreen, Surfaces page (PIN Lockout): Allows all connected surfaces to be locked out after a timeout and requires a PIN to unlock.
  3. Page Permissions Surfaces tab: If enabled for a device or a group, it allows you to limit page access for that device/group.
  4. Remote Access Settings > Protocols: Determine whether remote computers/devices can initiate a connection to Companion.
  5. Dangerous Features: As of Companion 5.0, running shell commands and installing modules sent from remote clients are disabled by default. Leave these off unless you specifically need them and trust your network, as they allow code to run on the machine hosting Companion.
  6. REST API keys, Settings > Protocols (REST API): The REST API is disabled by default. When enabled, every request needs an API key. Give each script or system its own key with only the scopes it needs, and revoke keys which are no longer used. The Last used column helps you spot those.
  7. Prometheus metrics, Settings > Protocols (Prometheus Metrics): Disabled by default. When enabled, the metrics can only be read with the scrape token.

Note that the Admin Password only protects the admin interface. It does not protect the remote control protocols, the REST API or the metrics endpoint, which have their own settings above.