Admin configuration reference
echo.labstack.com/pro v0.2.0. See the task guide for setup examples.
Required fields
Section titled “Required fields”Config.Panels: 1–64 panel adapters.Config.Authenticate: your per-request login check.- Write actions: enable each panel action and configure signing keys and an
Auditsink. The shell requires Operator and the resolved scope; panel adapters fix reason and confirmation requirements.Config.Authorizecan narrow these permissions. Config.Keys: required for pagination, digest views, declared POST views and actions. Unpaginated confidential-filter reads can use POST without Keys on one instance: Mount creates an ephemeral CSRF key. Its tokens expire on remount and cannot be verified by another instance. Supply shared Keys for multi-instance deployments.
Viewer is the default role; PublicPath defaults to the mount prefix and an empty Theme.Mode follows the system scheme.
admin.Config
Section titled “admin.Config”Import echo.labstack.com/pro/admin.
admin.Config · admin/types.go:173 · echo.labstack.com/[email protected]
Config mounts a console with explicitly enabled panel actions. All callbacks, panels, Now and Rand must be safe for concurrent use and honor request cancellation. Mount copies slices and descriptors and starts no goroutines. The application owns the limiter, middleware and Logger. Behind a proxy that rewrites the host, Origins must list the origins browsers actually see.
| Field | Type | Description | Defaults / requirements | Source |
|---|---|---|---|---|
Authenticate | func(*echo.Context) (Principal, error) | Authenticate is required. On every request, it returns the principal your application has verified. An error or invalid principal returns 401 admin_unauthenticated. | Authenticate is required. | admin/types.go:176 |
Authorize | func(context.Context, Principal, Access) error | Authorize optionally narrows the default role grants. Nil applies the default role grants. An error hides the target with 404. Navigation is true when checking a candidate navigation link; every data request is checked separately. Invalid requests use Navigation false and include only valid parameters, so required parameters may be missing. Denied views return the same response as unknown views. After authorization, invalid parameters return 400. POST lookups check the input scope before store access, then check the resolved record before returning data. Lookup input can contain secrets; do not log it. | Authorize optionally narrows the default role grants. Nil applies the default role grants. Invalid requests use Navigation false and include only valid parameters, so required parameters may be missing. | admin/types.go:185 |
Middleware | []echo.MiddlewareFunc | Middleware runs inside the protected wrapper, before Authenticate. Its HTTP errors are sanitized and passed through ErrorHandler. Middleware is optional; nil installs no additional middleware. | Middleware is optional; nil installs no additional middleware. | admin/types.go:189 |
Panels | []Panel | Panels is required and holds 1–64 panel adapters. Mount copies the slice and each panel descriptor. | Panels is required and holds 1–64 panel adapters. | admin/types.go:192 |
Origins | []string | Origins contains up to 16 exact trusted browser-visible origins. Empty derives the origin from TLS and Host; forwarded headers are never trusted. | Empty derives the origin from TLS and Host; forwarded headers are never trusted. | admin/types.go:195 |
PublicPath | string | PublicPath is the path browsers use to reach the console, before any proxy rewrite. It defaults to the mount prefix. | It defaults to the mount prefix. | admin/types.go:198 |
RateLimit | func(context.Context, Principal, Access) (time.Duration, error) | RateLimit optionally replaces the built-in per-principal rate limiter. A positive duration returns 429 with that Retry-After delay. An error returns 503 admin_busy. POST lookups count before store access, including lookups that find nothing. Authenticated shell pages, client shell routes and descriptor requests also count before navigation, using Access{Panel: "console", View: "shell"}. | RateLimit optionally replaces the built-in per-principal rate limiter. | admin/types.go:204 |
MaxExpensive | int | MaxExpensive bounds simultaneous expensive views, including lookup work: 1–64, default 2. | MaxExpensive bounds simultaneous expensive views, including lookup work: 1–64, default 2. | admin/types.go:207 |
Timeout | time.Duration | Timeout bounds the full request, including middleware: 1ms–1m, default 10s. | Timeout bounds the full request, including middleware: 1ms–1m, default 10s. | admin/types.go:209 |
Theme | Theme | Theme contains trusted application presentation; copied by value at Mount. Theme at zero selects the system scheme and default Echo Pro Admin title. | Theme at zero selects the system scheme and default Echo Pro Admin title. | admin/types.go:212 |
Instance | string | Instance names this server instance in views that show per-instance data. Panels that show such data require it. | Panels that show such data require it. | admin/types.go:215 |
ErrorHandler | func(*echo.Context, error) error | ErrorHandler optionally renders sanitized authentication and middleware problems. If it leaves the response uncommitted, the shell renders the sanitized problem. | ErrorHandler optionally renders sanitized authentication and middleware problems. | admin/types.go:218 |
Logger | *slog.Logger | Logger is optional and caller-owned; nil logs nothing. Only sanitized codes are logged. | Logger is optional and caller-owned; nil logs nothing. | admin/types.go:220 |
Now | func() time.Time | Now is a concurrency-safe clock; nil defaults to time.Now. | Now is a concurrency-safe clock; nil defaults to time.Now. | admin/types.go:222 |
Keys | [][]byte | Keys contains 1–8 signing and encryption keys of 32–64 bytes. Mount copies them. Keys is required for pagination, digest8 views, declared POST reads and actions. A digest8 view displays an eight-character keyed digest instead of the original value. The first key signs tokens and derives display digests. All keys verify tokens. Display digests change when the first key rotates and cannot be reversed without it. Without Keys, unpaginated confidential reads use an ephemeral CSRF key created at mount. Those tokens expire on remount and cannot be shared across instances. | Keys is required for pagination, digest8 views, declared POST reads and actions. | admin/types.go:230 |
CursorTTL | time.Duration | CursorTTL bounds continuation lifetime: zero selects 15 minutes; valid range 1s–24h. | CursorTTL bounds continuation lifetime: zero selects 15 minutes; valid range 1s–24h. | admin/types.go:233 |
CSRFTTL | time.Duration | CSRFTTL bounds synchronizer tokens: zero selects 1 hour; valid range 1s–24h. | CSRFTTL bounds synchronizer tokens: zero selects 1 hour; valid range 1s–24h. | admin/types.go:236 |
ActorBoundCSRF | bool | ActorBoundCSRF permits requests with no session ID. CSRF tokens then bind to the actor only and live for CSRFTTL. The default is false, requiring a session for cookie-authenticated POSTs. | The default is false, requiring a session for cookie-authenticated POSTs. | admin/types.go:240 |
Audit | AuditSink | Audit is a caller-owned, concurrency-safe durable sink required for enabled actions. | Audit is a caller-owned, concurrency-safe durable sink required for enabled actions. | admin/types.go:242 |
AllowUnauditedWrites | bool | AllowUnauditedWrites explicitly opts out of durable auditing. Mount warns through Logger when actions are enabled; nil Logger remains silent. | Mount warns through Logger when actions are enabled; nil Logger remains silent. | admin/types.go:245 |
RedactText | func(string) string | RedactText sanitizes free-text audit fields; nil retains only length and digest. | RedactText sanitizes free-text audit fields; nil retains only length and digest. | admin/types.go:247 |
Rand | io.Reader | Rand is a concurrency-safe nonce source; nil defaults to crypto/rand.Reader. Custom readers must supply cryptographically secure bytes in production. | Rand is a concurrency-safe nonce source; nil defaults to crypto/rand.Reader. | admin/types.go:250 |
admin.Theme
Section titled “admin.Theme”Import echo.labstack.com/pro/admin.
admin.Theme · admin/types.go:151 · echo.labstack.com/[email protected]
Theme customizes trusted application presentation. Accent is #rrggbb and must reach 4.5:1 on the light canvas, panel and wash. Dark mode uses a readable lighter shade. Mount rejects accents that fail contrast checks on light backgrounds. ExtraCSS is trusted application code. Tone is empty, info, warning or danger. Environment text appears in the console header on every page.
| Field | Type | Description | Defaults / requirements | Source |
|---|---|---|---|---|
Mode | string | Mode is the initial SPA color scheme: empty (system), light or dark. Viewers may override it. | Mode is the initial SPA color scheme: empty (system), light or dark. | admin/types.go:153 |
Title | string | Title is trusted console text; defaults to Echo Pro Admin. | Title is trusted console text; defaults to Echo Pro Admin. | admin/types.go:155 |
Accent | string | Accent is an optional #rrggbb color. Light backgrounds require 4.5:1 contrast. Dark mode uses a lighter shade that reaches that contrast. | Accent is an optional #rrggbb color. Light backgrounds require 4.5:1 contrast. | admin/types.go:158 |
Environment | string | Environment is optional trusted text shown on the SPA header. | Environment is optional trusted text shown on the SPA header. | admin/types.go:160 |
Tone | string | Tone is empty, info, warning or danger. | Tone is empty, info, warning or danger. | admin/types.go:162 |
ExtraCSS | string | ExtraCSS is trusted application CSS, limited to 64 KiB. ExtraCSS is optional; empty appends no application stylesheet. | ExtraCSS is optional; empty appends no application stylesheet. | admin/types.go:165 |
Read and token limits
Section titled “Read and token limits”| Setting | Default or limit |
|---|---|
Config.Timeout | Ten seconds; range one millisecond–one minute; includes middleware |
Config.MaxExpensive | Two; range 1–64 |
Config.CursorTTL | 15 minutes by default; range 1s–24h |
Config.CSRFTTL | One hour by default; range 1s–24h |
Config.RateLimit | Reads 10/s, burst 30; writes 12/min, burst 12; probes 6/min, burst 6 |
When every expensive-view slot is busy, the console returns 503 with code admin_busy.
The console never closes panel backends, authentication resources or the audit sink.
Error types
Section titled “Error types”Console errors use *admin.ProblemError. OpenAPI chain errors use
*openapi.ProblemError.