Set a Secure Password for the Collabora Admin Console

Set the Collabora Online Admin Console password in the way your server is deployed: for the CODE Docker image, configure its username and password environment variables; for a Linux package installation, run coolconfig set-admin-password. Then restart or recreate the service and sign in to the admin page to confirm the new credential works.

Know which password you are changing

The Admin Console is Collabora Online’s service-management page. It is separate from the administrator account for Nextcloud or another storage platform, and changing its password does not change document-user logins or the credentials used by your platform to connect to Collabora. The Docker and package-based installations also use different configuration workflows, so identify your deployment before changing anything.

For CODE in Docker, Collabora documents username and password as container environment settings. For package-based installations, Collabora’s configuration tool can set the admin password interactively. The current configuration reference marks direct use of the admin_console.password setting as deprecated on most platforms and recommends PAM or coolconfig instead. See Collabora’s CODE Docker image documentation and Collabora’s configuration reference.

Prepare before changing the credential

• Confirm the host name, container or service name, and whether Collabora runs in Docker or as a Linux package. If you have several instances, write down which one serves your users.
• Choose a unique password and store it in your password manager or deployment secret store. Do not use a sample password from a tutorial.
• If you manage Docker Compose, back up or commit the Compose file without committing any secret. Restrict access to the file that holds the secret; environment variables are still visible to administrators who can inspect the container.
• Keep the admin endpoint behind your normal access controls. A strong password helps, but it does not replace limiting who can reach the administration page.

Set the password for a CODE Docker container

In the Compose service for Collabora, set the documented username and password variables. This example reads the password from a local .env file rather than putting the secret directly in the Compose file:

services:
  collabora:
    image: collabora/code
    environment:
      username: admin
      password: "${COLLABORA_ADMIN_PASSWORD:?Set it in .env}"

In the same project directory, place the secret in .env:

COLLABORA_ADMIN_PASSWORD=replace-with-your-unique-secret

Replace the sample value with your real password, and do not commit .env to a shared repository. If the Compose service already exists, changing its environment on disk does not alter the environment of the running container. Recreate that service so the new setting takes effect:

docker compose up -d --force-recreate collabora

Use your actual Compose service name if it is not collabora. This restarts the Collabora container; it does not delete your documents, which are stored by your connected platform. If your deployment is managed by Kubernetes, Helm, or another control plane, change the corresponding secret or values there and apply that deployment’s normal rollout process rather than editing a running container by hand.

Set the password on a Linux package installation

On a server where Collabora was installed as a system package, run the configuration tool on that server:

sudo coolconfig set-admin-password

The tool prompts for the new password so you do not need to include it in the shell command. Enter it at the prompt and repeat it if asked. Then restart the service so it loads the updated configuration:

sudo systemctl restart coolwsd

Nextcloud’s current Ubuntu installation example also uses coolconfig set-admin-password and restarts coolwsd after configuration. The exact package and service manager can differ on other distributions; consult that distribution’s Collabora installation instructions if the command or service name is unavailable. The Nextcloud example is documented in its Ubuntu 24.04 setup guide.

Sign in and check the result

Open the admin console for the Collabora host, commonly at https://collabora.example.com/browser/dist/admin/admin.html, replacing the example host with your server’s public URL. Sign in with the configured admin username and the new password. A successful sign-in confirms that the console accepts the credential; it does not by itself verify that document editing or the WOPI connection is healthy.

1. If the login fails on Docker, confirm that you edited the Compose project actually serving that URL, that the variable name is exactly username or password, and that you recreated the container after the change.
2. If the login fails after a package update, verify that coolwsd restarted successfully and that the browser is reaching the intended server. Check the service logs for configuration errors without copying secrets into a support post.
3. If you enabled PAM authentication, the configured admin_console.username and admin_console.password values are ignored. Use the PAM account and password configured for the host instead; changing the CODE Docker environment variables will not override PAM.
4. If login works but the admin page does not load, check the reverse proxy’s Collabora routes and access policy. A proxy or network problem is different from a rejected password.

Common mistakes to avoid

Do not confuse the Admin Console password with a Nextcloud administrator password, and do not paste the secret into a command such as docker run -e password=... if shell history or process inspection could expose it. For a Compose deployment, keep the secret in a protected environment file or an available secret manager and limit access to the Docker host. Also avoid editing coolwsd.xml directly as a first choice: Collabora identifies the legacy password setting as deprecated on most platforms.

If you cannot log in after following the right path, first confirm the instance and authentication mode, then verify that the new configuration was actually applied. That sequence distinguishes a stale container or wrong host from a password typo and gives you a clear next place to investigate.