Password · API Key Change

The DB account and AI keys used by Studio start with the same default values on every installation. Change them once during commissioning and you're done. You won't need to touch them again.

There's a single tool for making these changes: bin/passwd.sh. The platform · ai · studio products all have it under the same name, with the same usage.

The canonical configuration lives only in /etc/kopens/plantpulse-studio.env

The secret for this product is in /etc/kopens/plantpulse-studio.env. It's outside the repo tree, not inside the installation directory (/opt/kopens/plantpulse-studio-docker), and its permissions are 0600.

The .env at the root of the installation directory is the old path. Nobody reads it anymore — editing it won't change the stack.

Before 2026-08-16, passwd.sh was written to /etc/kopens/plantpulse-studio.env, while compose and the other scripts read .env from the repo root. So rotations were silently ineffective, and passwd.sh would report success while the stack kept running with the old value (PS_ANTHROPIC_API_KEY · PI_LLM_API_KEY were in that state). Don't write back to the old path.

---

App Login Accounts Are Not Covered Here

Don't mix these two up.

	What	Where to Change It
App login account	The account a person uses to log into Studio	Inside the app: Settings → User Management
AI key	Anthropic · OpenAI-compatible gateway key	This document — bin/passwd.sh

Don't try to change app accounts via .env — it will be a dead value

The Studio server checks ①DB → ②environment variable in that order when someone logs in. If the account is defined in the DB, it stops there — so editing STUDIO_LOCAL_USERS in env afterward has no effect.

Manage app accounts under Settings → User Management: create them, assign roles, and reset passwords. Details are in the User Management section of Settings (Administrator). Accounts originating from 환경변수 cannot be modified or deleted from the UI.

The bootstrap account (STUDIO_LOCAL_USERS) is a temporary measure for first-time access. Once operation accounts are ready, empty it and restart.

---

What Can Be Changed

Start by viewing the list. Running it without any arguments does the same.

cd /opt/kopens/plantpulse-studio-docker
bin/passwd.sh --list

You'll see the key · ID · current value (first 3 characters only) · target · where that value is located. To see the full value, use --list --show.

Key	What	How It's Changed
PS_ANTHROPIC_API_KEY	Anthropic API key	File — loaded at agent-server startup
PI_LLM_API_KEY	OpenAI-compatible gateway key	File — loaded at agent-server startup

That's all there are. The key names are the exact variable names from .env, and there are no aliases like anthropic — because having aliases would require maintaining a separate mapping table between names and variables, and that table is guaranteed to drift from reality.

DB password can't be changed here

🔴 There is no key called PG_PASSWORD. Studio only uses external PostgreSQL (the bundled container was removed on 2026-08-28), and the connection information is contained within the DATABASE_URL line in .env. The canonical source for that account is inside PG, so change it on the DB side first, then align DATABASE_URL, and then bin/restart.sh.

The platform's PP_* is also not here. Trying to pass it would be rejected just like a typo.

Names differ from inside the container

In logs and source code, you'll see them as ANTHROPIC_API_KEY · AI_API_KEY. The names used for .env and passwd.sh are the two listed above → Environment Variable Reference

---

Changing

The recommended approach is to omit the value and enter it via prompt. This keeps the password out of ps output or shell history. It asks for the value twice to confirm they match.

bin/passwd.sh PI_LLM_API_KEY

You can also pass the value directly as an argument.

bin/passwd.sh PS_ANTHROPIC_API_KEY=<new-value>

If you pass multiple items at once, the restart is bundled into a single one. Use this form during commissioning.

bin/passwd.sh PI_LLM_API_KEY=<new-value> PS_ANTHROPIC_API_KEY=<new-value>

If you just want to see what would change without doing anything, use --dry-run.

bin/passwd.sh --dry-run PI_LLM_API_KEY=<new-value>

When run, it first shows you what will be changed and the impact, then asks for confirmation via [y/N]. To skip the confirmation in automation, use --yes.

You can't omit the value in non-interactive mode

If you omit the value in an environment without a terminal (e.g., scripts, cron), the prompt can't be shown and it will end in an error. In that case, pass it in the KEY=<value> format.

---

What Happens When Run

The order is fixed.

Step	What happens
1	/etc/kopens/plantpulse-studio.env is updated to the new value (permissions 0600 preserved)
2	docker compose up -d --wait — the container is recreated to bake in the new value

The file is the canonical source for both keys. This isn't the kind of change that requires updating accounts on an external service — fix the file, rebuild, and you're done.

Studio connectivity will drop during this. Perform it during a maintenance window.

If it fails mid-way

Where	State	What to do
Step 2 (restart)	The file already has the new value	Check the status via bin/status.sh and handle the cause of the startup failure

Don't leave a value empty

The stack refuses to start if PI_LLM_API_KEY is empty. When changing it, make sure you put a new value in and verify it's in by checking with --list.

---

Verification

bin/passwd.sh --list

If the first 3 characters of the current value have changed, it's been applied. They show the first 3 characters so you can see at a glance that the default is gone.

---

Related Documents

• Secret Management — what each of the 6 key types is for
• Settings (Administrator) — managing app accounts and roles
• Installation — initial installation and first login