Mastodon Error ‘You Are Not Authorized’ on Admin Dashboard: Fix

When you try to open the Mastodon admin dashboard and see the error message ‘You are not authorized,’ you cannot manage users, view reports, or change server settings. This error usually means your account does not have the correct admin role assigned in the database or the role has become corrupted. This article explains the root cause of the authorization failure and provides step-by-step instructions to restore your admin access using the Mastodon command-line interface.

Why Mastodon Returns ‘You Are Not Authorized’ on the Admin Dashboard

Mastodon uses a role-based permission system stored in the users table of the PostgreSQL database. The two roles that grant dashboard access are admin and owner. The owner role has full control, while the admin role can manage most settings but cannot delete the instance or change certain critical configurations.

The error occurs when your account’s role field is set to user or is NULL. This can happen after a failed database migration, a manual import of user records, or when the server domain name in the user record does not match the LOCAL_DOMAIN environment variable. Mastodon checks both the role and the domain match before granting access to the admin dashboard.

Another cause is a corrupted session or permission cache. When you change a user’s role, Mastodon does not immediately refresh the permissions for active sessions. The server continues to serve the cached authorization state until the cache expires or is manually cleared.

Steps to Fix the ‘You Are Not Authorized’ Error

You need SSH access to your Mastodon server and the ability to run commands as the Mastodon user. If you do not have SSH access, contact your hosting provider or system administrator.

1. SSH into your Mastodon server
   Open a terminal and connect to your server using ssh yourusername@yourserverip. Replace yourusername and yourserverip with your actual credentials.
2. Switch to the Mastodon user
   Run sudo -i -u mastodon to change to the user account that runs the Mastodon services. The username may vary; common names are mastodon or toot.
3. Navigate to the Mastodon directory
   Run cd /home/mastodon/live or the path where your Mastodon code is installed. Verify the path by checking your Docker compose file or systemd service file.
4. Open the Rails console
   Run RAILS_ENV=production bin/rails console. This starts an interactive Ruby shell connected to your Mastodon database. Wait for the prompt to appear.
5. Find your user record
   Type user = User.find_by(email: 'youremail@example.com') and press Enter. Replace youremail@example.com with the email address you use to log in. The console will display the user object if found.
6. Check the current role
   Type user.role and press Enter. If the output shows "user" or nil, the role needs to be changed. If it shows "admin" or "owner", the problem is elsewhere.
7. Change the role to admin
   Type user.update(role: :admin) and press Enter. The console will return true if the update succeeds. To make the user the owner, use user.update(role: :owner) instead.
8. Verify the domain in the user record
   Type user.account.username + '@' + user.account.domain and press Enter. Compare this with your server domain. If the domain is wrong or nil, update it by typing user.account.update(domain: 'yourdomain.com') replacing yourdomain.com with your actual domain.
9. Exit the Rails console
   Type exit and press Enter. You are now back in the shell.
10. Clear the permission cache
    Run RAILS_ENV=production bin/tootctl cache clear. This command flushes the Redis cache and forces Mastodon to reload permissions on the next request.
11. Restart the web process
    Run systemctl --user restart mastodon-web if you use systemd. For Docker setups, run docker restart mastodon_web_1. This ensures the new role is picked up by the web server.
12. Test the admin dashboard
    Open your browser, log out of Mastodon, log back in, and navigate to https://yourdomain.com/admin. The dashboard should now load without the error.

If Mastodon Still Shows the Authorization Error After the Main Fix

Session Cookie Not Updated After Role Change

Mastodon stores authorization data in a signed cookie. If the cookie was issued before the role change, the server may still see the old role. Clear your browser cookies for the Mastodon domain or open the dashboard in a private browsing window. Log in again and test the dashboard.

Environment Variable LOCAL_DOMAIN Does Not Match

Check the LOCAL_DOMAIN environment variable in your Mastodon configuration file (.env.production). Run grep LOCAL_DOMAIN /home/mastodon/live/.env.production. The value must be exactly the same as the domain in your user record, including any subdomain like social.yourdomain.com. If they differ, edit the file and restart all Mastodon services.

Database Migration Failed During Upgrade

After a Mastodon version upgrade, some database migrations may not run correctly. Run RAILS_ENV=production bin/tootctl db:migrate to apply any pending migrations. Then run RAILS_ENV=production bin/tootctl cache clear and restart the web process.

Mastodon Admin Roles: Owner vs Admin

Item	Owner	Admin
Access to admin dashboard	Yes	Yes
Delete the instance	Yes	No
Change server domain	Yes	No
Manage all user accounts	Yes	Yes
View and resolve reports	Yes	Yes
Modify server-wide settings	Yes	Yes

After applying the fix, you can now access the admin dashboard and manage your Mastodon instance. To prevent future authorization errors, always use the tootctl accounts modify command for role changes instead of direct database edits. Run tootctl accounts modify --role admin --email youremail@example.com from the shell to change roles without opening the Rails console.