Super-admin
The super-admin email is the email address (or comma-separated list of emails) you provide during deployment as the SuperAdminEmails CloudFormation parameter. It's the one identity that always has full control over the deployment, no matter what changes inside the platform afterwards.
What the super-admin can do
- Manage the deployment from the Deployment Management Dashboard — change Cognito pools, custom domain, and apply stack updates.
- Recover the platform if regular admin accounts are lost or misconfigured.
- Drive top-level configuration that isn't safe to expose to ordinary admins.
Why it matters
These emails are locked into the deployment record when the CloudFormation stack is created. It's not an ordinary admin account that can be deleted from a dashboard later — it's a piece of the deployment's identity.
If you lose access to that mailbox, you lose access to a class of recovery actions. Treat it the same way you treat the root user of an AWS account.
Picking the right email
Best practices:
- Use a shared mailbox your team controls (e.g.,
agents-admin@yourcompany.com), not a single individual's address. - Use an inbox you'll still have in 5 years, not a contractor's address that ends with their engagement.
- Use an inbox that multiple people can access if you're a team.
- Don't reuse your AWS root account email — for the same reason you wouldn't reuse passwords.
When you sign in
The super-admin email gets the regular Admin Dashboard sign-in flow. The same email also has elevated permissions on the Deployment Management Dashboard — that's what makes it different.
Changing the super-admin email
Changing the super-admin email after deployment is not a routine operation. It involves updating the deployment record and reconfiguring related identity links. If you need to change it, contact Espressif and we'll walk you through it.
This is another reason to choose a long-lived shared address up front.
Multiple admins
Once the platform is running, the super-admin can sign up additional regular admins through the Admin Dashboard's normal sign-up flow. Those admins manage agents, tools, and end-user access — they don't have super-admin powers.
In short:
| Role | Who | What they can do |
|---|---|---|
| Super-admin | The email you set at deploy time | Everything; manages the deployment itself. |
| Admin | Other admins you sign up later | Create and manage agents, tools, KBs, share with end users. |
| End user | Sign up on /try/ | Chat with agents. |