# SlowBooks Pro Server Edition — setup guide One download, two products: the same signed Windows build that runs as a single-user desktop app can serve your whole office. Add a second user and the deployment *becomes* Server Edition — no separate license, no separate download, free either way. ## What you get - One Windows PC hosts the books; everyone else uses a **browser** — nothing to install on the other computers. - **Users and roles**: admin (everything), bookkeeper (daily books, no admin functions), accountant (reads everything, the audit log included, and posts journal entries only — an outside accountant's sign-in, see [working-with-your-accountant.md](working-with-your-accountant.md)), read-only (reports and lookups). **HR and payroll are admin functions** — pay runs, pay stubs, W-2/941 forms, direct-deposit accounts, portal tokens, benefits, garnishments, onboarding paperwork and employee records are refused to the other three roles, reads included; the employee list stays visible to them as a directory (names, activity, work state) with pay, tax elections and addresses blanked. Time entries and time off remain daily books. - Every change in the audit log says **who** made it. - The company stays **one file** — backup is copy, undo is restore. ## Quick trial (no install, stops when you close it) On the machine that will host: ```powershell cd .\SlowBooksPro.exe --serve-lan ``` A popup shows the connect URLs (also written to `connect-urls.txt` in the data folder). Allow the Windows Firewall prompt. From any other computer on the network, browse to `http://:3001`. ## Permanent install (starts with Windows, no login needed) From an **elevated** PowerShell in the folder containing the exe: ```powershell powershell -ExecutionPolicy Bypass -File _internal\scripts\windows\serveredition-install.ps1 ``` This registers a startup task (runs as SYSTEM before anyone logs in), opens the firewall port, sets the data home to `C:\ProgramData\SlowBooksPro` (machine-wide, not one user's profile), starts the server, and prints your team's connect URLs. If you already have desktop-mode books in `%LOCALAPPDATA%\SlowBooksPro`, the script copies them (company files, encryption key, uploads, backups) into the new data home the first time — your desktop copies are left untouched. Run it from an **elevated** PowerShell (right-click → Run as Administrator) and from the installed app's folder — a wrong location stops with a "SlowBooksPro.exe not found" message before anything is changed. Undo it any time: ```powershell powershell -ExecutionPolicy Bypass -File _internal\scripts\windows\serveredition-uninstall.ps1 ``` Your books survive uninstall — the script never deletes data. ## Adding your team On a multi-user install the sign-in screen lists the usernames, so a person picks their name and types only their own password — the way desktop bookkeeping software has always worked. Names only, never roles, and only before sign-in. Anyone who can reach the port can read that list, which is one more reason Server Edition is for trusted networks. 1. Sign in as the admin → **Settings → Users**. 2. Add each person with a username, password, and role. The moment a second user exists, the login screen gains a username field and the header reads **SERVER EDITION**. 3. Roles are enforced server-side: a read-only user physically cannot post an entry; an accountant can post and void their own journal entries and nothing else; a bookkeeper cannot touch Settings, Users, backups, or migrations, and cannot connect, remap or disconnect a bank feed (those store a credential and wire the books, so they are the administrator's) — but a bookkeeper does run the day-to-day syncs on a feed the administrator has connected. The last active admin can never be locked out — the app refuses to demote or deactivate them. 4. **Invite your accountant** (Settings → Users) makes a sign-in with a one-time password and shows what to send, once: the address, the username and the password, each with a Copy button of its own. They choose their own password at the first sign-in and nothing else opens until they do. Give the sign-in an end date if the engagement has one: past that day the sign-in is refused with the date, and you can extend it from the Users list, which also shows each person's last sign-in. An administrator's password reset works the same way: the new password is for one use. ## API tokens (programs, not people) A program (an AI agent, the receipt service, an import tool, a script) signs in with an API token instead of a password. An administrator makes one under **Settings → API Tokens**: a label, a role and, if the program needs it, **Can make backups**. The secret (`sbp_…`) is shown once and kept only as a SHA-256 hash. The program sends it on every request as `Authorization: Bearer sbp_…`; no session cookie and no CSRF token are involved. Every change it makes is in the audit log as `token: