Confused about users/admin and API keys

[ovizii]

I've got it up and running but the docs are confusing.

Since I read that we can create users in immich-places, I assumed I'd create a user equivalent to my non-admin immich user with my own API key.

However, the README says:

You can disable registration (REGISTRATION_ENABLED=false) once your admin account exists.

What admin account? Is the first account created on immich-places an admin account? I can't see any admin stuff after logging in to immich-places.

I created an API key inside immich for my non-admin immich account. I registered a user on immich-places with my non-admin immich email account and used the API key I created for my non-admin immich account.

It appears to sync with immich just fine though.

But then I have an error in immich-places which again mentions an admin user: (may require admin key): immich getLibraries returned HTTP 403 Yes, I do use external libraries.

❯ docker compose logs -f immich-places-backend
immich-places-backend  | 2026/04/11 17:51:50 [DB] Initialized at /data/immich-places.db
immich-places-backend  | 2026/04/11 17:51:50 [Geocode] Provider: Nominatim (timeout: 10s)
immich-places-backend  | 2026/04/11 17:51:50 [Server] Listening on :8082 (TLS terminated by reverse proxy)
immich-places-backend  | 2026/04/11 17:51:50 [Sync] Starting incremental sync for user 25be0fdb-b9df-47c1-afee-96214953b8f1 (since 2026-04-11T17:45:55Z)...
immich-places-backend  | 2026/04/11 17:51:50 [Sync] Syncing stacks for user 25be0fdb-b9df-47c1-afee-96214953b8f1...
immich-places-backend  | 2026/04/11 17:51:51 [Sync] Stack sync completed for user 25be0fdb-b9df-47c1-afee-96214953b8f1: 90 stacks, 180 assets updated
immich-places-backend  | 2026/04/11 17:51:51 [Sync] Syncing libraries for user 25be0fdb-b9df-47c1-afee-96214953b8f1...
immich-places-backend  | 2026/04/11 17:51:51 [Sync] Failed to fetch libraries for user 25be0fdb-b9df-47c1-afee-96214953b8f1 (may require admin key): immich getLibraries returned HTTP 403
immich-places-backend  | 2026/04/11 17:51:51 [Sync] Syncing albums for user 25be0fdb-b9df-47c1-afee-96214953b8f1...
immich-places-backend  | 2026/04/11 17:51:51 [Sync] Album sync completed for user 25be0fdb-b9df-47c1-afee-96214953b8f1: 21 albums
immich-places-backend  | 2026/04/11 17:51:51 [Sync] Incremental sync completed for user 25be0fdb-b9df-47c1-afee-96214953b8f1: 0 assets updated in 170.912575ms
immich-places-backend  | 2026/04/11 17:56:50 [Sync] Starting incremental sync for user 25be0fdb-b9df-47c1-afee-96214953b8f1 (since 2026-04-11T17:51:50Z)...
immich-places-backend  | 2026/04/11 17:56:50 [Sync] Syncing stacks for user 25be0fdb-b9df-47c1-afee-96214953b8f1...
immich-places-backend  | 2026/04/11 17:56:51 [Sync] Stack sync completed for user 25be0fdb-b9df-47c1-afee-96214953b8f1: 90 stacks, 180 assets updated
immich-places-backend  | 2026/04/11 17:56:51 [Sync] Syncing libraries for user 25be0fdb-b9df-47c1-afee-96214953b8f1...
immich-places-backend  | 2026/04/11 17:56:51 [Sync] Failed to fetch libraries for user 25be0fdb-b9df-47c1-afee-96214953b8f1 (may require admin key): immich getLibraries returned HTTP 403
immich-places-backend  | 2026/04/11 17:56:51 [Sync] Syncing albums for user 25be0fdb-b9df-47c1-afee-96214953b8f1...
immich-places-backend  | 2026/04/11 17:56:51 [Sync] Album sync completed for user 25be0fdb-b9df-47c1-afee-96214953b8f1: 21 albums
immich-places-backend  | 2026/04/11 17:56:51 [Sync] Incremental sync completed for user 25be0fdb-b9df-47c1-afee-96214953b8f1: 0 assets updated in 95.311977ms

[ovizii]

Any ideas? The API key has library.read permissions, but I still see this error in immich-places:

immich-places-backend | 2026/04/11 17:56:51 [Sync] Failed to fetch libraries for user 25be0fdb-x-y-z-96214953b8f1 (may require admin key): immich getLibraries returned HTTP 403

[JoeriA]

Mounting the library not read-only fixed it for me: #6

[ovizii]

Mounting the library not read-only fixed it for me: #6

Thanks but my immich libraries are not mounted RO :-/

[Majorfi]

Hi
I will take a look over the week end

[Majorfi]

Ok @ovizii sorry for the delay
So I took a coffee and some time and my brain started remembering the project. This is a "false" positive kinda.

1. The way Immich works is that the read-only (RO) libraries behave in an incorrect way with Immich: any edit tells you "yes go, all good" but actually nothing happened. And to add to the fun, there is NO way to tell automagically if the external library is RO or not from the API.
2. So when a user with Libraries permissions loads the libraries -> We have a list of libraries but we don't know which ones are RO and which one are write.
3. To prevent "fake" success (you edit, we say yeah! and it's actually failing), we have in Immich Places a modal where an admin account with Library permissions can list the libraries and select the one that should be displayed on the UI/Map
4. Any non admin user WILL ALSO SEE the assets from the selected libraries, but the assets from the non selected will be hidden
5. This double pattern is required so we avoid issue above (3.) and the non admin user only sees stuff he can actually edit

---

Now, with the bug
The admin user needs to have library api access to list the library and being able to select the one to display/hide.
Even tho this is a property shared among all user in the system, the code was checking for ALL users to try to grab the libraries (which is useless because we just need one user to have access to load them). So if you have two users (With permission/without permission) -> It will succeed for user with permission and load all the required info into the local database, but it will then throw an error message for the user without permission, even tho this message is without effect (as long as you already have a user that loaded them) and even tho we already have them.

---

• Admin account is the first account created
• You don't "need" external libraries if you are not using them. If you are using them, you need to give the read libraries permission to the API key you use on Immich Places

[ovizii]

OK, I understand, but I can't quite test this as I cannot access Immich places at all as Immich has now started throwing this error whenever libraries are being accessed by immich-places:

immich  | [Nest] 24  - 05/16/2026, 9:52:12 PM    WARN [Api:AuthService~eoi23iuh] Denied access to admin only route: /api/libraries
immich  | [Nest] 24  - 05/16/2026, 9:57:12 PM    WARN [Api:AuthService~d9rmc9th] Denied access to admin only route: /api/libraries
immich  | [Nest] 24  - 05/16/2026, 10:02:12 PM    WARN [Api:AuthService~sshvpjsl] Denied access to admin only route: /api/libraries
immich  | [Nest] 24  - 05/16/2026, 10:07:12 PM    WARN [Api:AuthService~bwk65qtu] Denied access to admin only route: /api/libraries
immich  | [Nest] 24  - 05/16/2026, 10:12:12 PM    WARN [Api:AuthService~mde975z4] Denied access to admin only route: /api/libraries
immich  | [Nest] 24  - 05/16/2026, 10:17:12 PM    WARN [Api:AuthService~gsvme3ui] Denied access to admin only route: /api/libraries
immich  | [Nest] 24  - 05/16/2026, 10:22:12 PM    WARN [Api:AuthService~7tza4twl] Denied access to admin only route: /api/libraries

I guess that is because I used my Immich user's API key. I didn't understand (or the instructions weren't clear) that one has to use an admin API key (that is an Immich user with ADMIN permissions). I'll have to check how to reset my immich-places and start over again.

[ovizii]

OK, managed to gain access to immich-places. Thanks for taking the time to help.

I have to say, I do not understand anything you told me earlier. English is not my first language, I hope you can try again?

You said earlier:

To prevent "fake" success (you edit, we say yeah! and it's actually failing), we have in Immich Places a modal where an admin account with Library permissions can list the libraries and select the one that should be displayed on the UI/Map

Where? I don't see that. There's nothing in the docs here about that either. When I created my first account on immich-places, I now gave it an API key of my immich admin user. AS expected, it worked as that user has not a single picture, its an admin user. Then when logged in, under my immich-places user, there is a menu: API keys. Here I now entered an API key of my "normal" immich user, which actually has pictures and libraries. They were loaded.

But is there any correlation between immich users and immich-places users?
Why did I have to input 2 API keys? Can I not sign up for immich-places with my "normal" user and his API key?