Web UI

Licensed plugin 💎: The dashboard requires the ui plugin in [license].key. OSS superd serves a short notice at / instead of a dashboard.

OSS vs subscription

OSS superd does not embed a dashboard. The optional ui plugin serves it at runtime via super_plugin_ui_v1 after you add a license key and plugin libraries — see Get Super Pro.

Accessing the dashboard (licensed)

With the ui plugin loaded and authorized in [license].key:

http://localhost:9002

Log in with an Access Token (sk-…) when the security plugin is enabled. Prefer generated tokens for day-to-day use; config auth_secret remains usable until an Admin explicitly disables it. See Authentication.

Dashboard tour

Screenshots below are from a licensed deployment (docs/static/images/). Use the tabs to browse each area — images are capped in width; click to enlarge.

Process list with host CPU/memory metrics (from the machine running superd), status filters, search, and topology view.

Process detail drawer: actions, configuration (command, hooks, health checks, resource limits, environment).

Live stdout/stderr streaming from the process detail drawer, plus file log history.

Notifications → Inhibition rules when the notify plugin is licensed: When → Mute targets → For (cross-event storm suppression).

See Event notifications.

Deploy the ui plugin

Install the ui plugin library from your subscription delivery package into $SUPER_ROOT/plugins/.

Restart superd after updating plugins.

Feature summary

The dashboard also includes create/edit program forms, a stack editor, API token management, and a license page — not shown above.

Security

Without security plugin (OSS only): The API and dashboard static assets are reachable without authentication on the bind address. OSS defaults to loopback-only startup (allow_insecure_public_bind = false).

Licensed: security is bundled and must load — startup fails otherwise. Dashboard and API require token auth.

With security plugin loaded: Token authentication and RBAC apply to the API and dashboard. Prefer generated Access Tokens for day-to-day login. auth_secret remains usable until an Admin explicitly disables it (after creating an Admin token). See Access control and Authentication.

Security tip: OSS exposure beyond localhost requires explicit allow_insecure_public_bind = true or the security plugin. Licensed deployments always load security.