How to use this admin
Smartsheet is still the source of truth. This app controls how live Smartsheet data is presented, filtered, branded, and optionally edited by contributors.
Main workflow
- Create a Smartsheet source.
- Create a view connected to that source.
- Configure setup, fields, filters, editing, and branding.
- Preview the output.
- Publish when the page looks right.
Before you start
SMARTSHEET_API_TOKENmust be valid.DATABASE_URLmust point to your production database on Railway or any other non-durable host. Local file mode is fine only for local/dev work.- If contributor editing is enabled,
CONTRIBUTOR_SESSION_SECRETmust be set. - If you use Supabase, backend-owned public tables must keep RLS enabled and the current app role must still have the generated access policy.
Important password note
Contributor passwords are stored as one-way hashes. Admins cannot view them. If someone forgets a password, use a reset link from the Contributors area instead.
Admin session cookies
Admin sign-in uses stateless, signed httpOnly cookies. Set a dedicated SMARTSHEETS_VIEW_ADMIN_SESSION_SECRET in production.
- Rotate the secret to log every admin out immediately after an incident or suspected cookie leak.
- If the secret is unset, the app derives signing material from the bootstrap username and password — changing the password then invalidates all admin sessions.
- On hosts with multiple environments, configure the secret per environment so Preview and Production behave predictably.