Downgrading the first user breaks API key permissions

[aguerin]

Hi team
We had a pretty serious scare this morning and wanted to share the issue to better understand what’s happening — and maybe help others avoid it.

---

Context

We have several admin users on our production instance.
After a review with our Legal team, we decided to downgrade some of them to the “Member” role before fully removing their access.

Among them, we also downgraded the very first user created when the platform was initialized.

---

The problem

After that change, we were no longer able to list projects — even when using API keys that were working fine before.

Even with my own API key (I’m still an admin and was the second user created), I couldn’t fetch projects anymore.
Oddly enough, I could still access everything via the UI using my account.

---

What we observed

• Downgrading the first user (entry in the user table) seems to break something critical.
• API keys — even those belonging to other users — lose their admin rights after that.
• The issue stopped as soon as we restored admin rights to the first user.

---

Our theories

• API keys might be tied internally to the very first user.
• There could be a hidden “platform owner” concept linked to user ID 1, and some system operations fall back to that context.

---

What we need

• Can you confirm or deny any of these assumptions?
• Can you explain why downgrading the first-ever user breaks API access for others, even if they’re admins?

Thanks a lot in advance — and let us know if you need any specific logs from our side.

[aguerin]

We spoke directly with the Activepieces team, who confirmed that calls made via API tokens take the permissions of the very first user created by the account.

They recommend that we make the change directly in the database, to ‘swap’ the identity of the very first user of the platform with that of a dedicated user (admin).