i have built this plex super admin panel this is a demo presentation of the panel if your wanting to take a look at the demo panel hit the link below this is the read me of what it can do

# Plex Super Admin Panel

A small PHP 7.4-compatible panel for managing Plex user access requests.

It supports:

- First-run admin setup.
- Saving an `X-Plex-Token`.
- Syncing owned Plex servers and library section IDs.
- Showing library content counts when Plex returns or allows the panel to query them.
- A public TV-code form for friends with a fixed 24-hour trial option.
- Linking a 4-character TV code to the configured Plex account when you explicitly confirm it.
- Admin-side pass durations: 24-hour test, 1 month, 3 months, 6 months, and 12 months.
- Extending linked users from the dashboard when they upgrade or renew.
- Expiry cleanup that can remove tracked Plex devices and tracked Plex library-share users when a pass expires.
- Optional Plex library invites by Plex username or email, with the same fixed pass durations.
- Reseller credits for reseller accounts. Super Admin is not charged credits.
- A Super Admin proxy pool that rotates Plex API traffic for every panel user.

## Reseller Credits

Credits apply to both reseller types: **Resellers With There Own Plex Content** and **Resellers Selling Owners Plex Content**. Super Admin can add credits from the reseller management pages.

TV device credit costs:

- 24-hour test: 0 credits
- 1 month: 1 credit
- 3 months: 2 credits
- 6 months: 3 credits
- 12 months: 4 credits

Plex library share by email credit costs:

- 24-hour test: 0 credits
- 1 month: 3 credits
- 3 months: 6 credits
- 6 months: 9 credits
- 12 months: 12 credits

## Important Plex Flow Note

Plex has two different flows:

- **Library invite:** your friend uses their own free Plex account, and you share selected libraries with their username or email. This is the recommended flow.
- **TV link code:** the 4-character code on a TV signs that TV app into the Plex account that links the code. If you link the code with your Plex token, that TV is linked to your account.

This panel is now focused on the TV link-code flow. It stores your Plex token, not your raw Plex password. Treat the token like a password because it can link devices into your Plex account.

The panel has a built-in cleanup check that runs at most once per UK day after midnight when the admin area is visited. PHP only runs when something visits the site, so for exact always-on cleanup use the dashboard's private cron URL with your host scheduler at midnight UK time.

## Proxy Pool

The Super Admin dashboard has a **Proxy pool** panel. Add one proxy per line and enable the pool to route Plex API requests for every panel user through the shared rotating pool.

Supported formats:

```text
http://host😛ort
http://user😛ass@host😛ort
https://host😛ort
socks4://host😛ort
socks5://host😛ort
```

SOCKS proxies require the PHP cURL extension.

## Requirements

- PHP 7.4 or newer.
- PDO SQLite extension.
- cURL extension recommended.
- HTTPS strongly recommended for production.

## Windows SSL Certificate Fix

If Plex requests fail with `unable to get local issuer certificate`, PHP cannot find a trusted CA bundle.

The panel checks these locations automatically:

- `storage/cacert.pem`
- The `PLEX_CA_BUNDLE` environment variable
- PHP `curl.cainfo` / `openssl.cafile`
- Common Windows paths, including the Plex desktop app CA bundle

The most reliable fix is:

1. Download `cacert.pem` from https://curl.se/ca/cacert.pem
2. Put it in this project as `storage/cacert.pem`
3. Try **Sync Plex libraries** again.

## Install

1. Upload this folder to your server.
2. Set the web/document root to the `public` folder.
3. Open the site in a browser.
4. Create the admin account.
5. Add your Plex token and sync libraries.

The SQLite database is stored in `storage/panel.sqlite`, outside the `public` folder. Keep it private. The package includes Apache deny files for `app/` and `storage/`, but the safest setup is still to point the web root at `public`.

This panel does not use `config.php` or `config.sample.php`. If your upload has those files, you are probably using a mixed/old upload. You can open `/health.php` after upload to check PHP version, SQLite, cURL, and storage permissions. After admin setup, health checks are private unless you are signed in.

## Getting a Plex Token

Plex documents `X-Plex-Token` as an account authentication token. Their support article explains the temporary-token method:

https://support.plex.tv/articles/204059436-finding-an-authentication-token-x-plex-token/

For a production tool, use a token you intentionally created and can revoke if needed.

## Finding the Server Machine Identifier

The panel can usually discover your owned server and set the machine identifier when you click **Sync Plex libraries**.

If you need to set it manually, it is the server/client identifier used by Plex for your server. You can find it from Plex resources or your Plex server advanced settings.

Library content counts are updated when you click **Sync Plex libraries**. The panel first tries Plex metadata/proxy count routes, then direct Plex server connections. If your web host cannot reach the Plex server and Plex does not return counts through the account API, a library may show `items: not counted yet` with a note explaining what failed.

The dashboard stores both Plex library identifiers when Plex returns them: `share` is used for Plex library invites, while `section` is used for direct server count URLs such as `/library/sections/SECTION/all`.

For content counts, the panel asks Plex for the useful media layer where possible: movies for movie libraries, episodes for TV libraries, and albums for music libraries. This avoids the common Plex mismatch where TV libraries count shows and music libraries count artists instead of the intended media items.

If the note says `Plex server connection was not reachable from this host`, add a reachable **Plex public URL for content counts** in the dashboard Plex account settings, for example `https://your-ddns-name.example:32400` or `http://your-public-ip:32400`. That URL must be reachable from the web host running this panel, not just from your home network.

If you use a raw IP address, `https://IP😛ORT` may fail because the SSL certificate usually will not match the IP. Use `http://IP😛ORT`, or use a real hostname with a valid certificate.

After saving the URL, use **Test public URL** on the dashboard. If it fails, the error shown by the panel is the thing to fix before syncing counts.

## Device PIN Workflow

1. Give your friend the public request form URL shown on the dashboard.
2. Ask them to open Plex on the TV and send the 4-character code.
3. They submit their name and TV code in the form. Public requests are always 24-hour trials.
4. In the dashboard, tick the confirmation box and use **Link TV**.
5. The TV app is signed into the Plex account represented by your saved Plex token.
6. When the expiry passes, the panel removes the captured Plex device ID during cleanup.
7. To renew a linked user, use **Extend pass** on their request row. The extension is added from their current expiry if it is still active, or from now if the expiry has passed.

## Expiry Cleanup

The dashboard shows a private cron URL. Run it with your host's scheduler at midnight UK time. Normal cron URL calls are gated so the sweep runs once per UK date. Add `&force=1` only when you want to test or manually force a run.

Example:

```text
curl "https://your-domain.example/cron.php?token=YOUR_TOKEN"
```

Linux cron for midnight UK time:

```text
TZ=Europe/London
0 0 * * * curl -fsS "https://your-domain.example/cron.php?token=YOUR_TOKEN" >/dev/null 2>&1
```

Windows Task Scheduler action:

```text
powershell.exe -NoProfile -Command "Invoke-WebRequest -UseBasicParsing 'https://your-domain.example/cron.php?token=YOUR_TOKEN'"
```

Set the Windows trigger to 00:00 and use a UK time zone.

Cleanup also checks expired library-share users. When Plex returns a share ID during the invite, the panel stores it and can remove that share from Plex automatically when it expires. If Plex does not return a share ID, the row shows `Not captured`; cleanup will try to find the matching share by username/email, then mark it for manual review if no safe match is found.

If Plex does not expose a new device ID immediately after PIN linking, the linked user will show `Not captured`. Use the **Assign device ID** dropdown on the Linked devices page to choose the matching Plex authorized device manually. Rows without a captured or assigned device ID cannot be safely auto-removed by the panel, because removing the wrong Plex device would be worse than leaving it for manual review.

## Security Notes

- Put the site behind HTTPS.
- Use a strong admin password.
- Do not expose the `storage` folder.
- Do not expose the `app` folder.
- Delete or restrict `health.php` if your host cannot keep it private after setup.
- Treat your Plex token like a password.
- If a token is compromised, rotate your Plex password and sign out connected devices from your Plex account settings.
- Plex tokens are redacted from panel error output, but you should still avoid sharing screenshots or logs that contain sensitive account details.

## Plex References

- Plex device link code flow: https://support.plex.tv/articles/203395277-connect-app-to-your-plex-account/
- Plex library sharing flow: https://support.plex.tv/articles/201105738-creating-and-managing-server-shares/
- Plex token support article: https://support.plex.tv/articles/204059436-finding-an-authentication-token-x-plex-token/
- PlexAPI community implementation used as an endpoint reference: https://python-plexapi.readthedocs.io/en/stable/_modules/plexapi/myplex.html









https://jedireturns.co.uk/plex%20demo/public

this is a super panel to add resellers selling owner content and also resellers selling there own content you can create resellers add credits that the resellers purchase from you you add that to there account and then they add 12 month sub for 4 credits and library share is same with credits

Very Nice work 👍