First sign-in and management TLS

Create the first Administrator and replace the temporary management certificate.

The first Control user is created through a one-time bootstrap flow.

Get the first Administrator token

On the server, retrieve the bootstrap token generated during installation:

sudo journalctl -u paneld.service --no-pager | grep 'AUTH BOOTSTRAP TOKEN'

Open the management address shown by the installer, enter the token and create the first Administrator account. Treat the bootstrap token as a short-lived secret and do not share it.

Set up a trusted management certificate

Point the management hostname at the server and make TCP port 80 reachable for the certificate challenge. Then use the supported TLS helper from the installed release:

sudo ./scripts/configure-panel-tls.sh \
  --hostname panel.example.com \
  --email [email protected]

The normal production management listener moves to HTTPS on port 443. If you intentionally keep management on 8443, use the helper's supported port option.

Reserve the management hostname for Control; do not attach the same hostname to a managed Site.

After first sign-in

Enable MFA for Administrator accounts, review Access, configure backups and test a non-production Site before hosting important workloads.

Branded sign-in

After initial setup, an Administrator can change the host-wide sign-in identity from Settings → Appearance. If host sign-in branding is disabled, unauthenticated screens continue to show the standard Control identity.