---
id: first-login
title: First login
sidebar_label: First login
---

A fresh install has no users and no organisation. The first visit creates both.

## 1. Bootstrap

Open the control plane in a browser. Because no user exists, you land on
`/setup`.

Fill in:

| Field             | Notes                                                             |
| ----------------- | ----------------------------------------------------------------- |
| Organisation name | Display name. Shown throughout the UI                             |
| Slug              | Lowercase, used in the hostname on cloud. Some names are reserved |
| Your name         |                                                                   |
| Email             | Becomes your sign-in identity                                     |
| Password          | Stored bcrypt-hashed                                              |

Submitting creates the organisation and its **owner** you.

:::warning Bootstrap works exactly once
The endpoint is open only while the database has no users. As soon as the first
one exists, `/setup` redirects to the login page and the bootstrap endpoint
refuses. There is no second chance to create the first owner, so record the
credentials before you close the tab.
:::

## 2. Sign in

You are taken to `/login`. Sign in with the email and password you just set.

Sessions are an opaque 32-byte token in the `km_session` cookie, with the body
held in Redis for 24 hours. Restarting Redis signs everyone out and loses
nothing else.

## 3. Look around

You land on the fleet dashboard, which is empty. The sidebar is the whole
product:

| Section   | What it does                              |
| --------- | ----------------------------------------- |
| Servers   | The fleet enrol, inspect, console, update |
| Keys      | SSH public keys and their assignments     |
| Workflows | Compose and run scripted work             |
| Steps     | The reusable step library                 |
| Monitors  | HTTP, TCP, ICMP and TLS checks            |
| Secrets   | The encrypted vault                       |
| Audit     | Every mutating action                     |
| Settings  | Members, SSO, alerts, retention, licence  |

## 4. Add the rest of your team

Go to **Settings → Access**. Add members with a role:

| Role     | Can                                                |
| -------- | -------------------------------------------------- |
| `owner`  | Everything, including billing-adjacent settings    |
| `admin`  | Everything except owner-only settings              |
| `member` | Day-to-day work servers, keys, workflows, monitors |

Settings and organisation management require `owner` or `admin`.

If you would rather not manage passwords, configure OIDC instead see
[Settings](../vantage/settings.md#single-sign-on-oidc). OIDC is configured per
organisation, and the client secret is stored encrypted.

## Next

[Add your first server](./first-server.md).