Signing In

Your First Administrator

Set admin_email: in operator.yaml before you install. tc-operator install then creates an auth user for that address, grants it the operator_admin role, and prints a temporary password once in the install summary:

auth user created — TEMP PASSWORD (change after first login): 7f3a…
operator_admin granted — log in at the node's admin app

That password is printed once and has no recovery. Keep it until you have signed in, then replace it.

Install also provisions that admin’s platform identity, so the admin can send invitations from the console’s Invite User button. If it cannot run at install time, the identity is created the first time you send an invite. There is nothing to do either way.

If you leave admin_email unset, install skips all of this and prints how to do it by hand. Re-running install is safe: an existing admin user is kept, its password is not reset, and the role is granted again.

Change the Password Immediately

Sign in, then open Account at the bottom of the left sidebar. Enter a new password of at least 12 characters, confirm it, and press Update password. There is a Show passwords tick box if you want to read what you typed.

Do this before you sign out. The temporary password is a long random string meant to get you in once.

The Sign-In Methods

The login screen detects which methods your node has configured and shows only those. There are three.

Password is always available. It is your first sign-in, and it works on a bare node with no email and no OAuth configured, so it is the guaranteed way in.

Send magic link needs SMTP. Wire the smtp: block in operator.yaml and re-run install. Without it the node cannot send email at all and the option stays hidden. Once SMTP is wired, any admin with an account on the node can ask for a sign-in link by email.

Continue with Google and Continue with Apple need provider credentials in the auth container’s environment, and the node’s own /auth/v1/callback registered as the redirect in the provider’s console. The matching button then appears on its own. The callback is on your own domain, so there is nothing to register with Trusted Codes.

When passwordless methods exist, a Sign in with password link sits under them and switches to the password form; Back to sign-in options switches back. When none exist, the password form is all you get.

The console does not offer an environment choice. Your node’s backend is fixed, so there is nothing to switch between.

Before Your Node Is Approved

If your node has been submitted but Trusted Codes has not yet approved its admission, you can sign in but the console is locked behind a screen headed Awaiting trusted.codes approval. It offers Check again and a sign-out link. It unlocks by itself once your server joins the federation registry.

Adding More Administrators

Run this on the node box. It needs no terminal of its own and is safe to re-run.

tc-operator add-admin --email someone@example.com

To take the role away again:

tc-operator add-admin --email someone@example.com --revoke

The account must already exist on the node — the person has to have signed in at least once. add-admin only grants the role; it does not create the account. The admin_email path at install is the one that creates an account for you.

The verb is fixed to operator_admin and can never grant the central role.

When You Cannot Get In

Check, in this order: that the admin surface is enabled and its host resolves over HTTPS; that you are using admin_email with the one-time password from the install summary, or a password set since; and that the account really holds operator_admin. A sign-in by any other account is rejected by design.

The magic-link option only appears once SMTP is configured.