First Admin Account

How you get your first administrator depends on how Infracast is deployed. On self-hosted servers you can choose the initial password with INFRACAST_ADMIN_PASSWORD; ADMIN_USERNAME and ADMIN_PASSWORD (without the prefix) are obsolete and no code reads them.

Deployment	How the first admin comes to exist	Role
SaaS	You sign up and verify your email	Tenant admin of your own tenant
Docker Compose, air-gap, ECS/Terraform	The server creates an initial account the first time it boots against an empty database	system-admin

Self-hosted: Docker Compose, air-gapped and ECS/Terraform

All self-hosted methods run the same infracast serve process (the container's default command is serve --addr :8080), so they behave identically.

On first boot, if the users table is empty, serve creates one user named admin with the system-admin role (the log line is no users found — bootstrapping admin user). This happens on every self-hosted method.

You must change the initial password at first login

• If INFRACAST_ADMIN_PASSWORD is set when the server first boots, that is the initial password (it is never logged).
• Otherwise the server generates a random 20-character password and writes it once to the startup log at WARN level (initial admin password: ...). Read it from the container log; it is not shown again.

Either way the account is flagged must change password. You can sign in, but every request other than change-password, logout and /me is refused with 403 (password_change_required) until you choose a new password; the web UI shows a change-password screen that cannot be dismissed. Do this before the server is reachable by anyone else.

What does not work

• infracast user create --username admin ... fails with error: user 'admin' already exists, because the server created that user on first boot. Pick a different username if you want a second administrator, or reset the existing password as shown below.
• POST /api/v1/bootstrap returns 409 Conflict (system already initialized) once any user exists, and the server creates admin before it accepts requests. It only succeeds if you created the database empty and call it before the first serve boot completes — which is not a realistic sequence. The body also has no bootstrap_token field: the endpoint accepts only username, password and email. GET /api/v1/bootstrap reports {"initialized": true|false}.
• Setting ADMIN_USERNAME/ADMIN_PASSWORD/API_SECRET_KEY (without the INFRACAST_ prefix) — not used; remove them from your configuration.

Setting the admin password

Use the emergency reset command. It authenticates with the server's JWT secret as a bearer token, so you do not need to know the current password:

export INFRACAST_JWT_SECRET='<the same secret the server runs with>'
./infracast user reset-password \
  --api https://infracast.example.com \
  --username admin \
  --password '<a new strong password>'

Notes:

• Always pass --api with your server's URL.
• The secret is read from INFRACAST_JWT_SECRET (or --jwt-secret); legacy variable names from earlier releases are still accepted.
• --api is required; there is no default server.
• Passwords shorter than 12 characters are rejected; use 16 or more.
• With the Docker image you can run it in the container: docker compose exec infracast ./infracast user reset-password --api http://localhost:8080 --username admin --password '<new>' (the container already has INFRACAST_JWT_SECRET).
• Because this endpoint accepts the JWT secret as a credential, keep the secret out of shell history and CI logs.

Then confirm by requesting a token:

curl -s -X POST https://infracast.example.com/api/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"<the new password>"}'

Creating additional users

Once logged in, create further users from the UI or with the CLI (a username other than admin):

docker compose exec infracast ./infracast user create \
  --username alice --password '<strong password>' --role system-admin

Roles: system-admin, tenant-admin, security-analyst, auditor, read-only.

Per-method notes

• Docker Compose — start the stack, then reset the password as above before publishing the port. See Docker quickstart.
• Air-gapped — identical; run the reset from a host inside the enclave with the same JWT secret. See Air-Gapped Deployment.
• ECS / Terraform — the ALB is reachable as soon as the service is healthy, so the initial account is exposed from that moment. Restrict the ALB security group (or listener rules) to your admin network until the password is changed. See Terraform quickstart.

SaaS

On app.infracast.io you create your own account:

1. POST /api/v1/register (or Sign Up in the UI) creates an account, a tenant and a user with the tenant-admin role. The user is inactive until the email is verified — it cannot log in yet
2. Click the verification link sent to your email (GET /api/v1/verify-email, valid 24 hours).
3. Log in. You are an administrator of your tenant; This sign-up path creates a tenant-admin, not a system-admin.

See SaaS quickstart.