Bootstrap the first admin & sign in
Create the initial admin inside the container, then authenticate the CLI.
Eddytor has no public setup endpoint - there's no bootstrap token to leak.
The first admin is provisioned by running a tool inside the server container,
so the trust boundary is "can you exec into the container," the same model as
kubeadm writing admin.conf on a control-plane node.
Create the first admin
The curl | sh installer prompts you for this. To do it by hand:
docker compose exec eddytor-server eddytoradm setup \
--email you@example.com --org "Default"
# ✓ Admin you@example.com created in organisation 'Default'.Good to know
eddytoradm setup is idempotent - once an admin exists
it's a no-op, so a leaked database role can't use it to seize a second admin.On Kubernetes the equivalent runs in the server pod via kubectl exec; the
chart's install NOTES print the exact command.
Sign in
Eddytor uses magic-link / device-code sign-in - there are no passwords. Point the CLI at your server and log in:
eddytor config set-api-url http://localhost:8080
eddytor config set-flight-url http://localhost:8082 # `eddytor query` uses a separate Flight SQL port
eddytor login # device-code flow; opens your browser
eddytor get tablesHeads up
Find the link in the logs when SMTP is unset:
docker compose logs eddytor-server | grep -i 'sign in to eddytor' -A2Headless access (API key)
For scripting - or to run eddytor query reliably - mint a non-expiring API key
from inside the container (same exec boundary), then point the CLI at it:
docker compose exec eddytor-server eddytoradm create-api-key --email you@example.com
# Admin API key for you@example.com (shown once): edd_live_…
eddytor config set-key edd_live_…Heads up
eddytor login, for eddytor query. The device-login token lasts 15 minutes and query won't refresh it;
the bootstrap API key doesn't expire. Both surface failures as GetFlightInfo failed: Invalid or expired token - see
the fix.Lost your key or can't sign in?
Nothing to recover and nothing to miss - the in-container tools are re-runnable as often as you like (the auth boundary is exec access, not a secret). See Can't sign in / lost API key.
Next
- Connect storage - register a bucket.
- Roles & scopes - who can do what.