First Login

On a fresh install PicPeak starts with no admin account. You create the first admin in your browser, protected by a one-time setup token — so no password ever sits in a config file.

If you set ADMIN_PASSWORD in .env (or ran the install script with --admin-password), PicPeak seeds the admin for you instead — skip to Seeded admin.

Get your setup token

The token is generated at first boot while no admin exists. Retrieve it any of these ways:

Option 1: From the install script — if you used Simple Install, the token is printed at the end of the run.

Option 2: From the logs


docker compose logs backend | grep -i "setup token"

Output:


[setup] No admin account yet — open /admin to finish setup. One-time setup token: q7Fh2K9x…

Option 3: From the token file (written to your data volume)


# Compose stack
docker compose exec backend cat data/SETUP_TOKEN
 
# All-in-one image — different path
docker exec picpeak cat /data/db/SETUP_TOKEN

The two deployments keep this file in different places, and the all-in-one image is the one people search for in vain: it uses /data/db/, not /app/data/. If the host has no shell — a NAS container UI, typically — open the volume in a file manager and read db/SETUP_TOKEN directly, or skip the token entirely with the seeded-admin route below.

Create your admin account

Open the admin panel

Navigate to http://localhost:3000/admin (or https://your-domain.com/admin behind a reverse proxy). With no admin yet, you are redirected to the /setup screen.

Paste the token and set your credentials

Enter the setup token, then your email and a password. The password must have:

At least 8 characters
An uppercase letter, a lowercase letter, and a number
A strength check also rejects common/guessable passwords

Done

Your account is created as the highest-privilege super admin and you’re logged straight in.

The setup token is single-use and stops working the moment the first admin exists — a leaked token is harmless after setup. If you never complete setup and lose the token, restart the backend to print a fresh one.

Seeded admin (legacy)

If ADMIN_PASSWORD (or --admin-password) was set, PicPeak creates the admin at migration time and writes the credentials to a file instead of showing the setup screen.


# Compose stack
docker exec picpeak-backend cat data/ADMIN_CREDENTIALS.txt
 
# All-in-one image
docker exec picpeak cat /data/db/ADMIN_CREDENTIALS.txt

On a NAS, where the container UI usually gives you no shell, this is the easier route: set ADMIN_PASSWORD before the first start and you never need to read a file at all. It takes effect only while no admin exists — see Single-container install.

Log in at /admin with the email (not the username) and that password; you’ll be forced to change it on first login.

If you lose access

Reset the admin password from inside the backend container:


docker exec picpeak-backend node scripts/reset-admin-password.js --force \
  --credentials-file data/ADMIN_CREDENTIALS.txt

Or via the install script:


sudo ./picpeak-setup.sh --docker --force-admin-password-reset

Configuring the admin email

You set the admin email in the browser during setup. To pre-fill a default for the seeded-admin path, set ADMIN_EMAIL in .env before first deployment:


[email protected]