First Login

On a fresh install PicPeak starts with no admin account. You create the first admin in your browser, protected by a one-time setup token — so no password ever sits in a config file.

If you set ADMIN_PASSWORD in .env (or ran the install script with --admin-password), PicPeak seeds the admin for you instead — skip to Seeded admin.

Get your setup token

The token is generated at first boot while no admin exists. Retrieve it any of these ways:

Option 1: From the install script — if you used Simple Install, the token is printed at the end of the run.

Option 2: From the logs


docker compose logs backend | grep -i "setup token"

Output:


[setup] No admin account yet — open /admin to finish setup. One-time setup token: q7Fh2K9x…

Option 3: From the token file (written to your data volume)


# Compose stack
docker compose exec backend cat data/SETUP_TOKEN
 
# All-in-one image — different path
docker exec picpeak cat /data/db/SETUP_TOKEN

The two deployments keep this file in different places, and the all-in-one image is the one people search for in vain: it uses /data/db/, not /app/data/. If the host has no shell — a NAS container UI, typically — open the volume in a file manager and read db/SETUP_TOKEN directly, or skip the token entirely with the seeded-admin route below.

Create your admin account

Open the admin panel

Navigate to http://localhost:3000/admin (or https://your-domain.com/admin behind a reverse proxy). With no admin yet, you are redirected to the /setup screen.

Paste the token and set your credentials

Enter the setup token, then your email and a password. The password must have:

At least 8 characters
An uppercase letter, a lowercase letter, and a number
A strength check also rejects common/guessable passwords

Done

Your account is created as the highest-privilege super admin and you’re logged straight in.

The setup token is single-use and stops working the moment the first admin exists — a leaked token is harmless after setup. If you never complete setup and lose the token, restart the backend to print a fresh one.

Seeded admin (legacy)

If ADMIN_PASSWORD (or --admin-password) was set, PicPeak creates the admin at migration time and writes the credentials to a file instead of showing the setup screen.


# Compose stack
docker exec picpeak-backend cat data/ADMIN_CREDENTIALS.txt
 
# All-in-one image
docker exec picpeak cat /data/db/ADMIN_CREDENTIALS.txt

The password is not written to the container log, and the credentials file is readable only by its owner (mode 0600), so read it with docker exec as shown (builds containing PicPeak PR #1491 ).

On a NAS, where the container UI usually gives you no shell, this is the easier route: set ADMIN_PASSWORD before the first start and you never need to read a file at all. It takes effect only while no admin exists — see Single-container install.

Log in at /admin with the email (not the username) and that password; you’ll be forced to change it on first login.

If you lose access

Reset the admin password from inside the backend container:


docker exec picpeak-backend node scripts/reset-admin-password.js --force \
  --credentials-file data/ADMIN_CREDENTIALS.txt

Or via the install script:


sudo ./picpeak-setup.sh --docker --force-admin-password-reset

Configuring the admin email

You set the admin email in the browser during setup. To pre-fill a default for the seeded-admin path, set ADMIN_EMAIL in .env before first deployment:


[email protected]