Create the Owner Account

A fresh deployment has no users, and ordinary sign-up cannot claim the Owner role. The Owner is created once, with a one-time bootstrap token that is only ever written to your Worker’s own logs.

1. Request a token

curl -X POST https://your-api-worker-url/api/v1/system/bootstrap/request

The response does not contain the token.

2. Read the token from the Worker logs

wrangler tail

Look for a line beginning [installation-bootstrap]. It contains the token and says it expires in 30 minutes. (Locally, it appears in the wrangler dev terminal.) Only someone with access to your deployment’s logs can read it.

3. Complete the bootstrap

curl -X POST https://your-api-worker-url/api/v1/system/bootstrap/complete \
  -H 'Content-Type: application/json' \
  -d '{"token":"<token from the logs>","email":"you@example.com","password":"a-strong-password","name":"Your Name"}'

The password must be at least 8 characters. The token is single-use and is stored only as a hash.

Both routes return 404 once any user exists on the deployment, so they cannot be used later.

4. Sign in

Open the Admin Worker URL printed by setup and sign in with that email and password. The bootstrap Owner’s email is treated as verified.

Every other account

Every account created afterwards must verify its email address before it can sign in. If you have not configured email yet, the verification link is logged instead of sent: run wrangler tail, create the account (Admin → Users → Add user), and open the /verify-email?token=… link from the log.

A person who signs up on your website has no CMS role (none) until an Owner or Admin grants one. Add user in the admin creates a staff account with the Editor role. See Users & Roles.

Next: create a content type and entries (Content), and consider generating recovery codes for the Owner account.