# First run

> Getting in the first time, and the order to configure things in.

Source: /toft-docs/latest/admin/start/first-run/

A new install migrates its schema and starts with **no sign-in providers**. You
get in as the built-in administrator, `admin`.

## The first password

There is no published default.

| Install | Where the first password comes from |
|---|---|
| Helm chart | Generated into the release Secret (`BOOTSTRAP_ADMIN_PASSWORD`) |
| One-box bundle | Generated by `install.sh` and printed once |
| Anything else | `BOOTSTRAP_ADMIN_PASSWORD` if set; otherwise generated and printed once in the log at first boot |

`BOOTSTRAP_ADMIN_PASSWORD` is read only when the account has no password at all;
it never resets one. Lost it? Run `toft local-admin enable` on the host — see
[The built-in administrator](/toft-docs/latest/admin/identity/local-administrator.md).

The first password is **must-change**: signing in with it creates no session and
only lets you replace it. Replacing it signs you in.

> **Note**
>
> No first-user-becomes-admin rule. The first person through a new provider gets
> that provider's `default_role`. Administrators are appointed by an administrator.

## The order to do things in

1. **Sign in as `admin`** and set a real password.
2. **Open Admin → System checks** to see what this install can and cannot do
   ([checks](/toft-docs/latest/admin/operate/checks.md)).
3. **Add a [sign-in provider](/toft-docs/latest/admin/identity/providers.md)** and confirm somebody
   can sign in through it.
4. **Make one of those people an administrator** — before you rely on SSO.
5. **Turn on only the [optional capabilities](/toft-docs/latest/admin/capabilities/optional.md)** you
   will use.
6. **Decide whether apps may be [public](/toft-docs/latest/admin/security/anonymous.md)**, and whether
   every app is [listable](/toft-docs/latest/admin/apps/listing.md) to everyone signed in.
7. **Adjust the [operating dials](/toft-docs/latest/admin/config/operating-dials.md)** if the defaults
   do not fit your machine.
8. **Configure [email](/toft-docs/latest/admin/capabilities/email.md)** so people get notified.

> **Do step 4**
>
> An install with SSO and no administrator behind it works until the day it does
> not. Keep the `admin` password where your team keeps break-glass credentials, and
> do not switch local sign-in off with only one administrator — the **Lockout risk**
> check warns when you have.