First boot

Checkend has no default password. At the first start, the server makes a one-time setup URL. The person who opens it becomes the first admin.

The setup URL

The server prints the setup URL at the first start. It looks like this:

https://stats.example.com/setup#cesetup_...

The server also writes the URL to the file <data>/setup-url (mode 0600), until the first admin exists. The installer prints the URL for you. With Docker, find it in the log:

docker logs checkend 2>&1 | grep setup

The token is in the URL fragment (after #), so it does not go into an access log.

Caution

Keep the setup URL private until you use it. Anybody with the URL can make the first admin. A restart of the server makes a new URL, and the old URL does not work after the restart.

Make the first admin with a passkey

1. Open the setup URL in a browser.
2. Type your email address.
3. Select Create a passkey, and follow the steps of your browser or password manager.
4. Select the modules. In this version, only analytics is available.
5. Add the first site. The page shows the install prompt and waits for the first event. See Add a site.
6. Connect an agent. The page shows the MCP URL, a form for an agent token, and the commands for Claude Code, any MCP client and ce. See Connect your agent.

The page removes the token from the address bar. After this, sign in on /signin with Sign in with a passkey. You do not type an email address to sign in.

You can add more passkeys later in Settings.

Passkeys need HTTPS or localhost

Passkeys work only on HTTPS with a domain name, or on localhost. They do not work on an IP address, or on plain HTTP with a domain name.

• On a server with --domain, or behind a proxy with TLS, passkeys work.

• On 127.0.0.1, the server uses localhost for the passkeys. Open the setup URL with localhost, not with 127.0.0.1.

• On a remote server without a domain, open an SSH tunnel, then open the setup URL on your computer:

  ssh -L 8080:localhost:8080 you@server

Make the first admin with an API token

Where passkeys do not work, the setup page tells you why. It then offers Create the admin with an API token. Use this on a private network with an IP address only.

1. Open the setup URL.
2. Type your email address.
3. Select Create the admin with an API token.
4. Copy the token. The page shows it one time.
5. Sign in to the web UI with the token.

You can also make the first admin from a terminal with ce setup. Use the token from the setup URL:

ce setup https://stats.example.com --email you@example.com --setup-token cesetup_...

ce setup makes the admin and stores the new admin token, as ce login does. A wrong or used setup token exits with code 5.

Automation: no setup step

For automation and CI, make the first admin from environment variables at the first start. Set both variables:

Variable	Value
CHECKEND_ADMIN_EMAIL	The email address of the first admin.
CHECKEND_API_TOKEN	The API token of the admin: ce_ and at least 32 characters.

CHECKEND_ADMIN_EMAIL=ops@example.com CHECKEND_API_TOKEN=ce_<at least 32 characters> \
  checkend serve --data /var/lib/checkend

Then use the token with ce:

CHECKEND_URL=https://stats.example.com CHECKEND_TOKEN=ce_... ce sites list

Caution

Keep CHECKEND_API_TOKEN in a secret store. It is an admin token.

Next step

Add a site.