---
title: Create the first admin
description: Bootstrap the first account on a brand-new self-hosted instance — get the admin key, sign up, promote to Owner, optionally close signup.
---

A brand-new Tale instance has no users yet. The first sign-up needs a bootstrap key to claim the **Owner** role; after that, the instance behaves like any other org. This walk runs the bootstrap and points at the settings that turn open signup off once the team is in.

The bootstrap key is generated by a script that reads it from the running platform container; it rotates every time the platform restarts. If you take too long between generating the key and using it, generate a fresh one — old keys do not stack up.

## Before you begin

Have the instance running and reachable on `SITE_URL`. Verify with:

```bash
docker compose ps
```

Every service should show `running` or `healthy`. If any is unhealthy, [troubleshooting](/self-hosted/operate/observability/troubleshooting) names the four common causes.

## Step 1 — Run get-admin-key.sh

From the repo root:

```bash
./scripts/get-admin-key.sh
```

The script prints a one-time key to stdout. Copy it — the script does not save it anywhere.

## Step 2 — Sign up via SITE_URL

Open `SITE_URL` and click **Sign up**. Fill in your name, email, and a password. The next screen asks for the admin key — paste it and submit. Create an **Organization** name on the screen after that. You land in the dashboard.

## Step 3 — Promote yourself to Owner

On a fresh instance, the first account is the **Owner** automatically; no manual promotion is needed. Confirm under **Settings > People** that your row carries the Owner badge.

If you joined an existing instance using the admin key (which is unusual but supported), your role will read **Admin** instead, and the existing Owner can promote you under the same screen.

## Step 4 — Disable open signup

By default, the sign-up page is reachable at `SITE_URL/signup` without a bootstrap key once an Owner exists. To close it:

- Open **Settings > Organization** and turn **Open signup** off.
- Or set `ALLOW_OPEN_SIGNUP=false` in `.env` and restart the platform container.

With open signup off, new accounts only join via member invites under **Settings > People** — see [Members and roles](/platform/admin/members-and-roles).

## Troubleshooting

- **`get-admin-key.sh` errors with "container not running".** The platform container is not yet up. `docker compose ps` will say which service is failing; logs via `docker compose logs platform` show why.
- **Pasted key is rejected.** Keys rotate per platform-container boot. Run the script again to get a fresh one.
- **You signed up but the dashboard reads "no organization".** The org-creation screen was skipped — sign out and back in to land on the org-creation flow again.

## Where this gets used

You now have an Owner and an org. The next steps that belong on the calendar are inviting the rest of the admins (under **Settings > People**), adding a model provider, and publishing the first agent — the [Cloud onboarding](/cloud/onboarding) walk is identical from this point on except the URL.
