---
title: "First boot"
summary: "Configuration validation, the one-time setup URL, and the ingest token you are shown once."
description: "What Fanout checks before it opens a listener, and how to claim the first administrator account."
status: preview
read_when:
  - "The process refuses to start and you want to know what it validated."
  - "You have a running instance and need to create the first administrator."
---
Fanout validates configuration before opening data files or listeners. Invalid
settings stop startup with an error naming the setting. See
[configuration](/docs/reference/configuration) for precedence, secret files and validation.

Local sign-in requires `FANOUT_AUTH_CODE_SECRET` with at least 32 characters.
SMTP and an AI provider are optional; each validates its required settings when
enabled. OIDC requires an HTTPS issuer and public URL, a client ID and a client
secret. The generated [settings reference](/docs/reference/configuration/auth) lists the
available authentication settings.

## Claiming the first administrator

When the control database holds no users, Fanout prints a one-time setup URL to
standard error:

```text
============================================================
 FANOUT SETUP

 Open:  http://127.0.0.1:7520/login?setup_token=…
 Valid: one-time use, expires in 1 hour
 Note:  this URL disappears after the first admin is created
 Warn:  it contains an administrator credential — this output may
        persist in container logs, log aggregators, and scrollback
============================================================
```

Under Docker, read it back with:

```sh
docker logs fanout 2>&1 | grep -A8 "FANOUT SETUP"
```

Open the URL, create the administrator, and **save the ingest token shown after
setup**. The raw token is displayed once; Fanout stores only its hash and cannot
show it again.

The setup form sends `email`, `display_name`, and `setup_token` to
`POST /api/auth/setup`. The first administrator starts with status `active`.

The setup URL is an administrator credential. Restrict access to process logs
until it is consumed or expires. Treat a leaked setup URL as a compromised
installation and rebuild with a fresh data directory before repeating setup.

## Signing in afterwards

Local mode has no passwords. Once SMTP is configured, active users receive
short-lived codes by email. Without SMTP, run `fanout login-link <email>` with
the server's environment and data directory to mint a 15-minute, single-use
link for an existing active user. OIDC deployments use the provider's flow instead.

## Next

[Send your first telemetry](/docs/get-started/send-telemetry), then investigate it with
[Fanout's agent or an MCP client](/docs/get-started/send-telemetry#investigate-the-data).