First run and sign-in

Setup readiness

Overview lists eight setup steps from the installation's saved state: branding, time zone, sender check, first component, first published incident, opening the public page, checking its subscribe form, and choosing its address. Each step opens its completion screen. The checklist collapses when all eight are done. A first incident means a real customer update; do not publish a fictitious outage just to complete setup.

In Settings, save the From email and select Check mail sender. Local mode captures a check message in the development outbox and labels that result as local readiness. Production reads the configured provider's domain authentication status; its key needs domain-read permission in addition to send permission. This proves the provider reports that domain verified, not inbox delivery. Changing the sender or provider credential requires another check. The public checks request the configured page address; the subscribe check inspects its returned form. It does not subscribe anyone or prove delivery.

Under Your public address, read the custom domain guide or keep the current address, then select Use this public address. A workers.dev address is valid. This records the address choice, not a DNS validation. Public page visits never write to the database; the protected Open public page action records its successful server check before opening the page.

Sign in from your terminal

If you cannot receive a sign-in email, use the installation checkout:

pnpm signin-link --email you@example.com

For a running local server on another port, add --port 4180 (or --origin http://127.0.0.1:4180). PORT and LAMP_WORKERS_STATE_PATH use the same local settings as development; --persist-to selects an explicit local state folder.

For your deployed installation, with your own Wrangler/Cloudflare credentials and the installation's SESSION_SECRET (the value deploy uploaded) set in the command's environment:

pnpm signin-link --remote --email you@example.com

Without SESSION_SECRET in the environment, the remote command refuses and says so; it never reads the secret from the deployed Worker.

The remote command reads the operator hostname from setup's wrangler.toml. Use --config path/to/wrangler.toml for another installation or --origin https://operator.example.com to specify its operator origin explicitly. Only an existing active operator can receive a link. Unknown, deactivated and erased operators are refused; the command never creates an operator or a session. It prints one link, once, on stdout in your invoking terminal. Open that link within 20 minutes. It follows the normal one-use sign-in flow and writes an audit entry saying “sign-in link created from the command line”. The command stores only a token hash and never writes the link to a file, log, or receipt.