> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seekr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create the first SeekrFlow administrator

> Create the administrator and organization for a new SeekrFlow deployment, before anyone signs in.

A new deployment has no accounts. Create the first administrator, who owns your organization.

<Warning>
  Don't sign in to SeekrFlow until you finish this page. The first account to exist closes the step that creates an administrator. If someone signs in first, `sfe org setup` can recover with `--recover-admin`, but it's simpler to avoid.
</Warning>

<Tabs>
  <Tab title="With the sfe CLI">
    `sfe` creates the administrator, the organization, and a break-glass administrator: a password account for signing in when single sign-on is unavailable. It names the organization from `Auth.organization.name` in your values file.

    <Steps>
      <Step title="Preview the setup">
        Replace `<admin-email>` with the administrator's address, and `<break-glass-email>` with a different address in your organization's domain. Without single sign-on, include `--skip-realm`:

        ```bash theme={null}
        sfe org setup --admin <admin-email> --break-glass <break-glass-email> --skip-realm -p <profile-name> -r <version> --dry-run
        ```

        The command reports what it would create, and changes nothing. If you leave out `--break-glass`, it uses `breakglass@seekr.com`.
      </Step>

      <Step title="Create the administrator">
        Run the same command with `--yes` instead of `--dry-run`:

        ```bash theme={null}
        sfe org setup --admin <admin-email> --break-glass <break-glass-email> --skip-realm -p <profile-name> -r <version> --yes
        ```

        `sfe` asks for the administrator's password, which must be at least 8 characters. It runs the setup as a job inside the cluster. You don't need the Domain Name System (DNS) record yet.
      </Step>

      <Step title="Store the two credentials">
        `sfe` prints two values once:

        * **Admin token** – Lets `sfe` act as the administrator. It expires after 7 days. Before then, replace it with `sfe org token rotate`.
        * **Break-glass password** – The password for the break-glass administrator. Never sign in to the UI through single sign-on with the break-glass address, which ends its password.

        Store both in your password manager or secret store before you continue. You can't display them again.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Without the sfe CLI">
    Create the administrator with the Auth service's bootstrap endpoint. It's reachable only from inside the cluster, and it closes after the first account exists. Replace `<admin-email>` and `<password>` with the administrator's address and password:

    ```bash theme={null}
    kubectl run bootstrap --rm -it --restart=Never --namespace seekrflow \
      --image=curlimages/curl -- \
      curl http://seekrflow-auth.seekrflow.svc.cluster.local:8003/v1/internal/auth/bootstrap \
      -H 'Content-Type: application/json' \
      -d '{"email": "<admin-email>", "password": "<password>"}'
    ```

    A `200` response means the endpoint created the administrator. A `409` response means an account already exists. The endpoint creates the administrator only. It doesn't create a break-glass administrator or set the organization's name.
  </Tab>
</Tabs>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.