Before you begin
Start neoserver using the console tutorial. Open http://localhost:9000/admin/ for the tutorial deployment. A reverse proxy or configured base path changes this address.
The console accepts super_admin credentials and workspace admin credentials. Viewer and editor credentials are intended for clients and API access, not console sign-in.
Use a token
- Choose Token, if multiple sign-in methods are available.
- Paste the complete bootstrap JWT or administrator API key into API key or JWT.
- Choose Start session.
A newly initialized server prints a one-time bootstrap JWT. The tutorial encryption key abc123 is not a login credential. Bootstrap tokens expire after 24 hours by default; a key ID or prefix is also not a usable secret.
The browser session uses an HttpOnly cookie. The console does not retain your pasted credential in browser storage. Session lifetime and invalidation rules are described in authentication and access.
Password and identity-provider login
Use a username and password
Follow Set up a super admin with a password to configure Basic authentication and an administrator login on the server. The walkthrough includes the TOML settings, restart steps, and HTTPS requirements.
After the server is configured:
- Open the console and choose Password.
- Enter your Username and Password.
- Choose Start session.
All Basic users inherit the same global Auth.DefaultRole. Setting it to super_admin gives every configured Basic user full server administration access; use OIDC role mappings for different permissions per user. If the Password option is missing, check the effective configuration and restart the server as described in the setup guide.
Use an identity provider
OIDC sign-in appears when browser login, issuer, and client settings are configured. OIDC uses Authorization Code with PKCE; the browser does not need an identity-provider client secret.
Follow OIDC setup to register the callback, scopes, and claim mappings. An authenticated identity still needs an administrator role mapped to access the console.
Recover access
For the tutorial environment, follow the token recovery commands. Stop the server before creating a replacement token against the catalog; do not delete the database or initialize it again.
After signing in, create a workspace.