Admin console

IdentSphere serves a built-in admin console at /admin, on the same origin as the API (e.g. https://auth.yourcompany.com/admin). It's embedded in the server binary — nothing extra to deploy. Platform admins use it to manage users, view the audit log, reset MFA, and (from PR2 on) configure integrations.

Creating the first admin

A fresh install has no platform admins. There are two ways to create the first one — both promote an already-registered user.

Option A — bootstrap on boot (convenience)

Set IDENTSPHERE_INITIAL_OWNER_EMAIL to your email and start the server. Once that user registers and verifies their email, the next boot promotes them to account_owner.

It is hijack-safe: promotion only happens while no owner exists yet, only for an existing user, and only if their email is verified — so nobody can seize ownership by registering your email after the fact. It's idempotent; leave it set.

-e IDENTSPHERE_INITIAL_OWNER_EMAIL=you@yourcompany.com

Option B — CLI (explicit, race-free)

docker run --rm --entrypoint /identsphere ghcr.io/identsphere/server:latest \
  admin grant you@yourcompany.com --role account_owner \
  --database-url "$DATABASE_URL"

Roles: account_owner (full), admin (provisioning + user management), viewer (read-only cross-org). The user must have registered first.

Logging in

Open /admin, sign in with the admin account's normal credentials (same /v1/auth/login, MFA included). Non-admins who reach /admin get an "access denied" screen — the platform-admin flag is resolved server-side per request.

Securing the console

The console is a high-value target. IdentSphere ships hardened defaults:

• Strict CSP on every /admin response: script-src 'self', frame-ancestors 'none' (no clickjacking), nosniff, Referrer-Policy, COOP/CORP. Fonts and scripts are same-origin only (fonts are self-hosted — no external requests, so it works air-gapped).
• Login rate-limiting: 5 attempts/min/IP on /v1/auth/login.
• MFA: enroll TOTP on the admin account; step-up is enforced on sensitive configuration changes (from PR2).

Additional controls:

Variable	Effect
IDENTSPHERE_SERVE_ADMIN=false	Don't serve /admin at all (headless / API-only)
IDENTSPHERE_COOKIES_SECURE=true	Required in production (HTTPS)

For the strongest posture, also restrict /admin at your reverse proxy (IP allowlist / VPN) — and remember XFF-based restrictions are only meaningful behind a proxy that strips client-supplied X-Forwarded-For.

Updating the console

The console is built from the admin-dashboard app and committed into the server build (crates/identsphere-axum/admin-dist/), so the binary is self-contained. Maintainers refresh it with scripts/sync-admin-dist.sh after a UI change.