First Login & Setup

Create the admin account

The installer prints a one-time setup link. It works only until the first admin exists, so nobody else can claim your fresh panel.

Lost the link? Generate a new one on the server (only possible while no admin exists):

xaxa setup-token

Then open https://YOUR_SERVER_IP:8443/setup/<token>.

Enable two-factor authentication

Go to Account & 2FA → Set up 2FA, scan the QR code with an authenticator app and confirm with a code and your current password. We strongly recommend this: the panel can control your entire server. Changing the password also invalidates a sign-in waiting for its second factor. Turning 2FA off asks for your password and a code from the app (or a recovery code).

Use a domain for the panel

1. Point an A record such as panel.example.com to the server.
2. Open Admin → Instance → Panel domain, enter the name and save. Behind Cloudflare's proxy, tick Skip DNS check.

XAXA issues a Let's Encrypt certificate and renews it automatically, so https://panel.example.com opens without a certificate warning. Port 8443 stays open so you can always get in directly.

Forgot your password?

xaxa user:reset-password you@example.com
xaxa user:disable-2fa you@example.com