Creating the First Administrator

A fresh deployment has no accounts, and administrators can only be created by an existing administrator — so the first one has to come from a terminal.

signUp is a public mutation. If it accepted the administrator role, anyone could grant themselves one from a browser console, which is why it refuses.

Creating it

Run the bootstrap mutation


npx convex run functions/bootstrap:createFirstAdmin \
  '{"name":"Your Name","email":"you@example.org","password":"a-long-password"}'

Add --prod for the production deployment.

Go to /signin/admin with that email and password.

Change the password

From your profile, once you are in.

This is an internalMutation, so it cannot be called from a browser. Running it requires deploy credentials for the deployment.

It only works once

The mutation refuses as soon as any administrator exists:


An administrator already exists.
Create further administrators from Admin → Users.

So it cannot be used later to quietly add an account.

Every administrator after the first

Admin → Users → Add User, choosing the Administrator role. That path requires an administrator session and is recorded in the audit log.