# First run and admin sign-in

> Sign in to the panel for the first time and check the things that break silently.

Source: https://joinnasnet.com/en/guides/nasnet-linux/first-run/
Last updated: 2026-08-14

---

## Overview

The admin panel is a React single-page app embedded in the `nasnet-panel`
binary and served at your `APP_BASE_URL`, so when the process is running, the
panel is already there and there is nothing extra to deploy. This page covers
the first sign-in and the handful of settings worth confirming before you start
handing out access.

## Before you start

- The panel process is running and `/health/ready` returns a success response.
- You know your `ADMIN_USERNAME` and the plain password whose bcrypt hash you
  put in `ADMIN_PASSWORD_HASH`.

## Steps

1. Open your `APP_BASE_URL` in a browser, for example `http://your-ip:9761`.
   If you set `APP_PANEL_BASE_PATH`, the panel lives under that prefix instead
   of the web root.
2. Sign in with `ADMIN_USERNAME` and your password. Sessions are JWT cookies.
3. Land on **Dashboard** and confirm the stats row is populating.
4. Open **Server** and check the status badge next to the server name reads
   **Online**, then look at the **Overview** tab for live host stats. If the
   badge is red, the panel is up but the Xray process is not healthy.
5. Open **Settings → Server** and confirm that **URLs & Endpoints**, meaning
   `app_base_url` and `sub_panel_url`, match how your users will actually reach
   the server.
   These are what subscription links are built from, so a wrong value here
   produces links that nobody can use.
6. If you are on a domain, turn on HTTPS now rather than later, as covered in
   [TLS and domains](/en/guides/nasnet-linux/tls-and-domains/).
7. Add your first inbound from **Server → Network**, then create a subscription
   from **Subscriptions**.

## Reference

| Setting | Where | Why it matters on day one |
| ------- | ----- | ------------------------- |
| `ADMIN_USERNAME` | `.env` | The sign-in name. |
| `ADMIN_PASSWORD_HASH` | `.env` | bcrypt hash of the sign-in password. |
| `JWT_SECRET_KEY` | `.env` | Signs session cookies. Must be at least 32 characters. |
| `APP_BASE_URL` | `.env`, also Settings → Server | Base URL used for subscription links. |
| `SUB_PANEL_URL` | `.env`, also Settings → Server | Where a browser opening a subscription link is sent. |
| `APP_PANEL_BASE_PATH` | Settings → Server | Serves the panel under a prefix instead of `/`. |
| `JWT_COOKIE_SECURE` | `.env` | Set `true` once you are on HTTPS. |
| `JWT_COOKIE_DOMAIN` | `.env` | Your domain when serving over HTTPS; empty in IP mode. |

Some values exist both in `.env` and in **Settings**, where they are stored in
the database. The panel-editable copy is the one to change once you are running.

## Troubleshooting

**Sign-in appears to succeed but bounces back to the login page.** This is
almost always a cookie problem: `JWT_COOKIE_SECURE=true` while you are browsing
over plain HTTP, or a `JWT_COOKIE_DOMAIN` that does not match the host in the
address bar.

**Subscription links point at the wrong address.** Fix `app_base_url` in
**Settings → Server**; existing links are generated from it at request time, so
the correction takes effect immediately.

## Related

- [Installation](/en/guides/nasnet-linux/install/)
- [TLS and domains](/en/guides/nasnet-linux/tls-and-domains/)
- [Dashboard](/en/guides/nasnet-linux/dashboard/)
- [Settings](/en/guides/nasnet-linux/settings/)