First run and admin sign-in

Sign in to the panel for the first time and check the things that break silently.

Last updated Aug 14, 2026View as Markdown

Overview

The admin panel is a React single-page app embedded in the nasnet-panel binary and served at your APP_BASE_URL, so when the process is running, the panel is already there and there is nothing extra to deploy. This page covers the first sign-in and the handful of settings worth confirming before you start handing out access.

Before you start

  • The panel process is running and /health/ready returns a success response.
  • You know your ADMIN_USERNAME and the plain password whose bcrypt hash you put in ADMIN_PASSWORD_HASH.

Steps

  1. Open your APP_BASE_URL in a browser, for example http://your-ip:9761. If you set APP_PANEL_BASE_PATH, the panel lives under that prefix instead of the web root.
  2. Sign in with ADMIN_USERNAME and your password. Sessions are JWT cookies.
  3. Land on Dashboard and confirm the stats row is populating.
  4. Open Server and check the status badge next to the server name reads Online, then look at the Overview tab for live host stats. If the badge is red, the panel is up but the Xray process is not healthy.
  5. Open Settings → Server and confirm that URLs & Endpoints, meaning app_base_url and sub_panel_url, match how your users will actually reach the server. These are what subscription links are built from, so a wrong value here produces links that nobody can use.
  6. If you are on a domain, turn on HTTPS now rather than later, as covered in TLS and domains.
  7. Add your first inbound from Server → Network, then create a subscription from Subscriptions.

Reference

Setting Where Why it matters on day one
ADMIN_USERNAME .env The sign-in name.
ADMIN_PASSWORD_HASH .env bcrypt hash of the sign-in password.
JWT_SECRET_KEY .env Signs session cookies. Must be at least 32 characters.
APP_BASE_URL .env, also Settings → Server Base URL used for subscription links.
SUB_PANEL_URL .env, also Settings → Server Where a browser opening a subscription link is sent.
APP_PANEL_BASE_PATH Settings → Server Serves the panel under a prefix instead of /.
JWT_COOKIE_SECURE .env Set true once you are on HTTPS.
JWT_COOKIE_DOMAIN .env Your domain when serving over HTTPS; empty in IP mode.

Some values exist both in .env and in Settings, where they are stored in the database. The panel-editable copy is the one to change once you are running.

Troubleshooting

Sign-in appears to succeed but bounces back to the login page. This is almost always a cookie problem: JWT_COOKIE_SECURE=true while you are browsing over plain HTTP, or a JWT_COOKIE_DOMAIN that does not match the host in the address bar.

Subscription links point at the wrong address. Fix app_base_url in Settings → Server; existing links are generated from it at request time, so the correction takes effect immediately.