Skip to main content

Administrator onboarding

Create the first administrator​

Initialize the first administrator on the Engine host before making that Engine remotely reachable. The account is an administrator and the owner of the initial organization; once it exists, the first-account setup path cannot be used again.

macOS or Windows host​

  1. Open the installed Clawuno app while signed in to the host computer and wait for its Local Engine to start.
  2. On a new 0.8.1 installation, complete the first-run form in the host app with the administrator's name, real email address and a password of at least eight characters. The account is created during this required setup; there is no separate “set up remote login” step in 0.8.1.
  3. Save the credentials in the organization's password manager.
  4. Verify the same email and password from another trusted browser or Desktop client before inviting users.

If this Engine already has an administrator with an email address and password, sign in with that account instead of trying to create another one. Keep the host user signed in and Clawuno running while the Desktop-hosted Engine serves remote users.

Linux host​

Use only the one-time setup URL generated by the installer. Open it on a trusted device, then enter the administrator's name, real email address and a password of at least eight characters. The setup credential is carried in the URL fragment so it is not written to normal HTTP access logs. Complete setup once, store the administrator credential in the organization's password manager, and do not share or reuse the URL.

Configure the organization​

  1. Sign in to the Engine with the first administrator and open System Settings → Users.
  2. Confirm that the administrator email and password created during first-run setup work from the intended protected access address.
  3. Select Enter activation code, paste the complete code supplied by Clawuno and submit it. Treat the code as a credential: do not put it in tickets, screenshots or Chat.
  4. Confirm the displayed edition, License ID, expiry (when present) and used accounts / account limit. Activation applies to the connected Engine and does not require a restart.
  5. Add administrators before relying on one person's account for recovery.
  6. Add users with the minimum role required.
  7. Define which Workspaces represent departments, projects or controlled data domains.
  8. Decide which local folders may be linked and who owns their host permissions.

An Agent can work in multiple Workspaces. The Agent identity is global, while each Chat and Work still runs with an explicit active Workspace and its file boundary.

Operational ownership​

Record named owners for:

  • host, app or container lifecycle;
  • reverse proxy, DNS and TLS;
  • user lifecycle and Team/Enterprise license;
  • model credentials and usage budgets;
  • backup verification and recovery drills;
  • security incident response.

Uno can guide an administrator through product settings, but it cannot replace host access, recover a stopped Engine or authorize itself to external infrastructure.

Recover an administrator account​

The person performing this procedure must already have operating-system access to the Clawuno host. It creates a single-use reset URL valid for 15 minutes; it does not reveal the old password.

  • macOS: ~/clawuno/bin/clawuno admin reset-token --new --email ADMIN_EMAIL
  • Windows Desktop: quit Clawuno, open PowerShell as the Windows user who installed it, set $engine = "$env:LOCALAPPDATA\ClawunoDesktop\current\engine" and $env:DATA_ROOT = "$env:USERPROFILE\clawuno\data", then run & "$engine\runtime\node.exe" "$engine\bin\admin-cli.js" reset-token --new --email "ADMIN_EMAIL". Run Remove-Item Env:DATA_ROOT afterward.
  • Linux Docker: from the selected instance directory, run sudo docker compose exec -u 10001 engine node /opt/clawuno/bin/admin-cli.js reset-token --new --email ADMIN_EMAIL --port 9700. If users access a reverse-proxy URL or a non-default host port, replace the printed origin while preserving the /sign-in/reset?token=... path and token.

Open the URL on a trusted device, set the new password, and store it in the organization's password manager. Generate a new URL if it expires; do not send the token through public channels.