Administrator Registration

FinClaw creates users through identity-service's POST /auth/register; administrator privileges are controlled by ADMIN_EMAILS in .env.

Single-Node Version

# Positional arguments
./scripts/register-admin.sh admin@example.com <password>

# Environment variable form
ADMIN_EMAIL=admin@example.com ADMIN_PASSWORD=xxx ./scripts/register-admin.sh

# Specify the gateway address (defaults to http://localhost:26100 or reads from .env)
./scripts/register-admin.sh --url https://your-domain.com

The script ships with the offline release package under deploy/scripts/. The password must be at least 8 characters long. On success, the script prompts you to add the email to ADMIN_EMAILS and to run fleet.sh down && fleet.sh up -d to restart services.

K8s Version

Option 1: kubectl exec Into the Pod

kubectl -n <ns> exec -it deploy/identity-service -- \
  ./scripts/register-admin.sh admin@example.com <password>

Applicable when the image already packages scripts/register-admin.sh. If the image does not include this script, switch to Option 2.

Option 2: port-forward and Call Locally

kubectl -n <ns> port-forward svc/identity-service 26101:26101

# In another terminal
curl -X POST http://localhost:26101/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@example.com","password":"<password>"}'

port-forward maps identity-service's 26101 port to local, bypassing api-gateway for a direct call. The request body matches the single-node version: {email, password}; a 201 or 200 response means success.

How It Takes Effect

1. Ensure the target email has been added to ADMIN_EMAILS (comma-separated).
2. Single-node mode: after modifying .env, restart the services for it to take effect (./scripts/fleet.sh down && ./scripts/fleet.sh up -d).
3. K8s mode: after modifying the ConfigMap or Helm values, run helm upgrade + kubectl rollout restart deploy/identity-service.
4. Multi-tenant scenario: the administrator scope and tenant isolation relationship — administrators can operate across tenants.

See Routine Operations - Config Hot-Reload Boundary.