Bootstrap admin credentials and access¶

This guide walks you through rotating the default administrator password and generating emergency recovery links for administrative access in Charmed Authentik.

Note

For initial deployment, first-time credential retrieval, and accessing the web interface, see the Getting started with Charmed Authentik tutorial.

Rotate the administrator password¶

After performing your initial login, you should rotate the automatically generated akadmin bootstrap password:

In the Admin Interface dashboard, select your user profile in the top-right corner.
Select User Settings.
Under the Password section, select Change Password.
Enter the current bootstrap password and specify a new secure password.
Select Change Password to commit the update.

Warning

Once you change the password in the Authentik web interface, the password value previously returned by the get-bootstrap-admin-credentials Juju action will be stale.

Generate an emergency recovery link¶

If you lose administrative access or need to bypass standard authentication flows to repair configuration, you can generate a single-use emergency recovery link using the create-recovery-link Juju action.

Run the action on the authentik-server leader unit:

juju run authentik-server/leader create-recovery-link username=akadmin duration=10

Action parameters:

username (optional, string, default: akadmin): The username of the account to recover.
duration (optional, integer, default: 10): The validity period of the recovery link in minutes.

The action outputs a structured result containing:

url: The full recovery URL.
path: The relative URL path for the recovery flow.
status: Confirmation status of the link generation.

Paste the generated URL into your browser to log in directly and reset the account credentials.

Security considerations¶

Superuser API Token Exposure: The get-bootstrap-admin-credentials action returns the bootstrap-token in plaintext. This token provides full administrative access via the Authentik REST API.
Recovery Link Scope: The create-recovery-link action returns a URL that bypasses all standard authentication stages (including MFA).
Action Output Visibility: Juju action results are visible in the Juju controller audit history to anyone with read access to the model.

Next steps¶

Learn how to Protect OIDC and OAuth applications to integrate downstream web services.
Learn how to Protect LDAP applications to configure directory access.
See Common operational tasks for scaling and performance tuning.