Kinetica docs
 v1.0.0
Get help
● Set up · Day one

First steps
owner, secret key, first account.

What to do right after the server starts: create the console owner with the one-time setup code, secure the secret key, create your first studio account, and decide whether strangers may sign up.

Console at /adminStudio at /app

01Create the console owner

The console at https://your-domain/admin is where you, the operator, run the studio. Your customers never see it. On the first start the server log shows a one-time setup code:

[admin] No owner account yet. Open /admin and create it with this one-time setup code:

    XXXX-XXXX-XXXX-XXXX

[admin] The code is shown once, here only. Each start before the owner exists adds a new code; any printed code works until the owner is created.
  1. Find the code docker logs kinetica (Docker) or journalctl -u kinetica (systemd).
  2. Open /admin The "Create the owner" screen asks for the code, your e-mail and a password (twice).
  3. Sign in You land on the console's Overview. Turn on two-factor sign-in under Security & alerts.
The console's Create the owner screen asking for the one-time setup code, e-mail and password

Lost the owner password later? On the server, in the Kinetica folder:

node --env-file=.env dist/src/server/recover-owner.js you@agency.com
# Docker:
docker exec kinetica node dist/src/server/recover-owner.js you@agency.com

Add --reset-2fa to also remove two-factor sign-in.

02Secure the secret key

ADMIN_SECRET_KEY (64 hex characters) encrypts every API key you save in the console. If you did not set it in .env, the server generated one into DATA_DIR/.admin-secret-key and warned in the log (src/server/config.ts):

[studio] ADMIN_SECRET_KEY is not set: using a generated key in /app/data/.admin-secret-key.
[studio] Copy it into .env as ADMIN_SECRET_KEY and back it up: without it the saved API keys cannot be read.
  1. Read the generated key Plain Node: cat data/.admin-secret-key. Docker: docker exec kinetica cat /app/data/.admin-secret-key.
  2. Copy it into .env as ADMIN_SECRET_KEY=…, and restart (sudo systemctl restart kinetica, or recreate the container with --env-file .env).
  3. Back it up in your password manager, separately from the server.
Do not lose it

A backup restored with a different key starts fine, but every saved API key has to be entered again (docs/guide/keys.md). Never paste this key into a support request.

03Go through the setup list

The console's Get started page and Overview list what is still missing. In order:

  1. Brand: product name, accent colour, support e-mail (White label).
  2. Server: the public URL (https://…). Already set, and shown locked, when PUBLIC_URL is in .env.
  3. Integrations: the keys (Keys).
  4. AI director, Voice, Studio, Rendering: the defaults work; change them later.
  5. E-mail: the sender address for invites and notices (needs the Resend key).
  6. Plans and Credit packs (Plans and credits).
The console's Get started page with product name, accent colour, support e-mail and AI model fields

Then open System health: it shows the Chrome and ffmpeg versions, free disk in DATA_DIR, the database size, the render queue, the speed of the last render, every missing key with what it switches on, and the last backup.

04Create your first studio account

The studio (/app) has its own accounts, separate from the console. Two ways to get the first one:

From the console: Users, "Invite staff (e-mail)". You get a link to set a password, e-mailed when e-mail is set up and always shown on the page. Staff can open every workspace.

From the server, with create-user.js:

node --env-file=.env dist/src/server/create-user.js you@agency.com "Your name" --staff --credits 500
# Docker:
docker exec kinetica node dist/src/server/create-user.js you@agency.com "Your name" --staff --credits 500

It creates the account and its own workspace, adds the starting credits, and prints a one-time password:

Created you@agency.com in workspace "Your name's workspace" with 500 credits.
One-time password (shown once): …
Sign in at /app and keep it somewhere safe.
OptionEffect
--staffA staff account: owner of every workspace. Leave it out for a normal customer account.
--credits NStarting credits for the new workspace, shown in its history as "Operator: starting credits".

Then open /app, sign in, change the password under your account, and make a video (The studio app).

05Sign-up open or closed

Console, Settings, Access:

ModeSettingWhat happens
Agency mode (default)"Anyone can sign up" OffOnly people you invite get an account. You create a workspace per client on the console's Workspaces page and invite people from the studio's Team page. A sign-up attempt answers "Sign-up is by invitation."
Self-serve"Anyone can sign up" OnAnyone can create an account. They get their own workspace on the first active free plan, plus "Credits a new self-serve workspace gets" (0 by default).

The same section has the "Announcement banner": a line of text shown at the top of every studio page, for example for planned downtime. It also shows the console's standard "Maintenance mode", "Maintenance message" and "Blocked countries" fields; in version 1.0.0 the studio does not act on those three, so use the announcement banner to tell people about maintenance.

Before you go live, make a backup and set up the nightly one (Backups).