Your administrator account

Sign-in uses the account and random password shown by your deployment command. The administrator API token is a separate credential.

You can keep the generated password if you have stored it securely. Deployment summaries always show the initial credentials, not a password changed later.

Make the server reachable

Check the local services

Check configuration synchronization and the rathole control listener before connecting a device.

These checks inspect the current saved configuration. Your draft settings are applied when you finish. Local readiness does not verify public DNS, provider firewall rules or end-to-end tunnel traffic.

If a check fails, you can still save setup and troubleshoot in Node settings. Existing website and firewall rules are never changed by this guide.

Publish your first local service

1. Create a client in Clients. Give it a device name and copy its one-time enrollment code.
2. Install holepunch-client on the computer running your local application. Run the command below and enter the enrollment code when prompted.

3. Keep the CLI running. In Tunnels, select the client, protocol, local address and port, such as 127.0.0.1:8000.
4. For Web, choose a domain with DNS pointed at this server. For TCP/UDP, use the assigned public port. Open the endpoint and test a real application request.

The desktop app is optional. All tunnel settings live in this console. Do not use the administrator API token as a client token.

Before inviting users, open Default policy to configure registration, client and tunnel counts, bandwidth and the platform domain suffix. Email delivery must be configured before opening registration or sending invitations. Individual limits are managed in User management.