First admin account

ExchangePro does not ship a built-in admin password. The first account created at /signup is automatically assigned role = admin while no administrator exists.

Security - first signup becomes admin

While no admin user exists, the next person who completes public registration (/signup) is automatically assigned role = admin and gains full control of the site (settings, users, funds workflow, HTML/CSS in CMS fields).

Anyone who signs up before you on a publicly reachable site becomes administrator. This is intentional for easy bootstrap, but you must treat open registration as a security risk until you have claimed admin.

Create your first admin

Register at /signup before the site is public - the first signup becomes administrator. See Production bootstrap (signup) below.

Production bootstrap (signup)

Recommended order before going live:

1. Finish backend and frontend install.
2. Register yourself at /signup before sharing the site URL publicly.
3. Confirm you land on /admin.
4. Admin → Settings → System → turn User registration off if you do not want public signups.
5. Add other admins only via Users if needed.

Bootstrap flow

1. Complete backend and frontend installation.
2. Open the signup page:

   https://yourdomain.com/signup

3. Register with your real admin email and a strong password.
4. If email verification is disabled in admin settings (default off until configured), you are signed in immediately.
5. You are redirected to /admin because your account has role = admin.

How it works (backend)

On POST /api/auth/signup, the API runs inside a database transaction and checks (with a row lock) whether any admin exists:

$isFirstAdmin = ! User::query()->where('role', 'admin')->lockForUpdate()->exists();
// ...
'role' => $isFirstAdmin ? 'admin' : 'user',

The first account receives role = admin. All later signups receive role = user unless changed in admin. The lock prevents two simultaneous signups from both becoming admin.

Email verification

If System → Email verification is enabled:

1. Signup returns needsVerification: true.
2. User receives a 6-digit code by email.
3. Complete verification on the signup flow before accessing the dashboard.

Configure SMTP first: Mail configuration.

Creating additional admins

1. Sign in as admin → Users (/admin/users).
2. Create a user and set role to admin, or edit an existing user.
3. Optional: credentials email is sent when creating users from admin.

Security recommendations

Practice	Why
Register admin before announcing the site	First public signup wins admin if none exists
Disable public registration after you have admin	Stops strangers from signing up at all
Remove or protect /signup while testing on a public URL	Staging servers on the internet are discoverable
Use strong passwords	Admin = full platform control
Enable email verification	Slows automated abuse (does not replace locking registration)
Use HTTPS	Protects session cookies

If someone else became admin first

1. Sign in with that account if it is yours (typo during testing), or
2. From the database (or a trusted developer), set your user’s role to admin and demote the other account, or
3. On a fresh install only: reset DB and register again before the site is public.

Prevention is easier than recovery - register first, then disable registration.

Disable public registration

Admin → Settings → System configuration

Toggle User registration off when you only want admins to create accounts manually.

Troubleshooting

Issue	Solution
Signed up but sent to /dashboard not /admin	An admin already exists; use admin user management
Cannot sign in after signup	Check email verification / SMTP
403 on admin API	See Troubleshooting → Admin API