Skip to content
DarkAuth Docs

Install API

Install APIs exist only for first-run bootstrap. They are served on the admin port before DarkAuth is initialized.

Endpoints

Section titled “Endpoints”
  • GET /install
  • POST /install
  • POST /install/opaque/start
  • POST /install/opaque/finish

The exact request shapes are intended for the installer UI and CLI installer rather than general application use.

Bootstrap responsibilities

Section titled “Bootstrap responsibilities”

The install flow configures database mode, writes instance config, derives KEK settings, applies schema, creates the first admin account through OPAQUE, generates signing keys, and seeds initial settings and clients.

Security expectations

Section titled “Security expectations”

The install token is one-time bootstrap state. Every install POST must present the current matching token while the token is still fresh. OPAQUE registration start does not refresh an expired install token, and OPAQUE registration finish does not consume the token by itself. Final installation still rejects an invalid or expired token even if admin OPAQUE registration state exists.

Do not expose the installer to the public internet. After initialization, install endpoints should not continue accepting requests.