- Open the console (
http://127.0.0.1:8080/in compose, or your api origin). - If no tokens exist you see Create the first admin.
- Leave the token name as
adminor type another name. Submit. - The next screen is Copy this token. The secret looks like
lattice_live_plus 64 hex characters. It is shown once. - Click Enter console.
Lattice keeps the token in this browser tab (sessionStorage), not localStorage. A new tab does not inherit it. Closing the tab drops it. Paste again from your password manager.
After the first token
The login screen is a paste box. The token must start with lattice_live_. Wrong prefix shows Token should start with lattice_live_.
API:
Authorization: Bearer lattice_live_…
Until the first token exists, POST /tokens works from the host; other IPAM writes are loopback-only so the UI on localhost can load. Overview may show bootstrap_open. After the first token, Bearer is required. The server enforces RBAC. A readonly token that POSTs /leases/{id}/release gets 403.
Create more tokens later on Tokens (/tokens) as admin. See Tokens and roles.