Set up Blink and sign in for the first time

A new Blink instance has no accounts. The first person to finish the setup page becomes its owner: the account with every permission, in the instance and in your first organization. Setup has four parts:

1. Create the owner account and your first organization.
2. Turn on two-factor authentication and save your recovery codes.
3. Create and save the recovery kit.
4. Prove the saved kit opens.

Before you start, have these ready:

• An authenticator app on your phone or computer (Google Authenticator, 1Password, Authy or similar).
• A password manager, or another safe place for a passphrase.
• Somewhere offline to keep two small files, such as a USB drive kept in a safe.

Get your setup link and token

Setup happens at /setup on your Blink address, for example https://yourname.onblink.cloud/setup. The page asks for a setup token, which proves you are the person allowed to claim this instance.

On Blink Cloud

When your instance is ready, IZT emails your contact address. The email’s subject is Set up your Blink instance followed by your instance name. It contains:

• the setup link, ending in /setup,
• the setup token,
• the date and time (UTC) the token is valid until.

The setup token expires

Use the token before the time in the email. After that it is refused, and setup cannot go on until IZT sends you a new link. If yours has expired, contact IZT and ask for a new setup link.

On your own server

The Blink server prints the setup token as setup_token in its log and console when it starts and has no accounts yet. Copy it from there. This token does not expire, and it stops working as soon as the owner account exists. If the server restarts before setup is done, it prints a new token: use the latest one. See Install for setting up the server itself.

1. Create the owner account

1. Open the setup link (or go to /setup on your Blink address). The page shows Set up Blink.
2. Fill in First name, Last name, Email and Password (at least 8 characters), then type the password again in Confirm password.
3. In Organization, type the name of your company or team. This becomes your first organization, and you are its Owner.
4. In Setup token, paste the token from the email or the server log.
5. Click Create owner account.

If the page says That setup token doesn’t match, copy the token again. On your own server, make sure it is the latest one the server printed. On Blink Cloud, check that the time in the email has not passed.

Note

Once setup is finished, /setup sends you to the sign-in page.

2. Turn on two-factor authentication

Every Blink account signs in with a password and a second factor. The owner sets it up right away.

1. The page shows Set up two-factor and a Setup key.
2. Add the key to your authenticator app. Click Open in authenticator if your device offers it, or click Copy key and paste the key into the app.
3. Type the 6-digit code the app shows into 6-digit code, then click Verify and enable.
4. The page shows Two-factor enabled and 10 recovery codes. Each one signs you in once if you lose your authenticator. They are not shown again.
5. Click Copy codes and store them in your password manager, then click I’ve saved them, continue.

You can add a passkey later, under Account, as a faster second factor.

3. Create the recovery kit

The recovery kit is two files locked with a passphrase you choose:

• Recovery key: replaces this instance’s identity if it is ever lost or stolen.
• Database key backup: a backup of the key that protects every secret Blink stores.

Blink keeps neither file. Without them, a lost instance means reinstalling every Access agent.

1. On Recovery kit, type a passphrase of at least 12 characters in Passphrase and again in Confirm passphrase.
2. Click Create recovery kit. Encrypting the kit takes a moment.
3. On Save the kit, click Download next to Recovery key and next to Database key backup. Each row also shows the file’s checksum.
4. Click I’ve saved both, continue.

Store the passphrase apart from the files

Keep the two files offline, away from your backups, and the passphrase in your password manager. Nobody, IZT included, can recover a lost passphrase. The files are shown only now: if you lose them before you finish, click Start over with another passphrase.

4. Prove the kit opens

Blink asks you to show that each saved file is the right one before it finishes setup.

1. Check the database key backup (step 1 of 2): with Open the saved file selected, click Choose the backup…, pick the database key backup you saved, enter the passphrase and click Continue.
2. Check the recovery file (step 2 of 2): click Choose the recovery file…, pick the recovery key file, enter the passphrase and click Finish setup.

The file and the passphrase are opened in your browser to prove they work. Neither is sent to the server.

If you cannot open a file, you can switch to Type its checksum and type the checksum value from the file instead. That only proves you can read the file, not that the passphrase works, so opening the file is the better check.

When setup finishes, the console opens.

If setup is interrupted

If you close the browser after creating the owner account, go back to /setup. Blink asks you to sign in with the owner account, then picks up at the recovery kit. Until the kit is confirmed, the sign-in page sends you back to /setup, and you cannot activate a license.

Sign in from now on

1. Go to /login on your Blink address. From the join page, click Technician sign in.
2. Enter your Email and Password and click Continue.
3. Confirm with your second factor:
   • With a passkey: click Sign in with passkey and confirm with your fingerprint, face, screen lock or security key.
   • With your authenticator: on Two-factor code, enter the 6-digit code, or one of your recovery codes, in Code and click Sign in.

Sensitive actions, such as activating a license, can ask you again. A Confirm it’s you dialog opens: confirm with your passkey or a fresh code from your authenticator.

Next

• On your own server: activate your license.
• On Blink Cloud: your license is activated for you. Continue with the console tour.