---
title: "Bootstrap Claim"
method: POST
path: "/auth/bootstrap/claim"
tags: ["Authentication"]
---

# Bootstrap Claim

`POST /auth/bootstrap/claim`

Claim the platform's bootstrap token to create the first operator.

On first boot the init container generates a random token, prints it to
stdout, and stores its sha256 in the platform authority manifest. The
operator presents the cleartext token here exactly once; in exchange they
get a person record, a `can_admin` grant on the authority artifact, and
an access token. After this call, `platform.setup_complete=true` blocks
any further claim attempts.

Single-use. Consumes the bootstrap regardless of email/password — if
those fields are absent, the operator is created passwordless and can
later link an OAuth provider, set a password, or register a passkey.

## Request body

- BootstrapClaimRequest — Body for `POST /auth/bootstrap/claim`. The token comes from init's stdout.
  - `token` string, required
  - `email` string, nullable
  - `name` string, nullable
  - `password` string, nullable

## Response `200`

Successful Response

- BootstrapClaimResponse
  - `access_token` string, required
  - `refresh_token` string, required
  - `token_type` string
  - `person_id` string, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/agience/apis/agience-platform-api.md) · [All operations](https://skmtc.net/agience/apis/agience-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/agience/agience-platform-api/revisions/187bad270c94/schema)