---
sidebar_position: 5
slide: /diagrams/abi-auth.svg
slide_alt: Three doors into ABI. Nexus UI: open Nexus, choose how, sign in, land in Chat if you are a known user, then roles set what you see. API: call agents or workflows, send ABI_API_KEY, get the result. CLI: abi chat talks to the engine, or org and user commands use Nexus email and password or a token. There is no abi login command.
question: How do I sign in to Nexus for the first time?
kind: task
via_web: available
via_cli: na
via_python: na
via_api: available
via_config: na
ref_web: Sign in
ref_api: POST /api/auth/login
prereq: The stack is running. The [Quickstart](/capabilities/get-started/quickstart) starts it.
next:
  - /capabilities/get-started/orientation
  - /capabilities/platform/choose-sign-in-method
  - /capabilities/platform/authenticate-engine-api
---

# Sign in to Nexus

Open Nexus after the API and web app are up. A successful sign-in lands on Chat in your default workspace. Engine routes still need `ABI_API_KEY`; see [Authenticate engine API requests](/capabilities/platform/authenticate-engine-api).

## Web UI

### Open Nexus

With Docker (`abi stack start`), Nexus is at `http://localhost:3042`. With `abi dev up`, ports are offset per checkout. `abi dev ports` prints the `nexus-web` port.

### Use the seeded admin

A new project seeds one user, `admin@example.com`. There is no default password in docs. The project writes it to `.env` as `NEXUS_USER_ADMIN_EXAMPLE_COM_PASSWORD`. `abi dev up` prints it on first boot. Published defaults (`admin`, `Admin1234!`, `admin1234`, `password`, `changeme`, and a few more) are refused at login.

If the form says the password is wrong, read `.env` again. On boot, the seeder replaces a published default and writes the new value back. That account is a super admin and owns the seeded organization and workspace. See [Platform settings](/capabilities/platform/platform-settings).

### Complete the form

The page reads `/api/auth/config`. With password sign-in enabled, enter email and password.

![Nexus sign-in: email and password](/abi/Screenshot_Sign_In.png)

*Password sign-in. The password field is on the form, and this shot leaves it empty.*

With password sign-in off, enter your email, then the 6-digit code from the message (or follow the magic link). Configure the mode on [Choose sign-in method](/capabilities/platform/choose-sign-in-method).

The password form includes **Forgot password?**, which posts to `/api/auth/forgot-password` and sends a reset link through the email service.

## CLI

Not applicable. ABI has no `abi login` command. Org and workspace commands accept `--auth-email` and `--auth-password`, or `--token` with `NEXUS_ACCESS_TOKEN`. See [Nexus API options](/user-guide/reference/cli#nexus-api-options).

## Python

Not applicable.

## REST API

### Log in

```bash
curl -X POST http://localhost:9879/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@example.com", "password": "$NEXUS_PASSWORD"}'
```

The response includes `access_token` and `refresh_token`. Send `Authorization: Bearer <access_token>` on Nexus `/api/*` routes. Refresh with `POST /api/auth/refresh`.

Password login requires `auth_password_enabled: true`. Email code login uses the magic-link and verify endpoints instead; see [Nexus: password or magic link](/capabilities/build/applications/nexus#password-login-vs-magic-link).

## Config

Not applicable. Sign-in mode is config on [Choose sign-in method](/capabilities/platform/choose-sign-in-method). Seeded users live under `nexus_config.users`.

## After sign-in

Nexus opens Chat at `/workspace/{id}/chat`. Under `abi dev up` a generated project seeds organization Dev and workspace Default (slug `default`). The Docker stack seeds organization and workspace ABI (slug `abi`). Visiting `/` with no last-visited cookie uses `DEFAULT_WORKSPACE`, then the slug `primary`. See [Workspace routing](/capabilities/build/applications/nexus#workspace-routing) and [Orientation and navigation](/capabilities/get-started/orientation).

Self-registration is off (`auth_signup_enabled: false`). Add people with [Invite an organization member](/capabilities/platform/invite-an-organization-member) or [Invite a workspace member](/capabilities/platform/invite-a-workspace-member), or list them under `users:` in config.