First administrator and signing in

The first administrator

Only keys registered with the bunker can use the dashboard. Only an administrator can register keys. So the first administrator comes from the environment, through BANCWR_ADMIN_PUBKEY.

Set BANCWR_ADMIN_PUBKEY in .env to your own npub (or hex public key), then start or restart the bunker.

At startup:

• If no administrator is registered, the bunker registers that key as an administrator. If the key is already a member, it promotes it to administrator. The bunker log says which.
• Once any administrator exists, the setting does nothing. It never re-adds a key you removed, and it never demotes anyone.

You can leave BANCWR_ADMIN_PUBKEY set, but it is tidier to remove it once you have signed in.

The bunker refuses to start if BANCWR_ADMIN_PUBKEY is not a valid key, or if it is the bunker's own key.

Why the bunker's key can never sign in

The bunker's own key (BUNKER_NSEC) can never sign in to the dashboard. It can never be registered as a member either, with any role.

The bunker signs for other people over NIP-46. If its key could sign in, anyone the bunker signs for could get it to sign a Bancwr sign-in and act as that key. Signing in with it would also mean putting the server's signing key into a browser extension.

If you try to sign in with the bunker's key, Bancwr refuses and tells you to sign in with your own key.

If no administrator is set

If you start Bancwr without BANCWR_ADMIN_PUBKEY, and no administrator is registered:

• The bunker logs a warning at every start.
• The health indicator shows the Administrator check as Needs attention.
• Anyone who signs in sees a page saying the bunker has no administrator yet, with their npub.

To make that key the first administrator:

1. Copy the npub shown on the page.
2. Set BANCWR_ADMIN_PUBKEY to it in .env.
3. Restart the bunker.
4. Sign in again.

Signing in

Open Bancwr at the address set in NUXT_SITE_ORIGIN. The Sign in page offers two ways in.

With a browser extension (NIP-07)

1. Click Sign in with extension.
2. Your extension tells Bancwr which key it holds.
3. Confirm the key (see below).
4. Approve the sign-in request in your extension.

If no extension is found, the page says so and suggests a remote signer instead.

With a remote signer (NIP-46)

1. Paste your signer's bunker:// string into Connection string.
2. Click Connect and sign in.
3. Approve the connection in your signer. If your signer asks, use the Approve in your signer link.
4. Confirm the key (see below).

Click Cancel to stop waiting for the signer.

Confirming the key

Before anything is signed, Bancwr shows the key your signer chose, under Sign in as. It shows the key's name and picture from its public profile when it can find them, and the npub.

• Click Continue as … to sign in with that key.
• Click Use another key if it is not the key you meant. Nothing has been signed.

If the signer then signs with a different key than the one you confirmed, the sign-in is refused.

Switching keys in your extension

Your extension decides which key signs in. Some extensions, such as Porwr, keep using the key a site first connected with, whichever key is selected.

To sign in with another key:

1. Open your extension's connected sites.
2. Disconnect Bancwr's address.
3. Choose the key you want.
4. Sign in again.

With a remote signer, paste the connection string of the signer that holds the key you want.

Keys that are not registered

If you sign in with a key that is not registered, you see This key is not registered with this bunker.

The page shows your npub, with a button to copy it. Send it to an administrator and ask them to add you on the Team page.

Click Sign out and try another key to go back to the sign-in page.

Signing out

Use the sign-out button in the sidebar footer, next to your name and role.

Signing out ends your session everywhere it was used. Restarting the dashboard container signs everyone out.

Common issues

The address does not match

Sign-in is refused if the page's address does not match NUXT_SITE_ORIGIN. Open Bancwr at exactly that address.

The sign-in request expired

Try again. Approve the request in your signer promptly.

Your role no longer allows this page

Bancwr checks your role on every page. If an administrator changes your access while you have a page open, you see a notice with a link back to the dashboard.