# Install the Total.js CMS and sign in the first time

> Run the CMS with Node.js or Docker on port 8000, sign in with the login and password it generates at the first start, learn the three ways to authenticate the admin and where the data of the site lives.

Framework: cms
Product: CMS (cms@8071e48)
Language: en
Content-SHA256: e49f68bd6abcc6dc32125a400e6d1dc037447613f204e0c2f7bca2f0b5049d9f
Snapshot: c0700e321579725c5cf4f5ace1ad7d2866d1b4f93c24a63c0b41b6b7998e976c
Sources: 
Review: not-recorded

## Run it

The CMS needs Node.js and nothing else: no database, no external service.

```bash
git clone https://github.com/totaljs/cms.git
cd cms
npm install
npm run start
```

`npm run start` runs `node index.js 8000`; the port is optional and the default is `8000`. With Docker:

```bash
docker pull totalplatform/cms
docker run -p 8000:8000 totalplatform/cms
```

## The first sign-in

At the first start the CMS creates its only administrator with a **random login and password**. Open `http://localhost:8000/admin/`: until the first successful sign-in the page shows them in a box with a button that fills in the form. After that the plain copy of the password is deleted from the preferences and the box no longer appears, so use the profile of the admin right away to set a login and password of your own, and do the first sign-in as soon as you start a new installation.

Until you create the first page, the address `/` redirects to `/admin/` while the password is still the generated one; once a page with the address `/` exists, `/` serves your site.

## Three ways to authenticate the admin

The admin lives under the address of the line `$api : /admin/` of the file `config`. The function `AUTH` of `definitions/auth.js` decides for the requests of that path:

| Mode | When | How |
|---|---|---|
| Session | the default | a cookie encrypted with the `salt` of the account; the login and password are checked with SHA-256 and that salt |
| Token | the line `token : <value>` exists in `config` | send it in the header `x-token`: the request runs as a built-in user called *Bot*, an administrator (`sa`). Ten wrong attempts block the address, and a wrong token gets no answer at all (the request ends with a timeout) |
| OpenPlatform | the settings hold `op_reqtoken` and `op_restoken` | people sign in with [OpenPlatform](/en/openplatform/how-an-app-connects/) and its groups decide the permissions `pages`, `layouts`, `widgets`, `navigation`, `posts`, `files`, `redirects`, `variables`, `settings` and `admin` |

The public pages use the function `FUNC.auth` if your code defines it (see [pages, layouts and navigation](/en/cms/pages-layouts-and-navigation/)); without it every visitor is anonymous.

## Where the data lives

| Place | What it holds |
|---|---|
| `databases/config.json` | generated values of the installation |
| `databases/memorize_account.json` | the administrator: name, login, password hash, cookie name and salt |
| `databases/fs-db/` | the file storage: the metadata of the site (pages, layouts, widgets, navigation, redirects, variables, configuration) and the HTML of every page and layout, the uploaded files and the posts |

To move the site, copy the `databases/` folder, or use the backup of the admin ([the admin API](/en/cms/the-admin-api/)).