Chapter 2 · about 2 minutes
Your admin login
Comet has no email address, so it can never send you a reset link. Two short codes take the place of one. This chapter is about writing them down properly, and it is the two minutes that saves you a very bad afternoon later.
Read this before you do anything else today
Between the moment you upload Comet and the moment you claim it, anyone who knows the address can claim it instead of you — the first person to press the button becomes the owner. That window should be a few minutes, not a few days.
So: finish this chapter today, in the same sitting as chapter 1, and do not post the address anywhere until you have. An unclaimed Comet install shows a full-width red banner on every screen precisely so you cannot forget.
How Comet knows you are you
Most websites ask for an email and a password, and email you a link when you forget it. Comet cannot do that: it has no email account, no mail server, and no company behind it holding your details. That is deliberate — it is what lets Comet run on any host with no signup and no monthly fee — but it changes how you get back in.
Instead, three things stand in for a password:
This browser
When you claim the site, Comet stores a key inside the browser you claimed it with. That browser is signed in from then on. No typing, nothing to forget.
And nothing to lose to a guessed password — but see the warning below about clearing your browsing data.
The recovery code
A code that looks like
COMET-4K7QM-9XB2R-TF08D-WZ3HN
It is how you get back in from a new browser, a new computer, or after clearing your browsing data. Comet shows it once. Print it.
The setup key
A separate code that proves to this install that a request came from its owner. The setup wizard needs it for anything that changes the install.
Also shown once, also worth saving, for a different job.
The trap: “clear browsing data”
Because your day-to-day login lives inside the browser, these three things all sign you out: clearing cookies and site data, using a different browser, and using a different computer or phone. Private/incognito windows are never signed in.
None of that is a disaster — that is exactly what the recovery code is for. It is only a disaster if you never wrote the code down.
Doing it
Claim the install
On the setup screen, press the button that claims this install — it is the one the red banner points at. Comet generates the setup key at that moment and shows it to you.
7f3a91c2e5…The message you get says, word for word:
This install is now claimed by you. STORE THIS KEY — it is shown exactly once and is never returned again, by any call. Every request that changes anything must send it as “key”. If you lose it, delete
api/data/setup.keyon the server (that one file only) and call begin_setup again.
In plain words: copy that key somewhere safe now, because Comet genuinely cannot show it to you a second time. If you do lose it, you are not locked out forever — you delete one small file on your host and claim again, and your database and your pages are untouched. That recovery is written out in Something went wrong.
Put the setup key somewhere you will find it in a year
Good places, in order of preference:
- A password manager — 1Password, Bitwarden, Apple Passwords, your browser's own. Save it under the address of your site so future-you can search for it.
- A note in whatever you actually use for notes, titled with your domain name.
- Printed on paper, in the drawer where you keep the important paperwork.
Bad places: a browser tab you mean to keep open; a text file called new.txt
on the desktop; only in your head.
Expect the recovery code in chapter 3
The recovery code is issued a few minutes from now, at the moment your database is connected and you take ownership of the site itself. It is a separate step because it is a separate thing: the setup key belongs to this folder on your host, and the recovery code belongs to you as the site's owner.
Have somewhere ready to write it — the same password manager entry is ideal. When it appears, do not press Continue until it is saved.
Check before you move on
The red “not claimed yet” banner is gone from the top of the screen, and your setup key is saved somewhere outside the browser tab you are reading it in.
If the banner is still there, or the claim was refused with the words This install was already claimed, see Something went wrong.
How the recovery code works, so you trust it
Two properties are worth knowing, because they change how carefully you have to treat the piece of paper.
- It is single use. The moment you use it to get back in, Comet issues you a fresh one and the old one stops working. Someone who glimpsed your screen last month cannot use it after you already have.
- Using it moves ownership to the browser you used it in. That is the point — you are getting back in from your new laptop — but it also means the old browser is now signed out. That is correct behaviour, not a bug.
Comet never stores the code itself, only a scrambled fingerprint of it, so nobody reading the database can work out what to type.
If you lose everything: the three ways back in
Keep this table. It is the whole recovery story, worst case included.
| If you have lost… | You get back in by… | How hard |
|---|---|---|
| Your browser data, or you are on a new computer | Typing your recovery code into Comet's recovery screen. A new code is issued straight away — save that one too. | Easy |
| The recovery code as well | Reading a console key out of your database from your SpacetimeDB dashboard, and pasting it into Comet's recovery screen. Only the account that owns the database can read it — which is one of the reasons chapter 3 recommends the door that gives you an account. | Fiddly, but self-service |
| Everything, including access to the database owner account | Reinstalling Comet's module over the top of the database, which resets ownership. Your pages survive; you will need help from someone comfortable with the SpacetimeDB dashboard. | Last resort |
Adding other people later
You do not have to hand out your own login to let a colleague write pages. Comet has editors and admins as separate roles, added from the settings screen once the site is up. Give people their own access; never share the recovery code.