● Start

Installation
server, console, app.

Three parts, in this order: start the server, create your console owner, then run the app pointed at your server. On your own computer this takes about half an hour.

npm ci/adminflutter run

01Start the server

Open the server folder. In a terminal, go to the server folder of the download.
Use Node.js 26. Run node --version. If it is lower than 26, install Node.js 26 (with nvm: nvm install 26 then nvm use 26).
Install the packages. Run the command below. At the end it checks the Content Credentials reader it downloaded against fixed fingerprints and prints c2pa: native binary verified for …; a different file stops the install (see Troubleshooting).

npm ci

Two npm notices are normal

npm 11 lists packages that "have install scripts not yet covered by allowScripts" and reports moderate findings in development-only packages. The install still completes; npm audit --omit=dev reports 0 vulnerabilities in what the server runs (checked on 12 November 2026).

Create your settings file. Copy the template. All values are optional for a first start on your computer.

cp .env.example .env

Build and start. The server is TypeScript; npm run build turns it into JavaScript and npm start runs it with plain Node.js, reading .env.

npm run build
npm start

The log ends with the server listening on port 8787 and the console at /admin. Open http://localhost:8787/healthz in a browser: it answers {"ok":true}.

Warnings at the first start are normal

Without ADMIN_SECRET_KEY the server makes its own key and says where it saved it. Without PUBLIC_BASE_URL it says shared verdict pages cannot be created yet. Both are set in Configuration before you go live.

While you change the server code, npm run dev restarts it on every change.

02Create the console owner

Find the setup code. As long as no owner exists, the server prints a one-time setup code in its log at start, in the form XXXX-XXXX-XXXX-XXXX. (If you set ADMIN_SETUP_TOKEN in .env, use that value instead.)
Open the console. Go to http://localhost:8787/admin.
Create the owner. Enter the setup code, your e-mail and a password. Once an owner exists, the setup page is closed for good. Remove ADMIN_SETUP_TOKEN from .env afterwards if you set it.
Look around. The Console guide walks through every section. Every outside service is off until you add its key.

03Run the app

Open the app folder and fetch its packages.

cd app
flutter pub get

Point it at your server. The server address is set when you build or run the app, with --dart-define=API_BASE_URL=. It must be the address only (scheme, host and an optional port), with no path.

# Android emulator reaching the server on your computer
flutter run --dart-define=API_BASE_URL=http://10.0.2.2:8787

# iOS simulator
flutter run --dart-define=API_BASE_URL=http://localhost:8787

Without API_BASE_URL the app starts and runs only the checks on the phone. An address with a path, a query or a user name stops the app at start with a clear message.

Use https for real phones

http:// addresses are for an emulator or simulator on your computer. Builds for real phones and the stores must use your server's https:// address.

04Your name, app id and icon

Before your first store build, give the app your own name, Android application id, iOS bundle id, App Group and icons. Step by step: Rename guide. The console's Brand section sets the name, accent colour and logo the server uses, for example on shared verdict pages.

05Check that everything works

From the top folder of the download, tool/check.sh analyses and type-checks the app and the server, builds the server and checks the licences of every dependency. The automated test suites (2,116 server tests and 894 app tests at this release) run before every release and are not part of the download, because their fixtures hold deliberately fake secrets and example card numbers for the redaction tests. It needs Node.js 26 and Flutter on your computer.

tool/check.sh