The setup token
Why the first account needs one, and where to find it.
A fresh Talos has no accounts, and whoever creates the first one becomes its administrator. On a laptop that is always you. On a server with a public address it is whoever opens the page first, and bots look for unclaimed first-run pages within minutes of a server appearing. Talos runs commands on your servers, so the first account must be protected.
So creating the first account needs the setup token: a random value only someone with access to the machine can read. After the first account exists it is never asked for again; everyone else joins by invitation.
Where to find it
The installer prints it next to the link, and saves it as SETUP_TOKEN in the .env file in the install folder. It is generated once and never changed, so it is still there weeks later. On a cloud server, logging in shows it. Installed by hand without a SETUP_TOKEN? Talos makes one from your ENCRYPTION_KEY and prints it in the backend log until the first account exists:
Google and GitHub sign-in
The token protects those too: on the sign-up page, enter it before choosing “Sign up with Google/GitHub”. It is checked before you are sent to the provider.
The only install without a token is a trial (--eval), which nobody but your own computer can reach.