Odin v4.28.0

[4.28.0] - 2026-11-06

The first-run setup page now generates your admin token (#758).

Added

• Generate admin token on the setup page. A fresh install's WebUI asked for a "Web API token" you had to invent,
  with no hint of what it was for. Setup now offers Generate admin token: a fresh 64-character token with a
  Copy button, and a note that you will sign in with it from now on. Save setup, then paste it into the sign-in
  screen. The token is generated in your browser and saved as web.api_token, as a typed token always was; nothing
  else about authentication changes.
  • You can still type your own token, or finish without one (no sign-in, reachable from this machine only).
  • The token stays on screen until you continue, so a failed save, or a save before copying, does not lose it. If
    you lose it later, an administrator on the host can recover it from web.api_token in Odin's config file
    (/etc/odin/config.yml for package installs). It is not listed on the API Tokens page.

Fixed

• After setup with a token, the setup page still offered a Codex device sign-in that the server would refuse. It
  now points to System → LLM Config, where Codex can be connected after you sign in.
• The first sign-in after setup could say "Your session ended" when the browser kept a session from an earlier
  Odin install. It no longer does.

Upgrade note: no configuration change. Installs that finished setup never see the setup page.

Commits

v4.27.6..v4.28.0

• bump: v4.28.0 (75df1bb)
• Merge pull request #758 from Calmingstorm/feat/first-run-admin-token (70d1fb7)
• release: prepare 4.28.0 changelog and install links (feb3ac8)
• app: clear the session-ended notice when entering pending setup (cf5729a)
• setup: keep the token safe across device sign-in, Copy and 401s (acf1c42)
• changelog: reference #758 (a839500)
• webui: generate the admin token on the first-run setup page (6e38b62)