Owner access after a browser deploy

When you deploy from Quickback Start's Deploy to Cloudflare card, the very first deploy seeds your app's first administrator (an appmanager user) and shows a one-time claim link next to the live URL:

https://<your-app>.<subdomain>.workers.dev/__quickback/claim#token=…

Opening it lets you set your email and a password, and you're the app's admin. That's the whole setup.

What the claim link is

• One-time and short-lived. The link works once and expires about six hours after the deploy. It's shown exactly once, in the deploy card — Quickback keeps no copy of it.
• Owner-only. The link can only claim the admin account the deploy seeded. It can never create a new account or elevate an existing one.
• Fragment-carried. The token rides the URL fragment (#token=…), which browsers never send to servers — it stays out of request logs entirely.

What happens when you claim

1. You open the link and choose your email and a password (the seeded placeholder email is synthetic — deployed apps can't send mail, so your chosen address is marked verified directly).
2. From that moment you sign in through your app's own auth — the same email + password login every other user of your app gets. If your app has the Account UI enabled, you land on /account; API-only apps sign in via POST /auth/v1/sign-in/email.

Quickback is not your app's identity provider. The claim link is a bootstrap window, not a login method: once claimed (or expired), your app has no runtime dependency on Quickback or the deploy broker for authentication.

Lost access? Re-issue from Start

Deployed apps on workers.dev can't send password-reset email, so your Cloudflare account is the recovery root: in the deploy card, Re-issue admin claim link mints a fresh link — authorized by the same Cloudflare connection that deployed the app. Re-claiming resets the admin password.

Every issue rotates the signing key, so any older link immediately stops working, claimed or not.

For CLI deploys

The claim route only activates when the QUICKBACK_CLAIM_KEY Worker secret is set — the browser-deploy broker mints it automatically. Apps deployed with quickback deploy don't get a claim link (the route answers 404); create your admin through your own flow, or deploy once through Start to bootstrap.