> ## Documentation Index
> Fetch the complete documentation index at: https://docs.protectorplus.cloudsine.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Initial Setup

> First-time provisioning of the Protector Plus appliance and dashboard.

After deploying the AMI (or installing the Helm chart), Protector Plus requires a one-time provisioning pass before it can accept production traffic.

## 1. Network configuration (AMI only)

In appliance/AMI deployments, the operator assigns an IP address via the console using the bootstrap `kioskuser` account. The `kioskuser` password is provided out-of-band.

<Steps>
  <Step title="Access the appliance via the physical / virtual console">
    Log in as `kioskuser`.
  </Step>

  <Step title="Configure IP, gateway, DNS, NTP">
    Use the menu-driven kiosk to set the static network configuration.
  </Step>

  <Step title="Reboot">
    Select the reboot option from the kiosk menu.
  </Step>

  <Step title="Verify dashboard access">
    Navigate to `https://<instance-ip>`. The dashboard administrative password is provided out-of-band.
  </Step>
</Steps>

<Note>
  In Kubernetes/Helm deployments, network ingress is exposed via your Ingress Controller and Helm-chart values control replica counts and resource sizing — there is no kiosk step.
</Note>

## 2. First admin sign-in

The initial admin authenticates using a **local dashboard account**. After sign-in:

1. Change the admin password (Profile → Security).
2. Bind Enterprise SSO if available (Profile → Identity Providers). The initial local admin remains as the break-glass entry point.
3. Configure SIEM forwarding (Settings → SIEM Integration) if you have a log collector.

## 3. Create the first security profile

Create a security profile for your GenAI application. See [Security profiles](/user-guide/security-profiles) for the workflow and the choice between **Forwarding mode** (FQDN-driven) and **Non-forwarding mode** (key-driven).

## 4. Set up authentication

<Steps>
  <Step title="Generate the org-wide API key">
    Navigate to **Org Settings** in the dashboard sidebar → Click **Generate** to create your organization-wide API key.

    <Warning>
      The key is shown only once. Store it securely in a secrets manager — Vault, AWS Secrets Manager, GCP Secret Manager, Doppler, etc.
    </Warning>
  </Step>

  <Step title="Register your first application">
    Navigate to **Apps** → **Register App**.

    Fill in:

    * **App Name**: Human-readable name for your GenAI application
    * **App ID**: Unique identifier (e.g., `my-chatbot`, `hr-assistant`)
    * **Security Profile**: Select the security profile you created in Step 3

    Save and note your App ID for use in API calls.
  </Step>

  <Step title="Configure your application">
    Update your application to include both headers in all Protector Plus API calls:

    * `X-API-Key`: Your org-wide API key
    * `X-App-ID`: Your app's unique ID

    See [Authentication](/api-reference/authentication) for integration details.
  </Step>
</Steps>

<Tip>
  The same org-wide API key is used for all your applications. Each app is distinguished by its unique App ID.
</Tip>

## 5. Configure guardrails

Configure which guardrails to enable for your security profile. A recommended starting configuration is: LLM, Vector, Content Moderation, and System Prompt Protection. See [Guardrails](/user-guide/guardrails) for details on each guardrail. Tune from there once you have baseline alert volume.