First run? Set BOOTSTRAP_ADMIN_EMAIL and BOOTSTRAP_ADMIN_PASSWORD in the API environment, sign in with those once, then remove them. After too many failed attempts, sign-in locks briefly.