Chris wrote:
Sorry you're locked out of Nginx Proxy Manager. Two things decide that login on a SparkBox, and the first one catches most people. First, the sign-in email is usually not in the .env file at all. Only the password is saved there. Unless you set up your own web address in SparkBox, the account's email is admin@sparkbox.local. If you did set up a domain, SparkBox switched NPM's sign-in email to the email address you typed in that setup (the certificate needs a real address), and saved it as NPMADMINEMAIL. Second, NPM only uses the saved login once, when it creates its first account. If the account was changed inside NPM, or existed before SparkBox started saving one, the saved password never applies again. Updating SparkBox doesn't change an existing NPM account. One check: in the dashboard, open Settings, then Service Passwords, and find the row "Nginx Proxy Manager admin (port 81)". It shows both halves, the email and the password. Sign in on port 81 with exactly that pair, and copy-paste the password rather than typing it. If that exact pair is refused, reply here with just the word "refused" and your SparkBox version (please don't post the password), and we'll take it from there.
Chris wrote:
I'm sorry — I was wrong to imply the email and password SparkBox saved would necessarily be the login Nginx Proxy Manager currently accepts. NPM uses those saved details when it creates its first admin account; if an account already existed or was later changed inside NPM, the saved pair may not match the current login. One check: did this exact pair ever successfully sign in to NPM on this box? Please answer yes or no only, and don't post the password. I've corrected what I know so this doesn't send the next person down the same path.
Chris wrote:
Thanks—that helps. I'm sorry: my earlier question focused on whether the saved password had changed, but you've never successfully signed in, so that wasn't a useful direction. The saved pair is intended for NPM's initial admin account, but the HTTP 400 “Bad Token” by itself doesn't tell us whether account setup or the login request is failing. One check: what SparkBox version is shown on your dashboard? Please don't post the password or request headers/cookies. I've corrected what I know so this doesn't send the next person down the same path.