Skip to main content

Password / API Key Change

The Edge credentials have the same initial values on all boxes. Change them once during commissioning and be done with it.

Edge uses a different method than other products

Platform, AI, and Studio use a rotating tool called bin/passwd.sh. Edge does not have that tool. On Edge, all credentials are configuration keys in app.properties, so you change them in the UI and restart, just like any other setting.

Where Are the Initial Values​

After installation, a factory summary file is generated once.

sudo cat /etc/kopens/credentials.txt
ItemValue
Permissions0600, root:root — readable only by root
Creation timeGenerated once on first run of install.sh
ContentsUI login, REST API key, MQTT, OPC UA, TSE, keystore passwords
Move this file once commissioning is done

This file is meant to be printed once before shipment and sent with the sealed box. It is not a file to keep on the box. After you change all credentials, move it to an operations vault and delete it from the box.

This file does not track the values you changed. It retains the initial values from installation time, so if you rely on it after changing passwords, you will see the old values.

What to Change​

KeyWhatInitial Value
edge.admin_passwordUI login password (admin)admin123!
edge.rest.api.keyREST API authentication key (X-API-Key / Bearer)Fixed default
mqtt.server.passwordBuilt-in HiveMQ broker (Sparkplug transmission)edge123!
opc.ua.server.passwordOPC UA server (northbound)edge123!
server.api_keyPlatform integration tokenInjected at installation
ai.api.keyAI feature keyEmpty
tse.server.passwordBuilt-in time series engine (TSE)tse123!

The first six are shown in the environment configuration screen. tse.server.password is not on the screen, so you change it in the configuration file.

Do not change the usernames — leave edge.admin_user, mqtt.server.user, and so on as they are, and change only the passwords. That is the standard operational practice.

Method ①: From the UI (to change one or two)​

  1. Log in with https://<gateway-ip>/ui/main
  2. Click the gear icon in the upper right (fa-cog) → Environment Settings (/ui/system/config)
  3. In the relevant tab, find the key and enter a new value — all keys in the table above are rendered as password input fields (edge.admin_password doesn't even have an eye icon, so the value is not visible on screen)
  4. Click Save in the upper right (fa-save)
  5. Restart — saving alone does not apply the change
Saving and applying are different

Saving only writes the app.properties file. Running processes hold the values from their startup, so you must restart to see the new values. The restart on the screen does not kill the container; it restarts only Tomcat (30–90 seconds).

For details, see Restart.

Method ②: Via Command (commissioning — changing multiple at once)​

bin/config.sh changes keys for you. You can change several at once and then restart only once, so during commissioning this method is faster.

cd /opt/kopens/install/bin

./config.sh --get edge.admin_password            # 현재 값 확인
./config.sh --set edge.admin_password '<new-password>'
./config.sh --set edge.rest.api.key    '<new-key>'
./config.sh --set mqtt.server.password '<new-password>'
./config.sh --diff                               # 직전 백업과 비교
./config.sh --restart                            # 마지막에 한 번만

Run it without arguments to open the file in an editor, and it will ask whether to restart after you save.

Every time you change something, a app.properties.bak.YYYYMMDD_HHMMSS backup is created automatically.

Use only on 2026.08-20260825 or later

On earlier versions, config.sh --set silently loses your values. It replaced the real file with a compatibility symlink via sed -i, so your edits never reached the app and were overwritten on the next restart. That is where the symptom "it says changed but it doesn't work" came from.

Check the image tag your box is running — IMAGE_TAG is the authoritative one.

grep '^IMAGE_TAG=' /etc/kopens/version.env

If you are on an older version, use Method ③ (direct editing) below, or change it from the UI.

Method ③: Edit the File Directly​

The authoritative configuration file is a single real file.

sudo vi /etc/kopens/conf/app.properties
sudo systemctl restart plantpulse-edge.service
Always edit the real file inside conf/
PathIdentity
/etc/kopens/conf/app.propertiesAuthoritative real file — the app reads it directly via -Dpe.conf.dir
/etc/kopens/app.propertiesSymlink — a convenience name pointing to the file above

If you open the symlink in an editor, you are editing the real file, so vi works either way. But a custom sed -i script will delete the symlink and create a new regular file in its place. Then your edits sit in /etc/kopens/app.properties while the app reads conf/app.properties, which still has the old values — resulting in a state where the save worked but nothing changed. (Using sed -i --follow-symlinks prevents this.)

After editing, verify that your changes are in the real file.

grep '^edge.admin_password' /etc/kopens/conf/app.properties

Verification​

# 실파일에 새 값이 들어갔는지
sudo grep -E '^(edge.admin_password|edge.rest.api.key|mqtt.server.password)' \
     /etc/kopens/conf/app.properties

# UI 로그인 — 새 비밀번호로 접속되는지
# REST API — 새 키로 통과하는지 (키가 «필요한» 경로로 확인한다)
curl -k -H "X-API-Key: <new-key>"  https://<gateway-ip>/api/v1/opc   # 200
curl -k -H "X-API-Key: 틀린키"  https://<gateway-ip>/api/v1/opc   # 401
You cannot verify keys via /api/v1/system/*

/api/v1/system/health, /ready, /version, and /api/health are paths that open without authentication (see REST API). Even if you put an arbitrary value as the key, you get a 200, so it does not confirm that "the key changed." You must verify that a wrong key returns 401, as described above.

The sidecar holds the initial values

In /etc/kopens/env.sh.generated (0600), the values determined at installation time remain in export ADMIN_PASS=... form. When a reinstall or upgrade regenerates app.properties, it reads the existing app.properties values first and preserves them, so values you changed in the UI or files are not reverted by an upgrade.

However, the sidecar itself is not updated, so consider its values initial values as well.