Guide 01 · Local administration
Activate AI Model Builder Admin securely.
The correct activation flow starts inside the local Builder. It binds shop validation to that installation without exposing local Admin endpoints or generating reusable public tokens.
Before you begin
Requirements
Use the Admin workspace in the installation you want to authorize.
Use the same email approved for your contributor or paid account.
Free contributor activation requires a direct public GitHub profile URL.
Standard flow
Activate Free or paid Admin access
Start the local application
Run AI Model Builder and open its Admin workspace. The UI and API must remain on local loopback addresses.
Choose secure shop validation
Use the Activate Admin link in the workspace. The Builder opens Reallexi validation with a pseudonymous, one-way machine binding and a secure return channel.
Verify the approved identity
Enter the account email. Free contributor access also verifies a direct GitHub profile. Complete the newest 8-digit email challenge within 10 minutes.
Return the token locally
Choose the return-to-Builder action or copy the issued token into the originating Admin workspace. Do not send it through email replies, chat, or support tickets.
Unlock and confirm
Choose Unlock Admin in the local workspace. Confirm the plan and capability status, then remove any temporary clipboard copy of the token.
Approved commercial access
Enterprise approval before activation
An authorized shop operator must first upgrade the same email in the hosted SQLite account database. The operator can use the browser console or a protected local automation credential.
Sign in to the operator console
Use an allowlisted operator email and the single-use passwordless link.
Apply an audited plan change
Select Update / upgrade plan, choose Enterprise, and provide a specific business reason. Every mutation creates an audit event.
Activate from the Builder
After the account shows Enterprise, the customer completes the standard installation-bound validation flow above.
Protected command-line option
After an operator creates a one-time CLI credential in the operator console, protect it with Windows DPAPI and perform the audited upgrade:
npm run operator:protectnpm run operator:account -- --email customer@example.com --action upgrade --plan enterprise --reason "Approved Enterprise access"Run these commands from the AI Model Builder project root. The raw credential is displayed only once, stored encrypted for the current Windows user, scope-limited, and revocable.
Recovery
Troubleshooting
| Symptom | Likely cause | Correct action |
|---|---|---|
| Activate button remains unavailable | Validation was not opened from a running Builder installation | Return to local Admin and reopen its secure link |
| Email code is rejected | An older code was entered or the 10-minute window expired | Request a new code and use only the newest email |
| Plan still shows Free | The operator changed another email or the action did not complete | Confirm the exact account email and review the operator audit event |
| Token does not unlock Admin | The token belongs to another installation or has expired/revoked | Restart validation from the intended installation |
| Operator command returns 401 | Credential is missing, expired, revoked, or lacks scope | Create a new one-time CLI credential and run protection again |
Non-negotiable practices
Security guidelines
- Keep Builder Admin and Hugging Face controls local-only; never proxy them to the public network.
- Never commit shop tokens, operator credentials, environment files, local databases, or generated artifacts.
- Do not share raw credentials in screenshots, browser responses, chat, support messages, or issue trackers.
- Use passwordless links only on the intended device and finish before they expire.
- Review plan, token, catalog, and account changes in the operator audit history.
- Block or revoke access immediately when an account or device is suspected of compromise.