Access the admin console

The admin console provides a web-based administrative interface for managing and monitoring your Terraform Enterprise installation. To access the admin console, you must authenticate using a valid API token with elevated privileges for administration tasks.

Admin console access modes

Terraform Enterprise supports multiple access modes for the admin console, configured using the TFE_ADMIN_CONSOLE_ACCESS_MODE environment variable:

Mode	Description	Default
`port`	Admin console UI is accessible at `/platform/admin` and System API is accessible at `/api/v1`, both via the dedicated admin port (e.g., `:8443`)	✅ Yes
`path`	Admin console UI and System API are accessible only via standard HTTPS path (`/platform/admin` and `/platform/admin/api/v1`)	No
`both`	Admin console UI and System API are accessible via both the dedicated admin port and standard HTTPS path	No
`disabled`	Admin console and System API are disabled and inaccessible	No
(unset)	Falls back to the value of `TFE_ADMIN_CONSOLE_DISABLED`. If `TFE_ADMIN_CONSOLE_DISABLED` is `true`, the console UI is disabled but the System API remains available on the dedicated admin port; otherwise, behavior is equivalent to `port`	No

By default, you can only access the admin console and System API through the dedicated port. This provides network-level isolation, as you can block the dedicated port at the firewall or load balancer level to restrict access to authorized networks or IP addresses.

Generate an admin API token

To generate a token for the admin console, refer to Generate a system API token in the CLI reference documentation.

Access the admin console

The admin console URL depends on your configured access mode:

Dedicated port access (default)

When TFE_ADMIN_CONSOLE_ACCESS_MODE is set to port:

Navigate to the dedicated admin console URL.

https://<your-tfe-hostname>:<admin_console_port>

When prompted, enter your admin API token to authenticate.
After successful authentication, you can access the administrative features.

Standard HTTPS path access

When TFE_ADMIN_CONSOLE_ACCESS_MODE is set to path or both, follow these steps:

Navigate to the standard HTTPS admin console URL:
```
https://<your-tfe-hostname>/platform/admin
```
When prompted, enter your admin API token to authenticate.
After successful authentication, you can access the administrative features.

Access the System API

The System API endpoint depends on your configured access mode and the port you have configured for that mode:

When TFE_ADMIN_CONSOLE_ACCESS_MODE is set to port or both, or is unset, you can send requests to the dedicated admin port configured by TFE_ADMIN_HTTPS_PORT, which defaults to 8443, using the /api/v1 base path.
When TFE_ADMIN_CONSOLE_ACCESS_MODE is set to path or both, you can send requests to the standard HTTPS port configured by TFE_HTTPS_PORT, which defaults to 443, using the /platform/admin/api/v1 base path.

If you configure a non-default port, include it in the request URL. For the full list of ports, base paths, and example requests for each access mode, refer to Network and port configuration in the System API documentation.

Shared session behavior

When TFE_ADMIN_CONSOLE_ACCESS_MODE is set to both, a single sign-in session is shared across both entry points. Logging in on the dedicated port is honored on the standard HTTPS path, and vice versa.

Security Note: When TFE_ADMIN_CONSOLE_ACCESS_MODE is set to both, the admin console becomes accessible on port :443, which is already open for standard TFE traffic. This bypasses network-level blocking of the dedicated admin console port (:8443). To restrict access to the admin console when using both mode, implement path-level IP allow-listing at your reverse proxy or load balancer (e.g., Nginx, HAProxy, AWS ALB, or Kubernetes Ingress) to control access to the /platform/admin path.

Next steps

You can use the admin console to perform the following tasks:

Refer to admin console for information about the features available.