seikan-server has a built-in web console at /_admin on the admin host (e.g. https://admin.example.com/_admin) — no separate install, no extra port. It's an alternative front end to the admin API, not a different system: log in with any root or sub API key, the same one you'd use with seikan init or Authorization: Bearer.

Logging in

Open /_admin, paste an API key, and log in. This starts a session (a browser cookie), separate from the bearer-token flow the CLI/scripted clients use — either works on every admin API route, and both resolve to the exact same key, role, and permissions. There's no separate username/password or account system to set up; if you can authenticate with the CLI, you can log in here.

Sessions last 30 days of inactivity and are stored server-side, so revoking a key (or restarting the server) invalidates any session tied to it immediately. Log out from the sidebar to end a session early.

What's there

• Dashboard — for root keys: create and revoke sub API keys. A newly created key's raw value is shown once, exactly like seikan-server prints it once at first start — copy it before navigating away. Sub-key sessions see a simpler view (key management is root-only, same as the API).
• Clients — every configured frontend, with live online/offline status (whether a tunnel client is currently connected), type, domain or port, and certificate status.
• Guidance — the install, seikan init, and seikan serve commands, prefilled with this server's real admin host (and, if you just created a sub-key in the same session, that key's real value).

Notes

• /_admin's login page is reachable without authentication (it has to be — that's how you log in), but every actual endpoint it calls (/api/frontends, /api/apikeys, ...) requires a valid session or bearer token, same as always.
• Like the rest of the admin API, /_admin only ever responds on the admin host — it's unreachable on any frontend domain.