Same token you set in SUPERADMIN_TOKEN. If you did not set one, check the server logs on boot — waxum prints an auto-generated one on first run.