Getting Started
This page walks a tenant owner through signup and a developer through their first proxied Claude Code session.
Sign up and create a tenant
Open the console
Navigate to https://app.<domain> and sign in. Cognito’s Hosted UI
offers Google (and optionally GitHub or Microsoft Entra) sign-in plus
email/password.
Get approved
Self-signups land in a pending state and see the /pending screen
until a platform admin approves the account. Invited users are approved
automatically.
Create a workspace
After approval, the console redirects you to /onboarding. Submit a
workspace name. On creation the platform:
- writes the
TENANT#<id>record (tier=starter,status=active), - provisions a per-tenant KMS CMK,
- reuses or creates your Stripe customer and a metered subscription,
- writes a free-credit row (10,000 free tokens),
- derives your proxy
slugfrom the workspace name.
Add a payment method
If the tenant has no payment method yet, the console redirects you to Stripe Checkout (setup mode) to collect one before you can use the proxy beyond the free credit.
The proxy slug is derived at runtime from the workspace name via
slugify() — it is not a stored field. Renaming a tenant changes the
proxy URL; existing clients pointing at the old URL see 404s once the
60-second tenant cache expires.
Next steps
- Developers — see Connect Claude Code.
- CI / Claude Desktop — see Service Accounts.
- Contributors — see Local Development.
The three auth flows
| Caller | Mechanism |
|---|---|
| Web console (owner / developer) | Cognito Hosted UI with PKCE; social or email/password |
| Claude Code (interactive developer) | agent-runner-auth token as apiKeyHelper — Cognito OAuth PKCE, tokens in the OS keychain |
| Service account (CI / Claude Desktop) | ar_live_... API key in the x-api-key header, verified by bcrypt against a stored hash |