Introduction
Getting access
Codara Cloud has no platform passwords. A verified GitHub or enabled Google identity creates your account; organization membership determines what that account can access.
Joining the beta
While Codara Cloud is in beta, buying a plan needs a personal invitation code. Joining someone else’s organization does not: an invited teammate only signs in.
Request access
Fill in the form at codaracloud.com/beta. You get a confirmation email from cloud@codaracloud.com. Joining the list creates no account, subscription or charge.
Receive your invitation
A person reviews every request. When we can offer a place, we email you an invitation with a code such as BETA-XXXXXXXXXX. The code is for one plan, billed monthly, works once and expires after 30 days.
Sign in and enter the code
Open the link in the email: it signs you in and fills in the plan and code. Or choose I have an invite code on codaracloud.com, sign in with GitHub or Google, and enter the code from your email.
Connect Discord (optional)
Account setup offers Connect Discord. Connecting adds you to the Codara Discord server and makes your first 3 months free instead of one. Do it before checkout: it can’t be added to a subscription you already have. If you leave Discord later, you keep your free months. One Discord account unlocks the offer only once.
Confirm in Stripe Checkout
Checkout shows the price, tax and when the free period ends before you confirm. A card is required. Your plan starts once checkout completes.
The beta offer
Who can sign in
A verified provider identity can create an account while browser registration is enabled, but an account alone provisions no organization, workload, subscription, trial, or charge. An organization owner or admin can invite the verified email on that account. The generated link is one-time and expires after 7 days by default.
There are no shared logins. Every person uses an individual provider identity, and organization membership determines which workspace boundaries they can see.
Organization roles
| Role | Access |
|---|---|
| Owner | Full organization access, including admins and invitations. |
| Admin | Manage resources and members, except inviting another admin. |
| Developer | Deploy and manage application resources inside authorized workspaces. |
| Billing | Read workspace, usage, quota, invoice and audit information. |
| Viewer | Read-only access; no secret reveal or mutations. |
Signing in to the console
Open the console
Go to console.codaracloud.com. Any page you visit while signed out redirects to the sign-in screen and remembers where you were headed.
Continue with GitHub or Google
Authorize the provider shown on the sign-in page. GitHub requests read-only identity and email access; repository access is handled separately by the Codara GitHub App. Google requests only OpenID identity scopes.
You land back where you started
Your browser session lasts 7 days, after which you sign in again. You can sign out at any time from the account menu.
Use GitHub and Google for the same account
Sign in to the account you want to keep, open Settings → Account, and choose Connect Google. Complete Google verification and Codara adds that immutable Google identity as a second sign-in method. Signing in with either provider then opens the same memberships and workspaces.
Matching email addresses are not account linking
If sign-in fails
Signing in from the CLI
The codaracloud CLI signs in through your Codara Cloud account in a browser. Run:
$ codaracloud login> Open this URL in your browser: https://console.codaracloud.com/auth/cli> And enter this code: XXXX-XXXXSign in to the console as usual, with GitHub or Google, and approve the code. The CLI then stores the credential in your operating system keyring, falling back to ~/.config/codara/config.yaml when no keyring is available. Confirm it worked with codaracloud whoami.
CLI sessions expire after 7 days
codaracloud login stores a session credential with the same 7-day lifetime as a browser session — it does not mint a long-lived token. For anything unattended (CI, scripts, scheduled tasks), create an API token instead.API tokens
API tokens are independent of your browser or CLI session. They carry an explicit list of scopes, are restricted to a 1–365 day lifetime, and can be revoked individually. New tokens default to 90 days and a read-only permission profile. Create one from Settings → API tokens in the console, or from the CLI:
# Name is a positional argument, not a flag$ codaracloud token create ci-deploys --scopes apps:read,deploys:create --expires-in-days 90 $ codaracloud token list$ codaracloud token revoke <token-id>The token is shown exactly once
Use a real login to manage credentials
Using a token
Pass it as a bearer token, or hand it to the CLI:
$ curl -H "Authorization: Bearer cdr_live_xxxxxxxx" \ https://console.codaracloud.com/v1/apps # The CLI reads --token, then $CODARA_TOKEN, then the keyring, then the config file$ export CODARA_TOKEN=cdr_live_xxxxxxxx$ codaracloud apps listScopes
A token carries only the permissions you grant it. The token screen offers 28 user-facing scopes; the API also recognizes the equivalent * and admin wildcards plus the internal-only builder service scope. The scopes used most often are below.
| Scope | Grants |
|---|---|
| apps:read | List and inspect apps. |
| apps:write | Create, update and delete apps. |
| deploys:read | Read deploy history and status. |
| deploys:create | Trigger builds and releases. |
| deploys:promote | Promote a release into another environment. |
| logs:read | Read runtime and build logs. |
| env:read | List environment variable keys (values stay masked). |
| env:write | Set and remove environment variables. |
| env:reveal | Read a variable’s plaintext value. Audit-logged. |
| domains:read / domains:write | Inspect and manage custom domains. |
| db:read / db:write / db:connect | Inspect databases, manage them, and open a connection through the platform. |
| buckets:read / buckets:write | Inspect and manage object storage buckets. |
| cost:read / metrics:read | Read cost figures and metrics. |
A token with no scopes is nearly inert
/v1/me and public health endpoints. Scoped resource requests return 403.What your account can see
Organization membership is the tenancy boundary:
- Organization members can act only on workspaces owned by organizations they belong to, and only as permitted by their role.
- A workspace groups projects, access and usage inside an organization. People join the organization rather than sharing a workspace login.
- API-token scopes can only narrow the owner’s organization role. A token may also be bound to one workspace (
client_idin the API); it can never widen access to another organization or workspace. - Codara platform operators retain global cluster access for support and operations.
Checking who you are
| Surface | How |
|---|---|
| Console | Settings → Account |
| CLI | codaracloud whoami |
| API | GET /v1/me |
Last updated