Tenant onboarding
This guide walks you through creating a NebCore tenant: from the invite email to a running platform environment in your own cloud account. Expect the guided part to take under an hour; the automated provisioning that follows usually completes within the same sitting.
Onboarding is currently invite-based. If you do not have an invite code yet, request one from the sign-up page at platform.nebcore.ai; you will receive an acknowledgment right away and an invite email once your request is approved.
The model: your account, your data plane
NebCore hosts the management plane. Everything that runs your workloads lives in accounts you own and control:
| You bring | NebCore provides |
|---|---|
| An AWS account (a dedicated one is recommended) | Automated provisioning of your platform environment into it |
| An identity provider tenant for SSO | Login, role, and membership wiring for your team |
| A GitHub organization | A gitops repository and the app integrations that manage it |
| An email address you can verify | Your tenant-admin account |
No long-lived NebCore credential is placed in your account: access is through a cross-account role you create yourself from a template during the wizard, and you can inspect exactly what it grants before you deploy it.
Before you start
Have these ready; the wizard verifies each one as you go:
- Your invite code (from the invite email).
- An AWS account where the platform environment will be created, with permission to deploy a CloudFormation stack in it.
- A GitHub organization you administer, for the gitops repository and app integrations.
- Your identity provider details if you want team SSO from day one (you can start with just your admin account and add SSO later).
- A domain (or subdomain) you want the environment served under, hosted in or migratable to Route 53.
The wizard
Open the link from your invite email. The wizard saves progress continuously: if you close the tab, reopening the same link resumes where you left off.
1. Account
- Verify your invite: enter the one-time code sent to your email.
- Accept the terms before any information is collected.
- Create your admin identity: your name, email, organization display name, and a short organization slug (checked for availability as you type).
2. Infrastructure
- Cloud provider: AWS is available today; other providers are visible but not yet selectable.
- Connect your AWS account: the wizard gives you a CloudFormation template that creates the cross-account trust role, then verifies it can be assumed. A second template deploys the scoped permission grants; the wizard verifies those too before letting you continue.
- Source control: connect your GitHub organization and create the platform's app integrations from the wizard's step-by-step actions; each one is verified in place.
- Cluster: choose the cluster type for your primary environment (managed EKS is the mainline path; self-managed options are available for on-prem and local evaluation) plus the add-ons you want.
- Networking and DNS: choose how the environment is exposed and which domain serves it. If your domain is hosted elsewhere, the wizard provides a guided, non-disruptive migration path into Route 53.
3. Configuration
- SSO: connect your identity provider so your team signs in with their existing accounts, or defer this and start with the admin account alone.
- Features and plan: pick the platform features to enable and a plan tier. A 30-day trial is available.
- License identity: the legal name, billing email, and country your license is issued to.
4. Review and launch
Review everything on one page (each section has an edit link), then start provisioning. A live board shows the work as it happens, grouped into four phases: cloud foundation, cluster, identity and SSO, and platform readiness. Each card streams its own progress log, so you can watch the environment come up rather than staring at a spinner.
When provisioning completes
You receive an email invitation to your new organization. Accept it, set your own password, and sign in at platform.nebcore.ai. No credential is ever displayed in the wizard or sent in email.
Next steps
- Installation: install NebCLI and NebGuard on your workstation.
- Quickstart: log in with
nebcli login --tenant <your-slug>, get your first short-lived cloud credential, and see a guardrail fire. - Invite your team from the platform console; if you connected SSO, they sign in with their existing accounts.
The wizard verifies each connection before letting you continue, so problems surface on the step that owns them, with a retry after you fix the cause. If a run ends in a failure view, use its get-help link; it carries the context of where you stopped.