Create an account
This page gets you from "no account" to "signed in to the console with a project selected." It takes about two minutes once you have your credentials.
Accounts and invitations are provisioned by your organization administrator or via an invitation link.
Before you begin
You need one of these from an administrator:
- An email + temporary password (they created the account for you), or
- An invitation link (a one-time URL that lets you create your own password).
Which one you get is your admin's choice. Both paths end in the same place.
Path A: you were given a temporary password
1. Sign in
Open https://console.codyhill.dev. Enter your email and the temporary password.
Your admin saw that password exactly once, when the account was created. If it's lost, they can't look it up — they can only reset it, which generates a new one-time password.
2. Choose a real password
Accounts created by an admin are flagged "must change password." Your new password must be at least 12 characters, and at least 3 of these 4: an uppercase letter, a lowercase letter, a number, a symbol. Either path clears the flag the same way.
- platformctl
- curl
- Console
You don't have to open the console for this at all. Neither password is ever taken as a flag value — a password in argv lands in your shell history and is readable in the process table by anyone else on the host — so the command reads each one from a file or from stdin:
platformctl change-password --current-password-file ./old --new-password-file ./new
Two shorter forms work as well:
# the new password piped in, the current one from a file
printf %s "$NEW" | platformctl change-password --current-password-file ./old
# the current password from the same variable `platformctl login` honours
platformctl change-password --new-password-file ./new # reads $CAI_PASSWORD
Either flag accepts - for stdin, and whichever flag you omit falls back to stdin — but only one of them can, because stdin is one stream. $CAI_PASSWORD covers the current password only; there is deliberately no environment variable and no flag for the new one. Set it from somewhere that is not your shell history: an inline CAI_PASSWORD=... platformctl ... is recorded exactly as a flag would be.
Run it with a terminal on stdin and nothing piped in and it does not prompt — it refuses, naming the flags:
no current password given: pass --current-password-file <path> and --new-password-file <path> (either may be "-" for stdin), or set $CAI_PASSWORD for the current one. Neither password is ever taken as a flag value, so neither can land in your shell history
One trailing newline is stripped from whatever it reads, so a file written with echo works as typed. On success a fresh session token is cached for you: the token you authenticated with still carries "must change password", so without the replacement you would stay locked out having just done what the API asked.
curl -s -X POST "$CAI_API/v1/auth/change-password" \
-H "Authorization: Bearer $CAI_TOKEN" \
-H 'content-type: application/json' \
-d '{"current_password":"<the temporary one>","new_password":"<at least 12 chars, 3 of 4 types>"}'
The response is a fresh session token, the same shape POST /v1/auth/login returns — so the old one is replaced, not merely revalidated.
The console shows a Choose a new password dialog on sign-in. It stays on screen until you finish it, so you can't do anything else first.
You should see: the dialog closes and the console loads normally.
Until you change the password, every management action is blocked. The API refuses those requests with:
password change required before using this API
Path B: you were given an invitation link
1. Open the link
The invitation link opens a public page in the console showing:
- the project you're being invited to,
- the role you'll get (
adminormember), - the email address the invitation was issued for.
If the link is broken or was already used, you'll see one of these instead:
this invitation link is not valid
this invitation has already been used, revoked, or expired
Ask your admin for a fresh invitation if that happens — links are single-use and expire.
2. Choose your password
If you don't have an account yet, the page asks you to choose a password of at least 12 characters and 3 of 4 character types. It then creates your account and grants you the project role in one step. Enter a shorter password and you'll see:
choose a password of at least 12 characters, mixing at least 3 of 4 character types, to create your account
If you already have an account, accepting simply grants the role to it — your existing password is never changed.
3. Sign in
Go to https://console.codyhill.dev and sign in with your email and the password you just chose. No forced password change on this path — you already picked your own.
Pick your organization and project
Everything you create on the platform lives in a project: a private workspace with its own members, resources, and quota — a cap on how much that project can run. Projects belong to an organization, which is usually your company. The console filters every page by the project you have selected, and it calls that selection your scope.
- Click the Scope button in the top bar, or press Cmd+K (Mac) / Ctrl+K (Windows/Linux).
- Type your project's name and pick it from the Switch project list.
- You land on the project's Home page — a dashboard of tiles counting the project's agents, functions, services, and data stores.
The console remembers your last scope, so you only do this when switching teams. The same search box also finds any resource you can see (agents, functions, secrets, and more) — it's the fastest way around the console.
Connect the project to Crusoe Cloud
One setup step stands between a new project and its first deploy: the project needs a Crusoe Cloud credential. Everything you deploy is built into a container image, and that image is stored in your own Crusoe Cloud Registry — your account, your quota, your bill — so the platform has to be able to reach it.
Someone does this once per project, and a project admin is the only role that can. If yours is already connected, there is nothing to do and nothing changes for you. Either quickstart walks you through it as its first step: connect your Crusoe Cloud account. The full reference is Crusoe Cloud integration.
Sessions, roles, and multi-factor authentication
- Sessions last 12 hours. After that you sign in again. Signing out clears your browser session immediately, and closing the browser ends it too.
- Your role decides what you see. If a page shows a "no access" message, you need a bigger role in that project. See Projects and access.
- Password policy. Ensure you choose a strong password meeting complexity requirements (12+ characters, upper/lowercase, numbers, symbols).
Next steps
- Install the CLI — for scripting and deploys from your terminal.
- Deploy your first agent — you can do it entirely in the console you just signed in to.
- Core concepts — how organizations, projects, and roles fit together.