Set up your account

A checklist to get your CubePath account ready before you deploy.

1. Complete your profile

Finish your account details from the account menu — name, email and contact info. This keeps billing and support running smoothly.

2. Your organization

Your resources and billing live under an organization. Switch between organizations from the top of the sidebar, and rename yours in settings.

3. Create projects

Projects group related resources (servers, networks, databases) so environments or clients stay separate. Create as many as you need and switch between them from the top bar.

Tip

Project boundaries matter more than they look. A private network, a firewall group and an availability group can only be used by resources in the same project, so splitting staging and production into separate projects is what stops them accidentally sharing infrastructure.

4. Invite your team

Invite teammates by email from your organization settings. Access is permission-based, so each member only sees and manages what their role allows.

5. Verify your account

To deploy resources you first need to verify your organization. Open Billing → Balance and add a payment method.

Adding a valid card does two things at once:

Verifies your identity, which is what keeps fraud and abuse off the platform.
Deposits your first credit. The card is charged $10.00, and that amount lands in your account as usable credit — it isn't a fee.

Once the charge goes through, your account status becomes verified, deployment unlocks, and the $10 shows up in your balance ready to spend.

6. Single Sign-On (optional)

SSO lets your team sign in with your company's own identity provider — Okta, Microsoft Entra, Google Workspace, or anything that speaks OpenID Connect. Members use the corporate account they already have, and you control access from your identity provider rather than from CubePath.

Set it up at Organization → SSO as an organization owner or admin.

1
Create an OIDC app in your provider
Use the redirect URI shown on the CubePath SSO page (there's a copy button next to it): https://identity.cubepath.com/account/sso/callback Your provider gives you back an Issuer URL, a Client ID and a Client secret.
2
Fill in your SSO settings
Enter a Provider name, the Issuer URL (use Test connection before saving), the Client ID and the Client secret. When editing later, leave the secret blank to keep the saved one.
3
Choose how new members are added
Auto-create members on first login adds anyone from your verified domain automatically; with it off, only people you've invited can sign in. Pick the default role for auto-created members.
4
Enable SSO and save
Turn on Enable SSO and click Save.
5
Verify your email domain
See below. Until the domain is verified, your settings are saved but login-by-email stays off.

Important

SSO can only auto-assign the member, viewer or billing roles — never owner or admin. Those are granted by hand from the Team page, so a misconfigured identity provider can't mint administrators.

Verify your email domain

Domain verification is what stops anyone pointing your email domain at their identity provider and intercepting your logins. It's a one-time check:

1
Add a TXT record
In your DNS, create a TXT record with host _cubepath-verification and value cubepath-sso-verification. Most panels append your domain automatically, so enter just the host, not the full name.
2
Open a support ticket
Request domain verification from your dashboard and include the domain (e.g. yourcompany.com).
3
We verify and enable it
Our team checks the record and sets it as your organization's verified domain. Because the ticket comes from your account, the domain is tied to your organization.

The verified domain is managed by CubePath support and can't be set by you — that's the safeguard. Once done, the domain shows as verified on the SSO page and your team can log in by entering their work email.

Problem	What to check
Record not found	The host must be exactly `_cubepath-verification`, and not typed with the domain twice. Give DNS time to propagate
Value mismatch	The value must be exactly `cubepath-sso-verification`
Domain already verified elsewhere	A domain can only be verified for one organization at a time — mention it in your ticket

How your team logs in

Members go to the login page, enter their work email and choose Continue with SSO. They authenticate with your provider and come back signed in, with no CubePath password.

If someone already has a personal CubePath account on that email but isn't a member yet, invite them from the Team page first.
The email your provider returns must be on the verified domain.

Sessions and revoking access

SSO sessions last about 8 hours, then re-authenticate through your provider. That short window is a feature: disabling someone in your identity provider costs them access within hours with no extra setup.

For immediate sign-out, register a back-channel logout URL in your provider:

https://identity.cubepath.com/account/sso/backchannel-logout

Your provider then notifies CubePath the moment a user signs out or is deactivated, and we end the session right away. Removing an SSO member from the Team page also signs them out immediately and blocks them from signing back in.

You're ready

Pick a region and the right product, then deploy from that product's own guide.

On this page