Get started with Origin Cloud

This tutorial takes you from a new user account to a running Linux instance you log in to over SSH. You use the origin CLI for almost every step and the GraphQL API for the payment method.

What you’ll build

You’ll end up with an organization that holds one project. In the project runs one instance, in the project’s default VPC, with a public IPv4 address that you connect to over SSH.

The following diagram shows the end state.

What you’ll learn

• How to install the CLI and log in.
• How to register an organization and read its review status.
• How to create a project and add a payment method.
• How to import a key pair, launch an instance and log in to it.
• How to remove what you created.

Before you begin

Cost

The instance, its root volume and its public IPv4 address are billable for as long as they exist. Registering an organization, creating a project and the default VPC cost nothing. If you follow Clean up right after the tutorial, you pay for a few minutes of usage. For current rates, see Pricing.

At list prices of 13 October 2026, in EUR excluding VAT, 15 minutes cost about €0.02:

The root volume’s size is the image’s own size. Metric samples the platform collects from the running instance, and traffic out to the internet (€0.09 per GB), add fractions of a cent here.

Step 0: Create your account

Create your Origin Cloud user account at console.origincloud.eu. The CLI, the API and the console all use this account: in step 1 you log in to the CLI with it.

Step 1: Install the CLI and log in

1. Install the origin CLI. See Install the CLI.

2. Log in. Your browser opens the Origin Cloud login page:

   origin id login

   On a machine without a browser, use origin id login --device instead. See Log in.

Step 2: Register your organization

1. Register the organization with its billing details. Add --vat-id <vat-id> if the billing address is outside Germany:

   origin admin register-organisation \
     --name "Example GmbH" \
     --street "Example Street 1" \
     --city Berlin \
     --postal-code 10115 \
     --country DE \
     --invoice-email billing@example.com \
     --contact-person "Jane Doe"

2. Note the orgId in the output, for example 0a1b2c3d4e5f. You’re now the organization’s Owner and its billing administrator.

For details and the other way to create an organization, see Create an organization.

Step 3: Check the review status

1. Read the organization’s status:

   origin admin get-organisation --id <org-id>

   • ACTIVE: continue with the next step.
   • PENDING_REVIEW: the platform operator reviews the organization. You get an email when it’s approved. Continue with steps 4 to 6 in the meantime; only step 7 needs an active organization.
   • REJECTED: the decision is final, and you can’t continue.

For what each status allows, see Organization review status.

Step 4: Create a project

1. Create a project:

   origin admin create-project --org-id <org-id> --name "Getting started"

2. Note the project’s urn and projectId in the output. The following steps pass the URN as --project-urn. Example output (illustrative):

   {
     "admin": {
       "createProject": {
         "urn": "urn:origin:cloud:admin::0a1b2c3d4e5f::lumen-482910375",
         "orgId": "0a1b2c3d4e5f",
         "projectId": "lumen-482910375",
         "name": "Getting started"
       }
     }
   }

Step 5: Add a payment method

A new project is charged to your organization’s default billing account. Launching an instance is refused with PAYMENT_METHOD_REQUIRED until that billing account has a verified payment method.

You start the setup through the API, enter the card on the payment provider’s page, and confirm it through the API. You need the roles/billing/administrator role, which you got in step 2, the orgId from step 2 and the projectId from step 4. The requests below are the same as on Add a payment method, which also covers failures and replacing a card.

1. Find the billing account the project is charged to, and its current status:

   curl -sS https://api.origincloud.eu/graphql \
     -H "$(origin id token --as-header --raw)" \
     -H "Content-Type: application/json" \
     --data @- <<'EOF'
   {
     "query": "query($org: OrgId!, $p: ProjectId!) { admin { project(orgId: $org, projectId: $p) { billingAccountId } billingAccounts(input: {orgId: $org}) { billingAccountId displayName paymentMethodStatus } } }",
     "variables": { "org": "<org-id>", "p": "<project-id>" }
   }
   EOF

   Note the project’s billingAccountId. If that billing account’s paymentMethodStatus is already VERIFIED or NOT_REQUIRED, skip to step 6.

2. Start the setup on that billing account:

   curl -sS https://api.origincloud.eu/graphql \
     -H "$(origin id token --as-header --raw)" \
     -H "Content-Type: application/json" \
     --data @- <<'EOF'
   {
     "query": "mutation($org: OrgId!, $ba: BillingAccountId!) { admin { startPaymentMethodSetup(input: {orgId: $org, id: $ba}) { redirectUrl } } }",
     "variables": { "org": "<org-id>", "ba": "<billing-account-id>" }
   }
   EOF

3. Open the redirectUrl from the response in your browser and enter the card details. When you finish, the page returns you to the Origin Cloud console.

4. Confirm the setup:

   curl -sS https://api.origincloud.eu/graphql \
     -H "$(origin id token --as-header --raw)" \
     -H "Content-Type: application/json" \
     --data @- <<'EOF'
   {
     "query": "mutation($org: OrgId!, $ba: BillingAccountId!) { admin { confirmPaymentMethodSetup(input: {orgId: $org, id: $ba}) { paymentMethodStatus paymentMethodBrand paymentMethodLast4 } } }",
     "variables": { "org": "<org-id>", "ba": "<billing-account-id>" }
   }
   EOF

5. Verify that paymentMethodStatus in the response is VERIFIED. If the confirmation fails with BAD_REQUEST, see If the confirmation fails.

Step 6: Create a key pair

The instance accepts SSH logins only with the key pair you name at launch. In this step you create a key on your computer and import its public half.

1. Create a key on your computer:

   ssh-keygen -t ed25519 -f ~/.ssh/origin-getting-started -C getting-started

2. Import the public key into your project:

   origin compute import-key-pair \
     --project-urn <project-urn> \
     --name getting-started \
     --public-key "$(cat ~/.ssh/origin-getting-started.pub)"

3. Note the key pair’s urn in the output.

The private key never leaves your computer. To have the platform generate a key pair instead, see Create a key pair.

Step 7: Launch an instance

1. Choose an instance type. Pick one whose available is true, for example gp1.core.2, the smallest type on sale:

   origin compute list-instance-types

2. Choose an image. The list contains the platform-provided images and any of your own. Platform-provided images have the __typename ComputePublicImage. Pick one by its description, and note its urn and defaultUser:

   origin compute list-images --project-urn <project-urn>

3. Launch the instance. Without --subnet-urn, it goes into the project’s default VPC, which the platform creates now, with an internet gateway and a public address for the instance:

   origin compute launch-instance \
     --project-urn <project-urn> \
     --image-urn <image-urn> \
     --key-pair-urn <key-pair-urn> \
     --instance-type gp1.core.2

4. Note the instance’s urn and loginUser in the output. Example output (illustrative):

   {
     "compute": {
       "launchInstance": {
         "urn": "urn:origin:cloud:compute:eu-central1:0a1b2c3d4e5f:lumen-482910375:i-79PVin5MmNc",
         "instanceId": "i-79PVin5MmNc",
         "instanceType": "gp1.core.2",
         "loginUser": "cloud",
         "status": "INITIALIZING"
       }
     }
   }

5. Wait until the instance is running. Repeat this command until status is RUNNING:

   origin compute get-instance --instance-urn <instance-urn>

   The instance passes through INITIALIZING and PENDING first. To poll every 10 seconds until it stops changing, with jq:

   while :; do
     status="$(origin compute get-instance --instance-urn <instance-urn> \
       | jq -r '[.. | .status? | strings] | first')"
     echo "$status"
     case "$status" in RUNNING | FAILED) break ;; esac
     sleep 10
   done

   If the status is FAILED, read the instance’s statusReason and look it up in Status reasons, then terminate the instance and launch again. If the host never confirms the start, an instance can stay PENDING for about 30 minutes before it becomes FAILED. See Instance lifecycle.

If the launch is refused, the error code tells you why. See Error codes. A refused launch creates nothing and costs nothing.

Retry the same launch every 5 to 10 minutes. If a larger type such as gp1.core.4 is available, launching that type instead may succeed sooner.

Step 8: Connect to the instance

The default VPC’s security group allows SSH from anywhere, so no firewall change is needed. Logins need the key pair’s private key; passwords are refused. To allow SSH from your own address only, see Security groups.

1. Find the instance’s public address. The platform assigned it as a Floating IP at launch; in a new project, it’s the only one listed. Note its address:

   origin network list-floating-ips --project-urn <project-urn>

   If the project already has other Floating IPs, match the address to the instance’s network interface. With jq:

   nic="$(origin compute get-instance --instance-urn <instance-urn> \
     | jq -r '[.. | .networkInterfaceAttachments? // empty | .[].networkInterfaceUrn] | first')"
   origin network list-floating-ips --project-urn <project-urn> \
     | jq -r --arg nic "$nic" '.. | objects | select(.networkInterfaceUrn? == $nic) | .address'

   If the list is empty, the platform couldn’t assign a public address, for example because the public IP quota is used up. See Limits.

2. Log in as the instance’s loginUser, which you noted in step 7, with the private key from step 6:

   ssh -i ~/.ssh/origin-getting-started <login-user>@<public-address>

   RUNNING means the host started the instance; it doesn’t prove the guest’s network is up yet. If the login times out right after launch, wait a moment and try again. If it keeps failing, see Can’t connect over SSH.

3. Verify that you’re on the instance. The login user has passwordless sudo:

   sudo whoami

   Example output (illustrative):

   root

Clean up

Remove what you created so it stops costing money.

1. Terminate the instance. Its root volume and network interface are deleted, and the auto-assigned public address is released with it:

   origin compute terminate-instance --instance-urn <instance-urn>

2. Delete the key pair:

   origin compute delete-key-pair --key-pair-urn <key-pair-urn>

3. Verify that the instance reaches TERMINATED:

   origin compute get-instance --instance-urn <instance-urn>

The default VPC stays in the project. It costs nothing, and the next launch without a subnet reuses it. To delete the project as well, delete the default VPC first with origin network delete-vpc, then the project. See Manage projects.

Next steps

• Compute: instance lifecycle, images and instance types.
• Storage: add volumes and take snapshots.
• Network: build your own VPC with private subnets.
• IAM: invite your team and assign roles.
• Service accounts: automate with the API.