# Get started with Origin Cloud

Register an organization, add a payment method, launch your first instance with the origin CLI, log in to it over SSH, and clean up afterwards.

This tutorial takes you from a new user account to a running Linux instance you log in to over SSH. You use the `origin` CLI for almost every step and the GraphQL API for the payment method.

## What you’ll build [#what-youll-build]

You’ll end up with an organization that holds one project. In the project runs one instance, in the project’s default VPC, with a public IPv4 address that you connect to over SSH.

The following diagram shows the end state.

<Diagram
  name="getting-started"
  alt="Your computer connects over SSH to the instance's public address. The instance runs in the default VPC of a project, inside your organization."
/>

## What you’ll learn [#what-youll-learn]

- How to install the CLI and log in.
- How to register an organization and read its review status.
- How to create a project and add a payment method.
- How to import a key pair, launch an instance and log in to it.
- How to remove what you created.

## Before you begin [#before-you-begin]

<BeforeYouBegin>

- An Origin Cloud user account. If you don’t have one, see [Step 0: Create your account](#step-0-create-your-account).
- A Linux or macOS computer with `ssh`, `ssh-keygen` and `curl`.
- Your company’s billing details: postal address, invoice email address, contact person and, outside Germany, a VAT identification number. The billing address must be in an EU member state.
- A credit or debit card for the payment method.

</BeforeYouBegin>

## Cost [#cost]

The instance, its root volume and its public IPv4 address are billable for as long as they exist. Registering an organization, creating a project and the default VPC cost nothing. If you follow [Clean up](#clean-up) right after the tutorial, you pay for a few minutes of usage. For current rates, see [Pricing](/docs/pricing).

At list prices of 13 October 2026, in EUR excluding VAT, 15 minutes cost about €0.02:

| Item | List price | 15 minutes |
| --- | --- | --- |
| Instance, `gp1.core.2` | €0.0551 per hour | about €0.014 |
| Root volume, `gp1`, for example 20 GiB | €0.00009589 per GiB-hour | about €0.0005 |
| Public IPv4 address (Floating IP) | €0.00009537 per minute | about €0.0014 |

The root volume’s size is the image’s own size. Metric samples the platform collects from the running instance, and traffic out to the internet (€0.09 per GB), add fractions of a cent here.

## Step 0: Create your account [#step-0-create-your-account]

Create your Origin Cloud user account at [console.origincloud.eu](https://console.origincloud.eu). The CLI, the API and the console all use this account: in step 1 you log in to the CLI with it.

## Step 1: Install the CLI and log in [#step-1-install-the-cli-and-log-in]

1. Install the `origin` CLI. See [Install the CLI](/docs/platform/access/cli#install-the-cli).
1. Log in. Your browser opens the Origin Cloud login page:

   ```sh
   origin id login
   ```

   On a machine without a browser, use `origin id login --device` instead. See [Log in](/docs/platform/access/cli#log-in).

## Step 2: Register your organization [#step-2-register-your-organization]

1. Register the organization with its billing details. Add `--vat-id <vat-id>` if the billing address is outside Germany:

   ```sh
   origin admin register-organisation \
     --name "Example GmbH" \
     --street "Example Street 1" \
     --city Berlin \
     --postal-code 10115 \
     --country DE \
     --invoice-email billing@example.com \
     --contact-person "Jane Doe"
   ```

1. Note the `orgId` in the output, for example `0a1b2c3d4e5f`. You’re now the organization’s Owner and its billing administrator.

For details and the other way to create an organization, see [Create an organization](/docs/platform/organizations/create).

## Step 3: Check the review status [#step-3-check-the-review-status]

1. Read the organization’s status:

   ```sh
   origin admin get-organisation --id <org-id>
   ```

   - `ACTIVE`: continue with the next step.
   - `PENDING_REVIEW`: the platform operator reviews the organization. You get an email when it’s approved. Continue with steps 4 to 6 in the meantime; only step 7 needs an active organization.
   - `REJECTED`: the decision is final, and you can’t continue.

For what each status allows, see [Organization review status](/docs/platform/organizations/review-status).

## Step 4: Create a project [#step-4-create-a-project]

1. Create a project:

   ```sh
   origin admin create-project --org-id <org-id> --name "Getting started"
   ```

1. Note the project’s `urn` and `projectId` in the output. The following steps pass the URN as `--project-urn`. Example output (illustrative):

   ```json
   {
     "admin": {
       "createProject": {
         "urn": "urn:origin:cloud:admin::0a1b2c3d4e5f::lumen-482910375",
         "orgId": "0a1b2c3d4e5f",
         "projectId": "lumen-482910375",
         "name": "Getting started"
       }
     }
   }
   ```

## Step 5: Add a payment method [#step-5-add-a-payment-method]

A new project is charged to your organization’s default billing account. Launching an instance is refused with `PAYMENT_METHOD_REQUIRED` until that billing account has a verified payment method.

You start the setup through the API, enter the card on the payment provider’s page, and confirm it through the API. You need the `roles/billing/administrator` role, which you got in step 2, the `orgId` from step 2 and the `projectId` from step 4. The requests below are the same as on [Add a payment method](/docs/platform/billing/payment-method), which also covers failures and replacing a card.

1. Find the billing account the project is charged to, and its current status:

   ```sh
   curl -sS https://api.origincloud.eu/graphql \
     -H "$(origin id token --as-header --raw)" \
     -H "Content-Type: application/json" \
     --data @- <<'EOF'
   {
     "query": "query($org: OrgId!, $p: ProjectId!) { admin { project(orgId: $org, projectId: $p) { billingAccountId } billingAccounts(input: {orgId: $org}) { billingAccountId displayName paymentMethodStatus } } }",
     "variables": { "org": "<org-id>", "p": "<project-id>" }
   }
   EOF
   ```

   Note the project’s `billingAccountId`. If that billing account’s `paymentMethodStatus` is already `VERIFIED` or `NOT_REQUIRED`, skip to step 6.

1. Start the setup on that billing account:

   ```sh
   curl -sS https://api.origincloud.eu/graphql \
     -H "$(origin id token --as-header --raw)" \
     -H "Content-Type: application/json" \
     --data @- <<'EOF'
   {
     "query": "mutation($org: OrgId!, $ba: BillingAccountId!) { admin { startPaymentMethodSetup(input: {orgId: $org, id: $ba}) { redirectUrl } } }",
     "variables": { "org": "<org-id>", "ba": "<billing-account-id>" }
   }
   EOF
   ```

1. Open the `redirectUrl` from the response in your browser and enter the card details. When you finish, the page returns you to the Origin Cloud console.

   <Callout type="warning" title="You’re not done yet">

   Returning to the console doesn’t activate the card. You must still run the confirm request in the next step. Until you do, `paymentMethodStatus` stays `NONE` and step 7 fails with `PAYMENT_METHOD_REQUIRED`.

   </Callout>

1. Confirm the setup:

   ```sh
   curl -sS https://api.origincloud.eu/graphql \
     -H "$(origin id token --as-header --raw)" \
     -H "Content-Type: application/json" \
     --data @- <<'EOF'
   {
     "query": "mutation($org: OrgId!, $ba: BillingAccountId!) { admin { confirmPaymentMethodSetup(input: {orgId: $org, id: $ba}) { paymentMethodStatus paymentMethodBrand paymentMethodLast4 } } }",
     "variables": { "org": "<org-id>", "ba": "<billing-account-id>" }
   }
   EOF
   ```

1. Verify that `paymentMethodStatus` in the response is `VERIFIED`. If the confirmation fails with `BAD_REQUEST`, see [If the confirmation fails](/docs/platform/billing/payment-method#if-the-confirmation-fails).

## Step 6: Create a key pair [#step-6-create-a-key-pair]

The instance accepts SSH logins only with the key pair you name at launch. In this step you create a key on your computer and import its public half.

1. Create a key on your computer:

   ```sh
   ssh-keygen -t ed25519 -f ~/.ssh/origin-getting-started -C getting-started
   ```

1. Import the public key into your project:

   ```sh
   origin compute import-key-pair \
     --project-urn <project-urn> \
     --name getting-started \
     --public-key "$(cat ~/.ssh/origin-getting-started.pub)"
   ```

1. Note the key pair’s `urn` in the output.

The private key never leaves your computer. To have the platform generate a key pair instead, see [Create a key pair](/docs/compute/key-pairs/create).

## Step 7: Launch an instance [#step-7-launch-an-instance]

1. Choose an instance type. Pick one whose `available` is `true`, for example `gp1.core.2`, the smallest type on sale:

   ```sh
   origin compute list-instance-types
   ```

1. Choose an image. The list contains the platform-provided images and any of your own. Platform-provided images have the `__typename` `ComputePublicImage`. Pick one by its `description`, and note its `urn` and `defaultUser`:

   ```sh
   origin compute list-images --project-urn <project-urn>
   ```

1. Launch the instance. Without `--subnet-urn`, it goes into the project’s default VPC, which the platform creates now, with an internet gateway and a public address for the instance:

   ```sh
   origin compute launch-instance \
     --project-urn <project-urn> \
     --image-urn <image-urn> \
     --key-pair-urn <key-pair-urn> \
     --instance-type gp1.core.2
   ```

1. Note the instance’s `urn` and `loginUser` in the output. Example output (illustrative):

   ```json
   {
     "compute": {
       "launchInstance": {
         "urn": "urn:origin:cloud:compute:eu-central1:0a1b2c3d4e5f:lumen-482910375:i-79PVin5MmNc",
         "instanceId": "i-79PVin5MmNc",
         "instanceType": "gp1.core.2",
         "loginUser": "cloud",
         "status": "INITIALIZING"
       }
     }
   }
   ```

1. Wait until the instance is running. Repeat this command until `status` is `RUNNING`:

   ```sh
   origin compute get-instance --instance-urn <instance-urn>
   ```

   The instance passes through `INITIALIZING` and `PENDING` first. To poll every 10 seconds until it stops changing, with `jq`:

   ```sh
   while :; do
     status="$(origin compute get-instance --instance-urn <instance-urn> \
       | jq -r '[.. | .status? | strings] | first')"
     echo "$status"
     case "$status" in RUNNING | FAILED) break ;; esac
     sleep 10
   done
   ```

   If the status is `FAILED`, read the instance’s `statusReason` and look it up in [Status reasons](/docs/compute/reference/status-reasons), then terminate the instance and launch again. If the host never confirms the start, an instance can stay `PENDING` for about 30 minutes before it becomes `FAILED`. See [Instance lifecycle](/docs/compute/instances/lifecycle#when-a-lifecycle-operation-fails).

If the launch is refused, the error code tells you why. See [Error codes](/docs/platform/reference/errors). A refused launch creates nothing and costs nothing.

<CapacityAdvice />

Retry the same launch every 5 to 10 minutes. If a larger type such as `gp1.core.4` is `available`, launching that type instead may succeed sooner.

## Step 8: Connect to the instance [#step-8-connect-to-the-instance]

The default VPC’s security group allows SSH from anywhere, so no firewall change is needed. Logins need the key pair’s private key; passwords are refused. To allow SSH from your own address only, see [Security groups](/docs/network/traffic-control/security-groups).

1. Find the instance’s public address. The platform assigned it as a Floating IP at launch; in a new project, it’s the only one listed. Note its `address`:

   ```sh
   origin network list-floating-ips --project-urn <project-urn>
   ```

   If the project already has other Floating IPs, match the address to the instance’s network interface. With `jq`:

   ```sh
   nic="$(origin compute get-instance --instance-urn <instance-urn> \
     | jq -r '[.. | .networkInterfaceAttachments? // empty | .[].networkInterfaceUrn] | first')"
   origin network list-floating-ips --project-urn <project-urn> \
     | jq -r --arg nic "$nic" '.. | objects | select(.networkInterfaceUrn? == $nic) | .address'
   ```

   If the list is empty, the platform couldn’t assign a public address, for example because the public IP quota is used up. See [Limits](/docs/platform/reference/limits).

1. Log in as the instance’s `loginUser`, which you noted in step 7, with the private key from step 6:

   ```sh
   ssh -i ~/.ssh/origin-getting-started <login-user>@<public-address>
   ```

   `RUNNING` means the host started the instance; it doesn’t prove the guest’s network is up yet. If the login times out right after launch, wait a moment and try again. If it keeps failing, see [Can’t connect over SSH](/docs/compute/troubleshooting#cant-connect-over-ssh).

1. Verify that you’re on the instance. The login user has passwordless `sudo`:

   ```sh
   sudo whoami
   ```

   Example output (illustrative):

   ```text
   root
   ```

## Clean up [#clean-up]

Remove what you created so it stops costing money.

1. Terminate the instance. Its root volume and network interface are deleted, and the auto-assigned public address is released with it:

   ```sh
   origin compute terminate-instance --instance-urn <instance-urn>
   ```

1. Delete the key pair:

   ```sh
   origin compute delete-key-pair --key-pair-urn <key-pair-urn>
   ```

1. Verify that the instance reaches `TERMINATED`:

   ```sh
   origin compute get-instance --instance-urn <instance-urn>
   ```

The default VPC stays in the project. It costs nothing, and the next launch without a subnet reuses it. To delete the project as well, delete the default VPC first with `origin network delete-vpc`, then the project. See [Manage projects](/docs/platform/organizations/projects).

## Next steps [#next-steps]

- [Compute](/docs/compute): instance lifecycle, images and instance types.
- [Storage](/docs/storage): add volumes and take snapshots.
- [Network](/docs/network): build your own VPC with private subnets.
- [IAM](/docs/iam): invite your team and assign roles.
- [Service accounts](/docs/iam/service-accounts): automate with the API.