Skip to main content
A Coreflux account is how you see every broker your organization has registered, and how the HUB connects to those brokers without a local password. The account lives at portal.coreflux.org. The HUB only displays the fleet and opens a broker; registration, licensing, and enrollment stay in the portal.
Like a key cabinet for the sites you run. Signing in shows the labeled keys (the fleet). Taking a key opens that site. Cutting a new key, or deciding who may hold one, still happens at the front desk — the portal.

​
When to use an account

The login card shows This machine and Coreflux Fleet as two tabs. This machine is the default once this HUB has any saved connection. Otherwise the card opens on Coreflux Fleet. The tabs are hidden while you are editing a connection.
The fleet list is read-only. Nothing on it is starred, edited, or stored as a saved connection.

​
Sign in

The desktop app signs in with no extra configuration. It talks to portal.coreflux.org.
1

Open Coreflux Fleet

On the login card, select Coreflux Fleet.
2

Sign in with Coreflux

Click Sign in with Coreflux. The HUB opens the account sign-in page in your browser and returns to the HUB when it finishes. The card then shows Signed in as and your display name.
3

Sign out

Sign out on that line ends the HUB session. It does not delete saved connections on This machine.
If credential storage is off, the card adds this session only; credential storage is off. You sign in again after the next launch.
Signed in as shows your display name: preferred_username from the account token, or your email when that claim is absent. The status bar and the account menu use the same name.

​
The fleet list

After sign-in the card shows FLEET BROKERS and the count on the same line, for example FLEET BROKERS 4.
  • Organization — A dropdown appears only when the account belongs to more than one organization. All organizations lists every membership.
  • Refresh — Loads the list again.
  • Register broker — Opens the portal. With one organization, or with one selected in the dropdown, that is the organization’s fleet page (/orgs/…/fleet on the portal). All organizations opens the portal home so you can pick.
  • Sign out — Ends the account session.
Each row is a broker the platform reported. The HUB does not invent the badges: A row the HUB can address has Connect. A row that still needs enrollment has Enrol in portal. Anything else with no address has Open in portal. Address lines:
  • A readable host is shown as protocol://host:port.
  • A Cloud broker with no address yet reads No address yet — assigned when the deploy finishes.
  • Any other broker with no address reads No address registered — add one in the portal.
Empty fleet: No connections available yet, with Register broker. The platform did not answer: Can’t reach the Coreflux platform. Your saved connections are unaffected. Retry loads the list again. Saved connections on This machine stay usable. If some organizations loaded and others did not, the rows that loaded stay, with Couldn’t load brokers for . Connect does not copy the broker into This machine. The next time you want that broker from the fleet, you sign in and connect again. A broker you also saved by hand remains a separate card.

​
What Connect sends

Connect uses your account access token as the MQTT password. The broker must have OIDC bearer authentication enabled, and its organization binding must include your account. Until enrollment finishes, the broker still accepts local usernames and refuses account tokens. That is the link between the products:
  1. You register and license the broker at portal.coreflux.org.
  2. You enroll the broker so it learns the organization id (License tab or -enroll).
  3. The fleet lists that broker for accounts in the organization.
  4. Connect presents the account token. The broker maps the token’s groups into LoT rules.
The portal’s own screens are not documented here. Register broker, Enrol in portal, and Open in portal leave the HUB and open the portal.

​
Cloud mode and a HUB you run yourself

Two different “cloud” words show up: Desktop and self-hosted HUB builds connect to the broker URL you asked for. That is This machine (the host and port you saved) and Coreflux Fleet (the address the platform returned). Cloud mode is on only when the HUB process has HUB_CLOUD_MODE set to true or 1. It also needs HUB_CLOUD_BASE_DOMAIN (the regional suffix, such as eu1.coreflux.cloud). The proxy then accepts only mqtts:// URLs whose host is a single name under that suffix, on HUB_CLOUD_BROKER_PORT (default 8883). Any other scheme, port, or region is rejected. If Cloud mode is on and HUB_CLOUD_BASE_DOMAIN is missing, every connection is rejected. Do not enable Cloud mode on a desktop app or a HUB container you use to reach a broker on your own network. Those installs leave HUB_CLOUD_MODE unset. Account sign-in and Cloud mode are independent. A self-hosted HUB can show Sign in with Coreflux with Cloud mode off, as long as the browser sign-in variables above are set and the brokers accept account tokens.

​
Limits

The HUB does not register brokers, issue licenses, or complete enrollment by itself. Those stay at portal.coreflux.org. A fleet row without an address cannot be connected until the portal has one.
  • Fleet rows are not editable, and Connect does not save a connection.
  • Signing in from the connection editor leaves the page and drops an unsaved draft.
  • Sign out ends the HUB session. The account provider’s own browser session can still be active, so the next Sign in with Coreflux may not ask for a password.
  • The web HUB cannot show token subject or expiry in the connection editor. The browser does not hold the token.

​
Next Steps

OIDC and Bearer Authentication

Configure the broker so an account access token is accepted at MQTT CONNECT.

Licensing and Enrollment

Activate a license and bind the broker to the organization the fleet lists.
Last modified on October 21, 2026