> ## Documentation Index > Fetch the complete documentation index at: https://docs.coreflux.org/llms.txt > Use this file to discover all available pages before exploring further. # Account, Fleet, and Cloud Mode > Sign in to Coreflux HUB with an organization account, open brokers from the fleet, and see how Cloud mode differs from a HUB you run yourself A Coreflux account is how you see every broker your organization has registered, and how the HUB connects to those brokers without a local password. The account lives at [portal.coreflux.org](https://portal.coreflux.org). The HUB only displays the fleet and opens a broker; registration, licensing, and enrollment stay in the portal. > [!TIP] > > **Like a key cabinet for the sites you run.** Signing in shows the labeled keys (the fleet). Taking a key opens that site. Cutting a new key, or deciding who may hold one, still happens at the front desk — the portal. ## When to use an account | You want to… | Use | | - | - | | Open a broker you saved by host, port, and username | **This machine** on the login card. Those connections stay in this HUB. They do not need an account | | See brokers the organization registered, and connect as yourself | **Coreflux Fleet**, after **Sign in with Coreflux** | | Activate a license or enroll a broker you are already connected to | [System Config → License](/hub/system/configuration#license). The portal issues the code or token; the HUB sends it to the broker | The login card shows **This machine** and **Coreflux Fleet** as two tabs. **This machine** is the default once this HUB has any saved connection. Otherwise the card opens on **Coreflux Fleet**. The tabs are hidden while you are editing a connection. *** The fleet list is read-only. Nothing on it is starred, edited, or stored as a saved connection. ## Sign in **Desktop HUB** The desktop app signs in with no extra configuration. It talks to [portal.coreflux.org](https://portal.coreflux.org). **1. Open Coreflux Fleet** On the login card, select **Coreflux Fleet**. **2. Sign in with Coreflux** Click **Sign in with Coreflux**. The HUB opens the account sign-in page in your browser and returns to the HUB when it finishes. The card then shows **Signed in as** and your display name. **3. Sign out** **Sign out** on that line ends the HUB session. It does not delete saved connections on **This machine**. If credential storage is off, the card adds **this session only; credential storage is off**. You sign in again after the next launch. **Browser HUB** A HUB you open in a browser shows **Sign in with Coreflux** only when the HUB server has all three of these set: | Variable | Role | | - | - | | `COREFLUX_OIDC_CLIENT_ID` | Account client the HUB uses to sign in | | `HUB_PUBLIC_URL` | Origin users type in the browser, with no trailing slash. The HUB's callback is `{HUB_PUBLIC_URL}/api/account/callback`, and that exact URL must be registered for the account client | | `HUB_SESSION_SECRET` | Encrypts the session cookie. At least 32 characters. Use the same value on every replica. Changing it signs everyone out | `COREFLUX_OIDC_CLIENT_SECRET` is optional and only for a confidential client. The desktop app ignores these variables. To use the HUB assistant in a browser HUB, also set `HUB_AGENT_ALLOWED_HOSTS`. See [Allowed hosts in a browser HUB](/hub/ai-assistant#allowed-hosts-in-a-browser-hub). The browser never receives the access token. If the session has expired, the HUB reports **Your Coreflux session has expired — sign in again.** If the three variables are missing, a fleet connect reports **Coreflux sign-in is not enabled on this Hub.** **Signed in as** shows your display name: `preferred_username` from the account token, or your email when that claim is absent. The status bar and the account menu use the same name. ## The fleet list After sign-in the card shows **FLEET BROKERS** and the count on the same line, for example **FLEET BROKERS 4**. * **Organization** — A dropdown appears only when the account belongs to more than one organization. **All organizations** lists every membership. * **Refresh** — Loads the list again. * **Register broker** — Opens the portal. With one organization, or with one selected in the dropdown, that is the organization's fleet page (`/orgs/…/fleet` on the portal). **All organizations** opens the portal home so you can pick. * **Sign out** — Ends the account session. Each row is a broker the platform reported. The HUB does not invent the badges: | Badge | Meaning | | - | - | | **Online**, **Offline**, **Never reported** | An enrolled broker, from the platform's liveness | | **Enrolling**, **Registered**, **Un-enrolled**, **Requested**, **Deploying**, **Failed**, **Removed** | Any other phase the platform sent | | **Trial**, **Trial (Growth)**, or **Licensed (Growth)** | The platform's licence bucket. A plan name, when the platform sent one, appears in parentheses | | **Cloud** or **Self-hosted** | Where that broker runs | A row the HUB can address has **Connect**. A row that still needs enrollment has **Enrol in portal**. Anything else with no address has **Open in portal**. Address lines: * A readable host is shown as `protocol://host:port`. * A **Cloud** broker with no address yet reads **No address yet — assigned when the deploy finishes**. * Any other broker with no address reads **No address registered — add one in the portal**. Empty fleet: **No connections available yet**, with **Register broker**. The platform did not answer: **Can't reach the Coreflux platform. Your saved connections are unaffected.** **Retry** loads the list again. Saved connections on **This machine** stay usable. If some organizations loaded and others did not, the rows that loaded stay, with **Couldn't load brokers for {names}.** **Connect** does not copy the broker into **This machine**. The next time you want that broker from the fleet, you sign in and connect again. A broker you also saved by hand remains a separate card. ## What Connect sends **Connect** uses your account access token as the MQTT password. The broker must have [OIDC bearer authentication](/latest/mqtt-broker/oidc-authentication) enabled, and its organization binding must include your account. Until [enrollment](/latest/mqtt-broker/licensing) finishes, the broker still accepts local usernames and refuses account tokens. That is the link between the products: 1. You register and license the broker at [portal.coreflux.org](https://portal.coreflux.org). 2. You enroll the broker so it learns the organization id ([License tab](/hub/system/configuration#license) or `-enroll`). 3. The fleet lists that broker for accounts in the organization. 4. **Connect** presents the account token. The broker maps the token's groups into LoT rules. The portal's own screens are not documented here. **Register broker**, **Enrol in portal**, and **Open in portal** leave the HUB and open the portal. ## Cloud mode and a HUB you run yourself Two different "cloud" words show up: | Name | What it is | What you do | | - | - | - | | **Cloud** badge on a fleet row | The broker is hosted for you. **Self-hosted** means the broker runs on infrastructure you operate | Read the badge. You do not set it in the HUB | | **Cloud mode** on the HUB process | A shared regional HUB. Its MQTT proxy only dials brokers in that region | Leave it off on the desktop app and on a HUB you install beside your own broker | Desktop and self-hosted HUB builds connect to the broker URL you asked for. That is **This machine** (the host and port you saved) and **Coreflux Fleet** (the address the platform returned). Cloud mode is on only when the HUB process has `HUB_CLOUD_MODE` set to `true` or `1`. It also needs `HUB_CLOUD_BASE_DOMAIN` (the regional suffix, such as `eu1.coreflux.cloud`). The proxy then accepts only `mqtts://` URLs whose host is a single name under that suffix, on `HUB_CLOUD_BROKER_PORT` (default `8883`). Any other scheme, port, or region is rejected. If Cloud mode is on and `HUB_CLOUD_BASE_DOMAIN` is missing, every connection is rejected. Do not enable Cloud mode on a desktop app or a HUB container you use to reach a broker on your own network. Those installs leave `HUB_CLOUD_MODE` unset. Account sign-in and Cloud mode are independent. A self-hosted HUB can show **Sign in with Coreflux** with Cloud mode off, as long as the browser sign-in variables above are set and the brokers accept account tokens. *** ## Limits > [!WARNING] > > The HUB does not register brokers, issue licenses, or complete enrollment by itself. Those stay at [portal.coreflux.org](https://portal.coreflux.org). A fleet row without an address cannot be connected until the portal has one. * Fleet rows are not editable, and **Connect** does not save a connection. * Signing in from the connection editor leaves the page and drops an unsaved draft. * **Sign out** ends the HUB session. The account provider's own browser session can still be active, so the next **Sign in with Coreflux** may not ask for a password. * The web HUB cannot show token subject or expiry in the connection editor. The browser does not hold the token. ## Next Steps > **[OIDC and Bearer Authentication](/latest/mqtt-broker/oidc-authentication)** > > Configure the broker so an account access token is accepted at MQTT CONNECT. > **[Licensing and Enrollment](/latest/mqtt-broker/licensing)** > > Activate a license and bind the broker to the organization the fleet lists. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.