Setting up Layer5 Account

This guide will walk you through setting up your Layer5 account, and through the profile, password, linked sign-in, account deletion, and subscription settings that belong to that account.

Configuring your Layer5 account 🔗

The first steps in starting with Layer5 are to create an account, verify your email, sign in, and view your profile. You do not name an organization or a workspace yourself. Layer5 Cloud creates an organization, a team, and a workspace the first time the new account signs in successfully. Submitting the sign-up form alone does not create them. An email sign-up signs you in immediately, so that first sign-in happens as part of registration. The Check your email page and the Import from GitHub first-run page described below arrived in Layer5 Cloud v1.0.278.

Every person who uses Layer5 Cloud has their own personal account, which can be part of multiple organizations and teams. Your personal account is your identity on Layer5 Cloud and represents you as an individual.

1. Creating an account 🔗

Sign up at https://cloud.layer5.io/signup. The registration page offers these sign-up methods:

What the email sign-up form checks 🔗

The email sign-up form is a single screen that asks for your first name, last name, email address, and password. Layer5 Cloud validates each field and keeps what you typed when it shows an error, so you only correct the field at fault.

When the deployment has a reCAPTCHA check enabled, the submit button stays disabled until you solve it. A field-level validation failure keeps your solved captcha. If the server rejects the whole submission after the captcha was sent, the captcha resets and asks you to “Please complete the verification again.” If the network fails, the page shows “We couldn’t submit your sign-up. Check your connection and try again.”

GitHub and Google sign-up skip the spam filter and the captcha.

The sign-up form stays valid for 24 hours. If you leave it open longer, it restarts and you fill it in again.

2. Verifying your email address 🔗

After an email sign-up, Layer5 Cloud signs you in and sends a verification email that contains both a verification link and a verification code. Either one completes verification. Both stay valid for 720 hours (30 days). You cannot use your account, or sign in again with your password, until you verify your address.

Opening the link verifies your address at once. You do not need to type the code or press a button. Layer5 Cloud then takes you back to the page you started signing up from, or to your dashboard if you opened the sign-up page directly. If the link has expired or was already used, the verification page says so and lets you request a new email.

Your browser lands on a Check your email page that says you are signed in and names the address the verification email went to. You can wait on this page:

• Resend email sends a new verification email without leaving the page. Once it is sent, the page also offers a form where you type the code from the new email instead of opening its link.
• Sign out and use a different email signs you out so you can sign up again with the correct address. Use it if you mistyped your address. An account cannot change its email address before that address is verified, so signing up again with the correct address is the fix.

The page remembers your address only in the browser tab you signed up in. If you open Check your email in a different tab, or your browser blocks site storage, the page shows generic text instead of your address. Resend email then opens the verification page, which asks for your address before it sends a new email.

If your organization uses a custom domain, the verification link, the page it opens, and the return afterward all stay on your organization’s domain, with your organization’s name and logo.

If your link has expired, request a new verification email and use the latest link.

3. Signing in to Layer5 Cloud 🔗

Sign in at https://cloud.layer5.io/login with the method you signed up with. If you signed up with GitHub or Google, Layer5 Cloud sends you to that provider to authenticate. The sign-in form stays valid for 12 hours. An expired form restarts.

You are not asked to name an organization or a workspace. Layer5 Cloud creates both, and your default team, on your first successful sign-in, as described in the next steps.

Where your first sign-in takes you 🔗

Your first sign-in normally opens your dashboard. One exception applies: if you started signing up from Kanvas, or from a Meshery Server on your organization’s custom domain, and you registered in this browser, your first sign-in opens the Import from GitHub page (titled “Get started”) once. If the sign-in carries an explicit return address, Layer5 Cloud sends you there instead.

The Import from GitHub page holds one card. It explains that connecting GitHub lets you pick repositories and import Kubernetes manifests, Helm charts, and Docker Compose files as designs. It also names your organization and workspace: “Organizations own workspaces. You’re in My Organization, working in My Workspace. Rename either anytime.” Select Import from GitHub to start the GitHub integration wizard, or skip to your dashboard.

4. Your default organization 🔗

Organizations are the unit of tenancy in Layer5 Cloud, and every user belongs to at least one. On your first sign-in, Layer5 Cloud creates an organization named My Organization (description “Default Organization”), makes you its owner, and gives you the Organization Admin role in it. You can create more organizations and join existing ones.

Layer5 Cloud also creates a team named My Team (description “Default Team”), attaches it to My Organization, and gives you the Team Admin role on it.

Layer5 Cloud records your primary email address so that one person signing in by a different method reuses the same account instead of creating a second one. Layer5 Cloud accepts open organization invitation links on every sign-in, not only the first. See Using the open organization invitation link.

You can rename My Organization and change its description at any time. See Editing your organization.

5. Your default workspace 🔗

Workspaces are logical groups of shared resources such as environments, connections, credentials, and designs. On your first sign-in, Layer5 Cloud creates a workspace named My Workspace (description “Default Workspace”) in My Organization, owned by you. You can create more workspaces and share access to their resources through teams. If any of your organizations ever has no workspace, Layer5 Cloud re-creates My Workspace in it.

You can rename My Workspace and change its description at any time. See Edit a Workspace.

Everything your first sign-in sets up 🔗

Your account is ready when you can sign in at https://cloud.layer5.io/login (for an email account, a successful password sign-in also proves your address is verified), your dashboard loads, and My Organization contains My Workspace.

6. Dashboard 🔗

The dashboard is your normal landing page after sign-in, except for the first sign-in described in step 3, which can open the Import from GitHub page. It is a grid of widgets whose layout you can edit. Layer5 Cloud prompts you before you leave with unsaved layout changes. Available widgets include Getting Started, Workspace Activity, Explore Playground, My Academy, Learn by Video, Help Center, Meshery Instances, Kubernetes Clusters Count, Catalog Content Count, Invite Friends, Badges, My Designs, System Version, Catalog Leaderboard, and Catalog Metrics. Academy administrators see additional widgets for Academy content statistics, metrics, test analytics, and registrations.

7. Viewing your Layer5 profile 🔗

Your Layer5 profile tells people the story of your work through recent activities and designs you have published to the catalog. Your avatar, tagline, and social links appear on your public profile. The next sections cover editing that profile, your password, linked sign-in providers, deleting the account, and the organization’s subscription.

Your account settings 🔗

Your profile belongs to you, not to an organization. A change applies in every organization you belong to.

The account area has four tabs: Profile, Preferences, Subscription, and Plans. Each tab opens only for a user who holds its permission. Without the permission, the tab shows a permission-denied view. When the account page is shown inside a Meshery UI that uses Layer5 Cloud as its provider, only the Profile tab appears.

The default user role holds View Profile, Reset Password, and Delete Account, so every member can manage their own account. The subscription permission is spelled View Subcription in the permission list. Use that spelling when you search for it.

• Layer5 Cloud signs you in through an identity service. Password changes and account deletion need a live browser sign-in. A script that holds only an API token cannot do either.
• Changing a password or linking a provider is a privileged action. If your sign-in is older than the privileged-session window, Layer5 Cloud asks you to sign in again first. The window is 24 hours on hosted Layer5 Cloud and 15 minutes by default in the self-hosted chart.
• A user’s profile can also be edited by an administrator who holds Update User Profile in an organization you share with them. Only a Provider Admin can change another user’s email address.

Edit your profile 🔗

The profile form saves itself. About one second after you stop typing, Layer5 Cloud saves the change and confirms it with a short message. There is no Save button, and edits made during a save are queued, not lost.

Change your email address 🔗

Changing the email address changes the identifier you sign in with. Layer5 Cloud marks the new address as unverified and sends it a verification message. The confirmation reads “Profile updated. Please check your new email address to verify it.” Verify the new address before you rely on it. If the verification message cannot be sent, the change still completes.

Layer5 Cloud writes the change to the identity service first and to your profile second, so a rejected address never leaves the two out of step.

Change your password 🔗

Use the Reset Password control on the profile. Enter the new password twice. The two entries must match, or the form reports “Your new passwords do not match”.

The identity service enforces the password policy:

• At least 8 characters.
• Not a password found in known breaches.
• Not too similar to your email address.

A strength bar (Very weak to Strong) shows how guessable the password is. It is advice only and does not block you. The policy above does. A rejected password returns the identity service’s reason. A successful change shows “Password updated”.

Changing your password does not end your other sessions or revoke your API tokens. To cut off a device or script, end the session or revoke the token yourself. See Sessions and Tokens.

If you forgot your password, use the recovery flow from the sign-in page instead. It emails a one-time code and link that stay valid for 30 days. See Support.

Link or unlink a sign-in provider 🔗

Link GitHub or Google to sign in with whichever you prefer. Either method opens the same account, with the same organizations, designs, and roles. GitHub and Google are the only supported providers for linking.

The profile lists a Link option for each provider you have not linked and an Unlink option for each provider you have linked. The provider you used to create the account appears in neither list: you cannot unlink it, and it is already linked.

Linking sends you to the provider to approve access, then returns you to Layer5 Cloud. Layer5 Cloud asks GitHub for your profile and email address and Google for your email and profile. Unlinking removes the provider from your account. Your password and the other linked provider keep working.

A provider account can be linked to one Layer5 Cloud account only. Linking depends on the provider reporting a verified email address. For how Layer5 Cloud resolves sign-ins that share an email address, read Account Consolidation and the Account Linking rules.

Linking a provider is a privileged action, with the same 24 hour hosted window and 15 minute self-hosted default described above.

Delete your account 🔗

Deletion is permanent. Layer5 Cloud asks you to confirm, and then does not offer recovery. You need the Delete Account permission, which the default user role holds, and a live browser sign-in.

What deletion does, in one step that either completes or changes nothing:

1. Hands on every organization and team you own (see Organizations and teams you own).
2. Hands any credential you hold on behalf of an organization to that organization’s owner, or else its longest-standing Organization Admin, so the organization keeps working. For an organization you owned, that is its new owner.
3. Marks your account as deleted and ends your memberships in every organization and team, which removes your roles with them, along with any provider-wide role. Each membership is kept as an ended record, so organization history shows when your access ended.
4. Revokes every API token you created, so none of them works afterwards.
5. Releases your email address, so it can be used to sign up again.
6. Records the deletion, and each organization or team handed on or deleted, in the audit trail.
7. Removes your sign-in identity, including linked GitHub and Google sign-in, and signs you out.

What deletion leaves behind:

• Published content, such as items you published to the catalog, stays public.
• The audit trail keeps its entries.

Organizations and teams you own 🔗

Each organization you own passes to someone who still belongs to it:

1. Its longest-standing Organization Admin, if it has one.
2. Otherwise its longest-standing member.
3. Otherwise, when nobody else belongs to it, the organization is deleted.

“Longest-standing” means the membership that was created first. Members whose own accounts are deleted, and guest (anonymous) accounts, are never chosen. The new owner keeps the roles they already had. Ownership does not change anyone’s roles.

Teams you own follow the same rule, with Team Admin in place of Organization Admin.

An organization that is the parent of another live organization is never deleted this way, because child organizations are never deleted or moved along with their parent. If such an organization has nobody else in it, it keeps you as its owner and the audit trail records why. Your account is still deleted.

When deletion is refused 🔗

Because organizations you own are handed on first, a refusal is rare. Layer5 Cloud refuses the deletion, and changes nothing, when you hold credentials designated to an organization you do not own and that organization has no live owner or Organization Admin to receive them. The message begins “Refusing to delete your account” and names the organization. Without a successor, those credentials would be orphaned.

Resolve it, then retry:

• Ask that organization’s members to promote someone to Organization Admin.
• Or release the credentials from the organization, or delete them.

Signing up again 🔗

Signing up again with the same email address, by email and password or with GitHub or Google, on Layer5 Cloud or on an organization’s custom domain, creates a new, empty account with a new account ID and its own personal organization (or the placement an organization’s open invitation gives any new account). It inherits nothing from the deleted one: no profile, preferences, memberships, roles, or ownership, and no linked sign-in providers. An account is identified by its account ID, not by its email address, so the deleted account cannot be restored this way. To regain access to an organization, ask one of its administrators to invite you again.

Subscriptions and billing 🔗

A subscription connects an organization to a Layer5 plan and bills for it. A subscription belongs to an organization, not to a person. Layer5 Cloud checks the caller against the subscription’s own organization, so administering one organization gives you no access to another organization’s billing. Current prices are on the pricing page.

Who can manage a subscription 🔗

The Subscription and Plans tabs open for any user who holds View Subcription or View Plans. The default user role holds both. A member who is not an owner or Organization Admin can open the tab, but Layer5 Cloud refuses the data behind it, so the subscription table cannot load. For subscriptions that belong to another organization, Layer5 Cloud answers “subscription not found”, the same answer it gives for an id that does not exist.

Read your subscriptions 🔗

The Subscription tab lists each subscription with these columns:

Three summary cards sit above the table: your current plan, the forecasted bill (“Based on current usage”, or “No billable usage” when the amount is zero), and the next payment due.

Layer5 Cloud takes the status from the payment processor. Status changes arrive when the processor reports them, so the tab can trail a payment by a short time. Use the refresh control to reload.

Start a paid subscription 🔗

The Plans tab lists the Personal plan (“Free Forever”), Team Designer, Team Operator, and Enterprise, each with monthly and annual prices and a currency selector.

• Personal is free and needs no subscription step. In entitlement records this plan is named Personal. The Free name is the same plan.
• Team Designer and Team Operator start in the tab. Review the plan, apply a coupon if you have one, and enter your billing address and payment details. The payment form is hosted by the payment processor, and Layer5 Cloud does not store card details.
• Enterprise does not use self-service checkout. Its subscribe action opens a contact form, and the Layer5 team arranges the subscription.

Layer5 Cloud creates the subscription as incomplete, counts your billable users, and asks the payment processor to start billing. The status becomes active when the first payment succeeds. Checkout starts no free trial.

Upgrade a subscription 🔗

Upgrade moves a subscription to a higher plan on the same ladder. Each ladder is separate:

• Monthly core plans, in order: Team Designer, Team Operator, Enterprise.
• Annual core plans, in the same order.
• Academy theory and lab bundles, each with its own monthly and annual ladder.

You cannot move down a ladder, and you cannot switch between monthly and annual billing on an existing subscription. To change cadence or move to a lower plan, contact Support.

Before you confirm, the upgrade shows an invoice preview with the prorated line items. Layer5 Cloud prorates the change: you pay for the new plan’s price for the rest of the current period, less credit for the unused part of the old plan. The confirmation reads “Subscription upgraded to” followed by the plan name.

Upgrade is unavailable for subscriptions that are canceled, inactive, incomplete, or on the free plan.

Cancel a subscription 🔗

Cancel asks you to confirm and then tells the payment processor to end the subscription at the end of the current billing period. The plan stays in force until the period ends. Because the plan runs to the end of the period, canceling issues no refund.

Cancel is unavailable for subscriptions that are already canceled or inactive, that never completed, or that are on the free plan.

How the billable user count works 🔗

Plans bill per user. The count is the number of distinct people who are members of the organization, with these rules:

• The account must be active. A person who has been invited but has not accepted is not counted. A deleted account is not counted.
• A member whose only role is academy learner is not counted.
• A member added without any role is not counted.
• The count never falls below the plan’s minimum number of users.
• Academy plans that bill per learner count active learners instead of organization members.

Layer5 Cloud recalculates the count when it creates a subscription, and then every 2 hours for subscriptions that are active, trialing, past due, incomplete, or unpaid. It sends the new count to the payment processor each time. No plan blocks you from adding users: the count changes what you pay, never what you can do.

What a change in the count costs:

• The count rises mid-period. The payment processor charges a prorated amount for the added users for the rest of the period. At renewal, the full amount reflects the new count.
• The count falls mid-period. The processor issues a prorated credit for the unused part. The credit stays on the organization’s account balance, does not expire, and reduces future invoices. It is not refunded automatically.
• Renewal date. A change in the count never moves the renewal date. At renewal, the organization pays for the count as of that date.

Removing a user from the organization, or deleting their account, lowers the count at the next recalculation.

What a plan enforces 🔗

Plans record several limits. Layer5 Cloud enforces only the number of components in a design.

For workspaces per organization on the Free plan, the plan records disagree: the monthly billing record sets 1 and the annual billing record sets 10.

When you save or import a design, Layer5 Cloud compares its component count with the limit of your organization’s active plan. A design that exceeds the limit is refused with the error Design exeeds maximum limit of N components supported by your current plan, where N is the limit. Reduce the number of components or upgrade the plan. When an organization holds more than one active subscription, the highest component limit among them applies. An organization with no active subscription cannot save or import a design. The request fails with HTTP 500 and the error Org is not entitled to adding components to a design.

Layer5 Cloud records every other quantity in the table and lists it through GET /api/entitlement/features, but it does not refuse an action because of any of them. See the API reference.

Only Provider Admins create custom roles. Layer5 Cloud refuses a role creation request from anyone else with HTTP 403. On hosted Layer5 Cloud, an organization cannot create a custom role itself. On a self-hosted deployment, the operator’s Provider Admins can. Roles are defined for the whole deployment, not per organization. Layer5 Cloud does not check your plan when a custom role is created.

Failure modes 🔗

Organization owners and Organization Admins are described in Organizations.