Opfield Cloud

Opfield Cloud connects an Opfield installation to your Opfield account at https://account.opfield.dev. A connected installation keeps one outbound connection to the account. Through it the account reads the installation’s health and, if you allow it, runs a few maintenance actions. The installation keeps running on your servers as before: your resources, nodes, secrets, and data stay where they are.

The connection is optional: every feature of Opfield works without it. You connect an installation in Settings > General, in the Cloud block. It works on every plan, Community included, and you can disconnect at any time. See Connect an installation.

What a connected installation gives you

In the Opfield account	Needs Allow remote management
The installation’s state: host name, uptime, Opfield version, CPU, load, memory and disk use, and the state of each of Opfield’s own containers	No
The latest logs of Opfield’s own containers	No
Whether an Opfield update is available, and on which channel	No
A one-time node enrolment token with its install command, as Nodes > Add Node makes it, for any node type Add Node offers	Yes
Starting the Opfield update that Settings > General offers	Yes
A first-admin setup code, only before initial setup, while the installation has no users	Yes
A sign-in client, so that users sign in to the installation with Sign in with Opfield account; only after an administrator asks for it with Use Opfield account	No

Allow remote management is off by default; an administrator turns it on in the Cloud block. While it is off, the account can only read, and answer a request for a sign-in client that an administrator made. The account cannot open a console, change resources, read secrets, or see your workloads, Routes, or databases: the connection answers only the requests above. See Cloud data and security.

Who can connect

The Cloud block appears in Settings > General for users with the license:manage scope. The same scope connects, disconnects, and turns remote management on or off. Reading the connection status through the REST API or MCP needs license:view. The AI assistant and MCP clients use the same scopes through get_cloud_status and manage_cloud; see Connect an installation and the Scope reference.

Managed installations

Managed cloud is an add-on for the Personal and Business plans, sold together with the license key in your Opfield account. A managed installation runs on a VM that Opfield Cloud creates for you. It connects to its account by itself on first start and activates its license key. When its provisioning names the account’s owner, it also comes up already set up, without the setup wizard:

• the public URL is set (and the public gRPC target, when it is not set yet);
• an OIDC provider named “Opfield account” is added;
• the owner of the account becomes the first system administrator and signs in with Sign in with Opfield account;
• setup is marked complete.

These steps succeed together or not at all; if one fails, the installation stays on the usual setup code flow.

A managed installation stays tied to the cloud that runs it:

• The Cloud block reads Managed by Opfield Cloud. There is no Switch account or Disconnect, and remote management shows Managed by the cloud instead of a switch: it is always on.
• The license is managed by the Opfield account: Update license and Deactivate are not available.
• The public URL, the gRPC addresses that nodes enrol with, internal HTTPS, the network trust settings (client IP source, trusted proxies, Cloudflare headers), and the status page upstream URL cannot be changed. Sign-in is not tied to the cloud. It works as on a self-hosted installation; see the next section.

Sign-in on a managed installation

The “Opfield account” provider is an ordinary OIDC provider, and you decide how people sign in:

• In Settings > Authentication > OIDC provider you can rename or edit the “Opfield account” provider, remove it with Remove, or replace it with your own SSO; see Connect your SSO provider. The installation has one OIDC provider, so your own SSO takes the place of the Opfield account.
• In Sign-in methods you can turn OIDC sign-in off and use Email and password or Email sign-in code (they need verified SMTP).
• In Administration > Users > Configure User you can move the owner to another sign-in method.

Add other users from Administration > Users with a password, an email code, or OIDC through the provider in use. Users who signed in with the Opfield account, the owner included, stay linked to it: after you switch to your own SSO, set their Sign-in method to another method and back to OIDC so they are linked to the new provider on their next sign-in.

The rule of every installation applies here too: Opfield refuses a change after which no administrator could sign in (LAST_ADMIN_SIGN_IN). If the owner is the only administrator, first give the owner, or another administrator, a method that stays on, for example email and password, and sign in with it.

Use Opfield account in the OIDC provider panel brings the Opfield account sign-in back at any time. It puts back the “Opfield account” provider with the client Opfield Cloud created for the installation, in place of your own provider, and turns OIDC sign-in on. Opfield keeps that client apart from the provider, so it survives editing or removing the provider. The button is shown while the installation uses another provider or none. API: PUT /api/admin/auth-settings with oidcProviderAction: "opfield_account"; MCP and assistant: update_opfield_settings with the same field. The settings report the state in opfieldAccountSignIn.

The provider stays “Opfield account” while it keeps the cloud’s issuer and client ID; another issuer or client ID makes it your own provider. The Opfield account can replace the client secret over the connection:

• While the installation signs in with the “Opfield account” provider, the new secret replaces the provider’s secret and the kept copy; Opfield stores it encrypted.
• After you removed the provider or replaced it with your own, the installation refuses the new secret (OPFIELD_ACCOUNT_PROVIDER_MISSING) and changes nothing. Your sign-in is not touched, the previous secret stays valid in the account, and Use Opfield account keeps working.

A reinstall that brings a new client from the cloud keeps your choice: if you removed the provider or use your own, it stays, and the new client is only kept for Use Opfield account.

A self-hosted installation connected to Opfield Cloud can sign in with the Opfield account too: Use Opfield account asks the account for a sign-in client. See Sign in with the Opfield account.

Related pages

• Connect an installation: the code, the Cloud block, remote management, switching accounts, and disconnecting.
• Cloud data and security: what crosses the connection, what is stored where, the audit log, and what happens when the account cannot be reached.
• Plans and entitlements: plans and the license service, which work separately from the Cloud connection.