Onboard your organization

This is the order that works for a new deployment. Cengrid has no in-app setup wizard (cengrid setup is an interactive command-line wizard that scaffolds a directory and walks you through missing secrets). The admin console’s Onboarding page is a stack of cards (model providers, custom providers, Slack, Google Chat, single sign-on), and everything else lives on its own page. Follow the steps below in order, and skip what you do not need.

Hand it to a coding agent

cengrid init writes a deployment.md runbook and a deploy-cengrid skill into your deployment directory. Give them to a coding agent and it will collect your choices, configure sign-in and the model, deploy, run live checks and return the URLs. See the deployment directory.

1. Deploy and sign in as the first administrator. Set ADMIN_GRANTS=<email>:org_admin for the person who should administer Cengrid, then deploy. Open the web URL, enter that email, and use the one-time link you receive. See sign-in below.

2. Add a model provider. Open Admin → Onboarding → Model providers and add a key for Anthropic, OpenAI or OpenRouter (skip this if you set modelProvider in the deployment config). Then pick the base model in Governance → Models. Send a real message in the web app to confirm it replies. See models.

3. Set your branding. In cengrid.config.jsonc, botName (up to 31 characters) names the bot in the generated Slack apps, the prompt and sign-in pages, and orgName (up to 40) is how it refers to your organisation. You can also change the name live under Governance → Advanced → Branding, a JSON field with the keys accent, mark, selfLabel (the bot’s name, up to 40 characters) and orgName. Editing it does not rename a Slack app you have already created.

4. Connect GitHub. In Connections, configure the organisation GitHub connection. You need it to import plugins. See Connect GitHub.

5. Connect Slack and/or Google Chat. Create the bot, add its tokens, and add channels or spaces as rooms. See Connect Slack and Connect Google Chat.

6. Register the OAuth apps you want people to use. In Connections → Available, configure Google (and any other built-in account connectors) with a client ID and secret. Then complete one real connection yourself from Keychain. See Connect Google Workspace.

7. Create teams and add rooms. Every room you add in the console belongs to a team, and the Add room form lets you create the team on the spot. See teams and rooms.

8. Add capabilities. Connect a plugin or marketplace from GitHub and add its skills, instructions, agents and apps to the organisation or a team. See capabilities.

9. Bring people in. Tell your team how to sign in and where to find the bot. See onboard people.

Sign in

Sign-in defaults to the built-in auth broker, which emails a one-time link. You need:

Setting	Meaning
ADMIN_GRANTS	<email>:org_admin for the first administrator. Only org_admin is accepted. It seeds the grant store once, only when it is empty. Later changes to the variable do nothing. Use Users instead.
AUTH_ALLOWED_EMAILS and/or AUTH_ALLOWED_EMAIL_DOMAIN	Who may sign in. A person is allowed if they match either. The broker refuses to start with neither. cengrid setup fills AUTH_ALLOWED_EMAILS from your admin grants.
AUTH_EMAIL_FROM	The sender, optionally Name <address>. It must be a verified sender.
AUTH_EMAIL_TRANSPORT	resend (needs RESEND_API_KEY, and a domain verified in Resend) or smtp (needs SMTP_HOST, SMTP_USERNAME, SMTP_PASSWORD, optionally SMTP_PORT and SMTP_TLS). The default is resend.

The CLI generates the broker’s own secrets (AUTH_CLIENT_SECRET, AUTH_TOKEN_SECRET and a signing key) and derives the portal’s OIDC_* settings. Links expire after 15 minutes by default and work once.

To use an identity provider you already have, drop "auth" from services and register the exact redirect <publicUrl>/auth/callback with it. See Sign in with Google and Slack sign-in. In production the portal refuses to start without a trust boundary: OIDC_ALLOWED_EMAILS, OIDC_ALLOWED_EMAIL_DOMAIN or PORTAL_EXPECTED_TEAM_ID.

You can also connect a company identity provider in the console under Admin → Onboarding → Single sign-on with an issuer URL, client ID, client secret and allowed email domain. That card adds SSO-only login, Invite-only join and an Invites table. Microsoft Entra ID is not supported.

Where things are in the console

Area	Pages
Admin	Sessions, Rooms, Intake decisions
Capabilities	MCP Servers, Connections, Skills, Agents, Instructions, Playbooks, Environments, Apps, Plugins
Artifacts	Files, Memory, Deployments, Crons
System	Metrics
Admin (second group)	Onboarding, Teams, Users, Governance, Keychain, Egress, Audit

There is no top-level Security or Branding page. Security posture, base model, spend limit and Branding are tabs and fields inside Governance. Team administrators see only the teams they administer.

QuickstartThe same journey as a one-page checklist.