# Get started with Team Cloud

> Buy a Team Cloud team in the console, set up its keys on an admin's Mac, invite people and join, step by step for owners, admins and members.

Source: https://docs.subcloak.com/cloak-proxy/team/get-started/

Added in Cloak Proxy 0.7.0.

{/* L9 draft. Sources: PLAN 6.1–6.3, 9.5 (console pages), 10 (Settings › Team), T5.2. Re-check labels against L6/L8. */}

A team is set up in three steps, often by three different people: the **owner** buys it in the console, the **first admin** sets up the team's keys on a Mac, and **members** join from Cloak Proxy. One person can do all three.

## For owners: buy a team

{/* PLAN 6.1, 9.5 pages 1, 2, 16 */}

You don't need a Mac or a seat to buy and run a team. The console never holds the team's keys, so you can manage billing and people without being able to read the team's data (unless an admin turns on automatic approval after SSO, which lets your identity provider admit a Mac).

1. Go to `console.subcloak.com/start` (or **Start a team** on [subcloak.com](https://subcloak.com/apps/cloak-proxy/team-cloud)) and sign in with your email. The console emails a 6-digit code. If you already use Personal Cloud, it's the same sign-in.

2. Fill in **Start a team**:
   - **Team name.**
   - **Seats**: at least 2. Each person who'll use Cloak Proxy with the team takes one.
   - **Billing**: **Monthly, $5 a seat**, or **Yearly, $4 a seat a month ($48 a seat a year)**.
   - **I'll use Cloak Proxy myself (takes a seat)**: on by default. Turn it off if you only run billing and settings.

   The total is shown on one line, for example "3 seats × $48 = $144 a year, plus tax. Billed by Polar."

3. Click **Continue to payment** and pay on Polar's checkout page.

4. The console's welcome page says "Payment received. Next, set up the team's keys on a Mac" and offers two choices:
   - **I'll do it**: download Cloak Proxy, sign in with the same email, then **Settings › Team › Set Up Team Keys**. See [For the first admin](#for-the-first-admin-set-up-the-teams-keys).
   - **Invite the first admin**: send an admin invitation to the person who'll set up the keys.

The console's **Overview** shows a **Setup checklist** until it's done:

1. Keys set up on a Mac
2. A second admin
3. Team Recovery Kit stored (an admin's Mac reports it)
4. Invite your team
5. SSO (optional)

> **Ask for a second admin early:**
> Only an admin's Mac can approve new people. A team with one admin shows a standing warning in the console and in the app until a second admin joins. See [Recovery and start over](https://docs.subcloak.com/cloak-proxy/team/recovery-and-start-over/).

## For the first admin: set up the team's keys

{/* PLAN 6.2; T5.2 rule 4 */}

The first admin is the owner (if they took a seat) or the person who accepted an admin invitation. Whoever sets up the keys first becomes the team's first admin; anyone else who tries afterwards joins the normal way and waits for approval.

1. Install [Cloak Proxy](https://docs.subcloak.com/cloak-proxy/getting-started/install/) 0.7.4 or later and sign in to Cloud with the invited email in **Settings › Cloud**. Only someone invited as an admin can set up the keys (the owner is, if they chose "I'll do it" in the console: that uses one of the team's seats).

2. In **Settings › Team**, the team says it needs its keys. Click **Set Up Team Keys**. Your Mac makes the team's keys and its Team Recovery Kit. Until this is done nobody can join, and most of the console waits for it.

3. Save or print the **Team Recovery Kit**: "Store it where your company keeps critical secrets. Whoever holds it can recover the team and read all its data." See [Team keys and the Recovery Kit](https://docs.subcloak.com/cloak-proxy/team/team-keys/).

4. Cloak Proxy creates the team's first spaces: **Team rules**, **Team mocks**, **Library**, **Findings** and **Agents**. It asks whether to create a first [vault](https://docs.subcloak.com/cloak-proxy/team/vault/) folder.

5. Invite a second admin and your team. See [Invite and approve people](https://docs.subcloak.com/cloak-proxy/team/invite-and-approve/).

{/* TODO(screenshot): team-settings-setup-light (Settings › Team before keys: Set Up Team Keys). */}

## For members: join a team

{/* PLAN 6.3; T5.2, T5.3 */}

1. Open the invitation email: "Priya Shah invited you to Acme on Cloak Proxy." It has a **Join** link and a download link. The invitation holds no secret: it only lets your address ask to join.

2. Install Cloak Proxy 0.7.4 or later, and sign in with the address the invitation went to, by email code, or with SSO if your team requires it.

3. Click the link in the email, or open **Settings › Team**, and click **Join**. Your Mac asks the team's admins to approve it.

4. An admin contacts you on a call or in chat and reads you a 6-digit code. Check it matches the code on your Mac, then click **Codes Match**. Don't click it if the codes differ.

5. Your Mac receives the team's keys and syncs the team's spaces. They appear in the sidebar under **Team: Acme**.

If no admin has set up the team's keys yet, Settings › Team says "Acme isn't set up yet", with no **Join** button: there's nothing to do until its first admin has set up the keys. **Check Again** looks for them.

A request to join lasts 10 minutes. Ask an admin to open **Settings › Team** on their Mac when you click **Join** (admins also get a notification). If nobody approves it in time, Settings › Team says so and you can click **Join** again.

Your second Mac joins the same way: once you're signed in, Settings › Team says "This Mac isn't in Acme yet". Click **Add This Mac**, and approve it from your first Mac after comparing a code there. An admin's Mac approves only a person's first Mac. A team allows up to 5 Macs per person, or fewer if a [policy](https://docs.subcloak.com/cloak-proxy/team/policies/) says so. {/* PLAN 6.3 step 5, 8.4 */}

## Where things are

{/* PLAN 10 */}

| In Cloak Proxy | What it's for |
|---|---|
| **Settings › Team** | The team, this Mac, join requests, members, security (Team Security code, Recovery Kit), policies, CI tokens, notifications and server-side features. With several teams, a picker at the top. |
| Sidebar **Team: Acme** | Workspaces, Rules, Mocks, Library, Findings, Vault, Agents, Reviews and Monitors\*. A lock marks a restricted space; a shield marks a protected set. |
| Toolbar | The plan pill ("Team · Acme"), **Activity** (notifications) and **Pair**. |
| **Team** menu | Open Console, Library, Reviews, Vault, Pair…. Before your Mac is in a team, only Open Console and Team Settings…. |
| **Help › Contact Team Support** | An email to team support with your team's code. |

| In the console | What it's for |
|---|---|
| **Overview** | Plan, setup checklist, items that need attention, recent activity. |
| **Members** | People, roles, seats, invitations and removals. |
| **Billing** | Seats, interval, payment method and invoices. |
| **Policies**, **SSO & SCIM**, **CI**, **Monitors\***, **Hosted mocks\***, **Usage**, **Audit log**, **Settings**, **Support** | As named. |
| **Your account** | Your passkeys, sessions and notification preferences. |

## Related

  - [Invite and approve people](https://docs.subcloak.com/cloak-proxy/team/invite-and-approve/): Invitations, join requests and comparing codes.
  - [Team keys and the Recovery Kit](https://docs.subcloak.com/cloak-proxy/team/team-keys/): What the keys are and where to keep the kit.
  - [Spaces, roles and permissions](https://docs.subcloak.com/cloak-proxy/team/spaces-and-roles/): Open and restricted spaces, and who can do what.
  - [Billing and seats](https://docs.subcloak.com/cloak-proxy/team/billing-and-seats/): Seats, proration and refunds.