Skip to main content

Get started with Temporal Cloud

Getting started with Temporal Cloud involves a few key steps to ensure your environment is set up correctly. However you're using Temporal, begin the process by covering essential tasks, such as account setup, Namespace creation, authentication configuration, and Worker deployment.

You’ll find links here to help you configure your Temporal Cloud account, authenticate your Clients and Workers, and set up the necessary infrastructure to get your Workflows running efficiently.

Sign up for Temporal Cloud​

To create a Temporal Cloud account, you can:

  • Sign up on our site; or
  • Subscribe at the AWS Marketplace for Temporal Cloud Pay-As-You-Go. Signing up through the AWS Marketplace is similar to signing up directly on the Temporal Cloud site, but billing goes through your AWS account.
  • To purchase Temporal Cloud on the Google Cloud Marketplace, please contact our team at sales@temporal.io.

For information about Temporal Cloud Pricing, see our Pricing Page.

Accept Account Owner permissions​

After sign-up, you will receive email from Temporal welcoming you to your new Temporal account. Your email address is now the first Account Owner for your account.

An Account Owner:

  • Has full administrative permissions across the account, including users, usage, and billing
  • Has Namespace Admin permissions on all Namespaces in the account

Establish your authentication credentials​

Temporal Cloud supports both TLS and API key authentication. The following two sections explain these approaches.

TLS authentication and certificates​

For TLS authentication, you must provide your own CA certificates. These certificates are used to create a Namespace, which in turn used grants Temporal Clients and Workers access to it. For certificate requirements, see the following:

API keys​

To enable and use API key access, see the following:

Authentication and SDKs​

Each SDK has a way to use your CA certificates and private keys to authenticate and authorize access to your Temporal Cloud Namespace.

Create a Namespace​

If you don’t have a Namespace yet--or want to create an additional one--create a Namespace in Temporal Cloud using the Temporal Cloud UI or the tcld CLI. If using mTLS authentication, don't forget to follow the step that has you add the CA certificate to the Namespace.

Namespace Setup - Details[+]

How to create a Namespace in Temporal Cloud​

info

The user who creates a Namespace is automatically granted Namespace Admin permission for that Namespace.

To create a Namespace, a user must have the Developer, Account Owner, or Global Admin account-level Role.

tip

By default, each account is allocated with a limit of ten Namespaces. As you start using Namespaces by scheduling Workflows, Temporal Cloud automatically raises your allowance. This automatic adjustment happens whenever all your Namespaces are in use, up to a maximum of 100 Namespaces. You can request further increases beyond the 100 Namespace limit by opening a support ticket.

Information needed to create a Namespace​

To create a Namespace in Temporal Cloud, gather the following information:

Create a Namespace using Temporal Cloud UI​

  1. Gather the information listed earlier in Information needed to create a Namespace.
  2. Go to the Temporal Cloud UI and log in.
  3. On the left side of the window, click Namespaces.
  4. On the Namespaces page, click Create Namespace in the upper-right portion of the window.
  5. On the Create Namespace page in Name, enter the Namespace Name.
  6. In Cloud Provider, select the cloud provider in which to host this Namespace.
  7. In Region, select the region in which to host this Namespace.
  8. In Retention Period, specify a value from 1 to 90 days. When choosing this value, consider your needs for Event History versus the cost of maintaining that Event History. Typically, a development Namespace has a short retention period and a production Namespace has a longer retention period. (If you need to change this value later, contact Temporal Support.)
  9. Select your authentication method: API keys or mTLS.
  10. If using mTLS authentication, paste the CA certificate for this Namespace.
  11. Optional: In Codec Server, enter the HTTPS URL (including the port number) of your Codec Server endpoint. You may also enable "Pass the user access token with your endpoint" and "Include cross-origin credentials." For details, see Hosting your Codec Server.
  12. Click Create Namespace.

Invite users​

Adding a user to your Temporal Cloud Account dispatches an email invite, which users must accept to join. To add users, see How to invite users to your Temporal Cloud account.

Invite Users - Details[+]
caution

Access to Temporal Cloud can be authorized through email and password, Google single sign-on, Microsoft single sign-on, or SAML, depending on your setup.

If you are using Google OAuth for single sign-on and an email address is not associated with a Google Account, the user must follow the instructions in the Use an existing email address section of Create a Google Account.

Important: Do not create a Gmail account when creating a Google Account.

If your organization uses Google Workspace or Microsoft Entra ID, and your IT administrator has enabled controls over single sign-on permissions, then you will need to work with your IT administrator to allow logins to Temporal Cloud.

When a user is created in Temporal Cloud, they receive an invitation email with a link. They must use this link to finalize their setup and access Temporal Cloud. Accounts with SAML configurations can ignore this email. However, those using Google/Microsoft SSO or email and password authentication need to accept the invitation link for their initial login to Temporal Cloud. For future logins, they must use the same authentication method they originally signed up with.

info

To invite users, a user must have the Global Admin or Account Owner account-level role.

Roles and permissions​

Each user in Temporal Cloud is assigned a role. Each user can be assigned permissions for individual Namespaces.

To invite users using the Temporal Cloud UI:

  1. In Temporal Web UI, select Settings in the left portion of the window.
  2. On the Settings page, select Create Users in the upper-right portion of the window.
  3. On the Create Users page in the Email Addresses box, type or paste one or more email addresses.
  4. In Account-Level Role, select a Role. The Role applies to all users whose email addresses appear in Email Addresses.
  5. If the account has any Namespaces, they are listed under Grant access to Namespaces. To add a permission, select the checkbox next to a Namespace, and then select a permission. Repeat as needed.
  6. When all permissions are assigned, select Send Invite.

Temporal sends an email message to each user. To join Temporal Cloud, a user must select Accept Invite in the message.

Frequently Asked Questions​

Can the same email be used across different Temporal Cloud accounts?​

No — each email address can only be associated with a single Temporal Cloud account. If you need access to multiple accounts, you’ll need a separate invite for each one using a different email address.

Can I use Google or Microsoft SSO after signing up with email and password?​

If you originally signed up for Temporal Cloud using an email and password, you won’t be able to log in using Google or Microsoft single sign-on.

If you prefer SSO, ask your Account Owner to delete your current user and send you a new invitation. During re-invitation, be sure to sign up using your preferred authentication method.

How do I complete the Secure Your Account step?​

If you signed up to Temporal Cloud using an email and password, you're required to set up multi-factor authentication (MFA) for added security. Currently, only authenticator apps are supported as an additional factor (such as Google Authenticator, Microsoft Authenticator, and Authy).

To proceed:

  1. Download a supported authenticator app on your mobile device.
  2. Scan the QR code shown on the Secure Your Account screen.
  3. Enter the verification code from your app to complete MFA setup.
  4. Securely store your recovery code. This code allows you to access your account if you lose access to your authenticator app.

Once MFA is configured, you’ll be able to continue using Temporal Cloud.

What if I lose access to my authenticator app?​

If you lose access to your authenticator app, you can still log in by clicking Try another method on the MFA screen. From there, you can either:

  • Enter your recovery code (provided when you first set up MFA)
  • Receive a verification code through email

Once you're logged in, you can reset your authenticator app by navigating to My Profile > Password and Authentication and then clicking Authenticator App > Remove method.

How do I reset my password?​

If you're currently logged in and would like to change your password, click your profile icon at the top right of the Temporal Cloud UI, navigate to My Profile > Password and Authentication, and then click Reset Password.

If you're not currently logged in, navigate to the login page of the Temporal Cloud UI, enter your email address, click Continue, and then select Forgot password. In both cases, you will receive an email with instructions on how to reset your password.


Connect to Temporal Cloud​

After having updated your Temporal Client and your Workers to use your Temporal Cloud Namespace credentials, you can deploy your Workers, so they are ready to execute your Workflows and Activities:

SDK-specific Worker configuration​

Worker quick-starts​

Get up and going with focused how-to guides: