Start here

From nothing to a service of your own answering on the internet. Six steps, each one saying what you should see when it worked.

1Get an invitation

We are in preview, so accounts are created by invitation. Ask for one:

hello@nuved.io

The invitation email carries a link. Opening it creates your account: you choose a password there and confirm your email address.

You can sign in with that address.

2Sign in and name your organization

Go to the sign-in page and sign in. The first time, you name your organization: it is the short name your projects and addresses are built from, so acme gives you acme-default and hello-acme.nuved.io. It cannot be changed later.

Your console opens, with your organization's name at the top.

3Top up

Your balance is what everything spends. Pick an amount in the console; the card form is Stripe's, and we never see the number.

€0.14 per vCPU-hour, €0.009 per GiB-hour, €0.08 per GB of disk a month, since 22 September 2026. A small service (0.25 vCPU, 512 MiB) costs about €29 a month, taken from the balance as it runs.

Free has 3 live shares at a time, for nothing; Pro has 10, with 3 reserved names and your own domain, for €4.00 a month from the balance. Hosting is charged on top of either.

Rates are what the machines cost us, divided by the capacity we can sell. They change only when our cost moves by more than 5%.

This platform is in test mode. Use the test card 4242 4242 4242 4242, any future expiry, any CVC. Nothing is charged, and the balance you get is real inside the platform.

The console shows a balance, and your first project appears within seconds.

4Install the CLI and sign it in

curl -fsSL https://get.nuved.io/install.sh | sh
nuved login

nuved login prints a short code and a link. Open the link, confirm the code, and the CLI is signed in: it never asks you for a password, and no password ever passes through it.

nuved whoami prints your organization and your balance.

5Deploy your first service

Point kubectl at your project. The file this writes reaches your projects and nothing else:

nuved kubeconfig acme-default -o ~/.kube/nuved
export KUBECONFIG=~/.kube/nuved

Save this as hello.yaml. It asks for no CPU or memory: your project fills those in for you, and you are charged for what it reserves.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
spec:
  replicas: 1
  selector:
    matchLabels: { app: hello }
  template:
    metadata:
      labels: { app: hello }
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        seccompProfile: { type: RuntimeDefault }
      containers:
        - name: hello
          image: hashicorp/http-echo:1.0
          args: ["-listen=:8080", "-text=hello from acme"]
          ports:
            - containerPort: 8080
          securityContext:
            allowPrivilegeEscalation: false
            capabilities: { drop: ["ALL"] }
---
apiVersion: v1
kind: Service
metadata:
  name: hello
spec:
  selector: { app: hello }
  ports:
    - port: 80
      targetPort: 8080

kubectl apply -f hello.yaml
kubectl get pods

kubectl get pods shows one pod, Running, 1/1.

6Give it a public address

In the console, press Expose on the service. Or from anywhere with a token:

curl -X POST https://api.nuved.io/v1/projects/acme-default/services/hello/expose \
  -H "Authorization: Bearer $NUVED_TOKEN"

Open https://hello-acme.nuved.io and it answers.

The address is the console's to manage, not kubectl's: your credential cannot list or write routes, so kubectl get httproute is refused by design. Expose and unexpose here or through the API above.

Your own app

Everything above works the same for your own code, with one requirement: it has to be a container image on a registry this cluster can pull. A public image needs nothing. A private one needs a pull secret, which you make in your own project:

kubectl create secret docker-registry regcred \
  --docker-server=ghcr.io --docker-username=YOU --docker-password=YOUR_TOKEN
# then in the Deployment:
#   spec.template.spec.imagePullSecrets: [{ name: regcred }]

Three things a project cannot do, whatever the manifest says:

run privileged, or as root with elevated capabilities;
use the node's network or its filesystem;
go past its caps — cpu and memory. Raise them in the console, or the pod simply waits.

A refusal always says which of these it was.

For AI agents (Claude Code, Codex, Cursor)

Give the agent a credential of its own, scoped to one project: in the console, Create token for that project, then download that project's kubeconfig while signed in with it. Paste this into your repository's CLAUDE.md or AGENTS.md:

## Deploying

This repo deploys to a Nuved project.

- kubeconfig: ~/.kube/nuved   (use `kubectl --kubeconfig ~/.kube/nuved`)
- namespace:  acme-default    (everything you create goes here)
- give a service a public address:
    curl -X POST https://api.nuved.io/v1/projects/acme-default/services/<service>/expose \
      -H "Authorization: Bearer $NUVED_TOKEN"

You cannot top up, change caps, mint tokens, or reach another project with this
token. If a deploy is refused, the message says why: read it and fix the manifest
rather than trying another way in.

Better still, hand the agent the rules themselves: nuved skill install writes them to .claude/skills/nuved/SKILL.md, or read them at get.nuved.io/skill/SKILL.md.

Every endpoint, in detail: API docs. Back to your console or sign in.