> ## Documentation Index
> Fetch the complete documentation index at: https://helpcenter.magure.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud Marketplace

> Let customers who buy MagOneAI on a cloud marketplace self-onboard, with their plan's usage entitlement applied automatically

## What this is

When a customer purchases MagOneAI through a public cloud marketplace, they can **onboard themselves** without a manual setup call. The purchase provisions (or links) their organization and applies the plan's usage entitlement automatically, and billing lifecycle events keep that entitlement in sync as the subscription changes.

<Warning>
  This is **billing and procurement onboarding**, not an in-app catalog. There is no marketplace of templates, prebuilt agents, or workflows to browse and install inside MagOneAI. "Cloud Marketplace" here means the AWS, Azure, and GCP marketplaces where a customer buys the MagOneAI subscription itself.
</Warning>

A marketplace purchase is an **onboarding channel, not an authentication method**. It never changes how anyone signs in: after onboarding, the customer logs in exactly like any other user, with email and password or SSO. The shipped login and signup flows are untouched.

## Providers

MagOneAI ships adapters for three marketplaces:

<CardGroup cols={3}>
  <Card title="AWS" icon="aws">
    Live. Purchase and lifecycle flow through the AWS Marketplace with entitlement-gated go-live.
  </Card>

  <Card title="Azure" icon="microsoft">
    In preview. Adapter for the Azure Commercial Marketplace SaaS offer.
  </Card>

  <Card title="Google Cloud" icon="google">
    In preview. Adapter for Google Cloud Marketplace (Producer Portal).
  </Card>
</CardGroup>

<Note>
  Every provider is **disabled by default** and must be turned on individually by a superadmin. Until a marketplace is enabled, its landing endpoint does not resolve purchases.
</Note>

## How onboarding works

<Steps>
  <Step title="Customer buys on the marketplace">
    The customer completes the purchase on AWS, Azure, or GCP and is redirected to MagOneAI with a marketplace token.
  </Step>

  <Step title="MagOneAI resolves the purchase">
    The landing endpoint verifies the token server-side and records a normalized subscription. The token never reaches the browser: the customer is handed only a single-use, short-lived registration link.
  </Step>

  <Step title="Customer registers or links an org">
    From the registration page, the customer either **provisions a brand-new organization** (standard signup) or **links the subscription to an organization they already own**. Linking to an existing org requires the caller to be an OWNER of that org.
  </Step>

  <Step title="Entitlement is applied">
    Once the subscription is activated with the marketplace, the plan is mapped to a usage entitlement and applied to the organization as its default token limit. The customer then lands in a normal, signed-in session.
  </Step>
</Steps>

<Note>
  For AWS, an organization is entitled only once the marketplace confirms the purchased dimension (surfaced by a lifecycle event), never at registration alone. This keeps a customer from being provisioned ahead of the confirmed purchase.
</Note>

## Staying in sync

A subscription is not a one-time event. MagOneAI listens for the marketplace's billing lifecycle notifications and moves the subscription and its entitlement accordingly:

| Lifecycle event                     | Effect                                                                   |
| ----------------------------------- | ------------------------------------------------------------------------ |
| **Activated / reinstated**          | Subscription becomes active and the plan's entitlement is applied        |
| **Plan changed / quantity changed** | The entitlement is re-applied in place; status is unchanged              |
| **Suspended**                       | The org is downgraded to the free-tier limit; data is retained           |
| **Cancelled**                       | Terminal; the org is downgraded to the free-tier limit; data is retained |

Redelivered notifications are safe: events are de-duplicated, so re-processing the same message does not double-apply an entitlement or corrupt state.

## The entitlement

The plan-to-entitlement mapping resolves to an **organization-default token limit** - the same [usage quota](/platform/usage-and-quotas) mechanism used everywhere else on the platform. A plan can grant a finite token budget or be unlimited. Suspension and cancellation drop the org to the free-tier floor rather than deleting anything.

<Note>
  Entitlements are **token-limit only** in this integration. A plan does not toggle feature flags or unlock modules; it sets the org's token allowance.
</Note>

An unmapped plan does not fail onboarding: the org onboards with the platform default entitlement and the gap is logged for an admin to reconcile.

## Configuration (superadmin)

Cloud Marketplace onboarding is configured entirely by platform superadmins, not by org admins or end users. Two things are managed:

<CardGroup cols={2}>
  <Card title="Enable flags" icon="toggle-on">
    Turn each marketplace (AWS, Azure, GCP) on or off. All are off by default.
  </Card>

  <Card title="Plan map" icon="table-list">
    Map each marketplace plan to the entitlement applied to the buyer's org. Unmapped plans fall back to the platform default.
  </Card>
</CardGroup>

Provider credentials are stored in [HashiCorp Vault](/security/secrets-management) under a platform-scoped path, never in the database or the workflow definition.

## What is out of scope

To set expectations clearly, this integration deliberately does **not** cover:

* An in-app marketplace of templates, agents, or workflows to install.
* Metering or usage-based (consumption) billing back to the marketplace.
* Private offers.
* In-app plan self-service (changing plans from inside MagOneAI).
* Marketplaces other than AWS, Azure, and GCP.

## Next steps

<CardGroup cols={2}>
  <Card title="Usage & quotas" icon="gauge" href="/platform/usage-and-quotas">
    How the token entitlement a plan grants is enforced across the org
  </Card>

  <Card title="Admin Portal" icon="gear" href="/platform/admin-portal">
    Where superadmins manage the platform, including marketplace configuration
  </Card>

  <Card title="Organizations & projects" icon="building" href="/platform/organizations-and-projects">
    The org that a marketplace purchase provisions or links to
  </Card>

  <Card title="Secrets & Vault" icon="key" href="/security/secrets-management">
    Where marketplace provider credentials are stored
  </Card>
</CardGroup>