# Self-Hosted onboarding > Onboard a Self-Hosted Data Plane management plane: organization details, SSO, providers, models, and the data plane credential used to install the data plane. Onboard a Self-Hosted Data Plane deployment through a one-time Admin Dashboard wizard. Steps 1 to 5 collect configuration, Step 5 downloads the credential used to install the data plane, and Step 6 confirms completion. Two values can be deferred: SSO (Step 2), until after the gateway is running but before the Console is opened to developers, and the gateway URL (Step 1), until after the gateway and DNS are live. ## The onboarding wizard The wizard launches automatically on the first sign-in to the Admin Dashboard; there is no separate onboarding URL. Each step has **Next** and **Previous** controls. **Next** is enabled once the current step's required fields are filled; **Previous** returns to any earlier step to review or change a value. Step 1 Organization Name Identify the tenant, and optionally register the gateway URL. Step 2 Corporate Login Configure SSO over OpenID Connect (OIDC). Can be deferred until after the gateway is running. Step 3 LLM Providers Connect providers such as OpenAI and Anthropic. Step 4 LLM Models Choose which models are exposed. Step 5 Configure AI gateway Download the `service-account.json` credential the data plane needs. Step 6 Setup Complete The Admin Dashboard can now be accessed by signing in with SSO. Onboarding produces a configured management plane and a `service-account.json` file used as input to the data plane installation. Plan for 15 to 30 minutes, plus any back-and-forth with the identity provider (IdP) team if SSO is configured now. ## Prerequisites Have the following on hand before launching the wizard: - Access to the Admin Dashboard. Tetrate provides the URL during provisioning. - Initial admin credentials for the first sign-in. - API credentials for at least one LLM provider, for example an OpenAI API key. - Optionally, a planned hostname for the gateway, for example `https://proxy.example.com`. This value can be entered as the **Data plane URL** in Step 1, or passed later as `tare install --serve-url`. Neither entry point is mandatory: the URL can also be registered from the Admin Dashboard once the gateway and DNS are live. - OIDC IdP details (issuer URL, client ID, client secret, scopes) if SSO is configured now. Agent Router supports **OIDC only**. SSO can also be deferred; see [SSO configuration](/agent-router-enterprise/guides/identity-and-access-management/sso-configuration-guide). ## Get started The wizard appears automatically when the Admin Dashboard URL is first visited. Click **Start setup** to begin. ### Step 1: configure organization name Fill in: | Field | Required | Description | Sample value | | :---- | :---- | :---- | :---- | | Organization Name | Yes | The organization's display name | `Acme Corp.` | | Data plane URL | No | The public URL where the gateway is reachable. Always include the scheme (thus `https://proxy.tare-pn-.tetrate.ai`, not just `proxy.tare-pn-.tetrate.ai`). The same value can be passed to `tare install --serve-url` later. | `https://proxy.tare-pn-12345a678.tetrate.ai` | :::info The gateway URL can be deferred The gateway does not need to exist yet, and this field can be left empty. **Next** is enabled once **Organization Name** is filled in. Onboarding only stores the value; the cluster, ingress, and DNS come later during install. Leaving the field empty means the default project is not serving traffic when the wizard finishes, which Step 6 reports. The URL can be registered at any time afterwards under **System → Settings → Data planes**, or automatically by passing `--serve-url` to `tare install`. See [Data plane installation](/agent-router-enterprise/self-hosted-data-plane/data-plane-installation). ::: :::note Field label The wizard labels this field **Data plane URL**, but the value is a gateway endpoint: a data plane hosts gateways, and each gateway owns the URL that clients call. See [Manage multiple gateways on a data plane](/agent-router-enterprise/guides/operate-and-govern/project-and-data-plane-management/manage-gateways-on-a-data-plane). ::: ### Step 2: configure corporate login (single sign-on) :::info SSO can wait For a Self-Hosted Data Plane install, configure SSO here or defer it until after the data plane and gateway are running. Developers need SSO before using the Console, so complete it before developer handoff. See the [SSO configuration guide](/agent-router-enterprise/guides/identity-and-access-management/sso-configuration-guide). ::: :::warning Agent Router supports **OIDC only**. SAML, LDAP, and other protocols are not supported. ::: If configuring SSO now, the wizard displays the **OIDC redirect URI** for the deployment, following the pattern: ```text https://dashboard./login ``` Register Agent Router as an OIDC application in the IdP using that exact URI, then fill in: | Field | Required | Description | Sample value | | :---- | :---- | :---- | :---- | | Issuer (IdP URL) | Yes | OIDC issuer URL exposed by the IdP | `https://login.example.com/` | | Client ID | Yes | OAuth client ID created for Agent Router | `agent-router` | | Client Secret | Yes | OAuth client secret paired with the Client ID | `••••••••` | | Discovery URL | No | OIDC discovery document URL. If omitted, Agent Router constructs it as `/.well-known/openid-configuration`. | `https://login.example.com/.well-known/openid-configuration` | | Scopes | Yes | OAuth scopes to request | `openid profile email` | | Admin email | Yes | At least one user granted admin rights after the first SSO login | `admin@example.com` | | Attribute mapping | Yes | Maps an IdP claim to the Agent Router user's email. The typical value is `email`. | `email` | ### Step 3: configure LLM provider(s) Connect Agent Router to one or more LLM providers. At least one provider is required to route traffic. The wizard shows a radio button for each supported provider, including OpenAI, Anthropic, Google, Azure OpenAI, Mistral, Cohere, Together, and Perplexity. See [Provisioning models and providers](/agent-router-enterprise/guides/operate-and-govern/provision-models-and-providers) for the authoritative list. Select a provider, click **Configure**, then fill in: | Field | Required | Description | Sample value | | :---- | :---- | :---- | :---- | | Display Name | No | Optional label shown in tables and filters | `OpenAI` | | API Base URL | Yes | Base URL for the provider API. Pre-filled for supported providers. | `https://api.openai.com/v1` | | Auth method | Yes | Authentication method. Pre-filled per provider. | `API Key` | | Secret Type | Yes | `Password` for single-string API keys; `Service Account JSON` for providers that authenticate with a JSON credential file. | `Password` | | Provider Secret | Yes | API key, token, or service-account JSON. Use **Rotate** in the UI to replace a stored secret without clearing the rest of the form. | `sk-proj-...` | | Enable provider | Yes | Toggle on to expose the provider with this configuration. | toggle | Repeat for each provider to expose. ### Step 4: configure LLM models The wizard shows a single list of all models Agent Router supports, maintained by Tetrate. By default, a selective set of common models is enabled. Deselect models to control cost, meet data-handling requirements, or scope to the intended use case. Models remain configurable later from the Admin Dashboard. If a required model is missing, contact Tetrate support. :::note Custom model entries are not configurable in onboarding. ::: ### Step 5: Configure AI gateway This final step generates the credentials the data plane uses to authenticate to the management plane. Click **Create Service Account**. A `service-account.json` file downloads. The credential is valid immediately and can be used to run `tare install` as soon as it lands. :::warning The download is **one-shot**. If the browser blocks it or the file is lost, the same credential cannot be downloaded again; regenerate it instead (see below). ::: :::warning Treat `service-account.json` as a long-lived secret. Store it in a secret manager; do not commit it to source control. ::: #### Regenerate the service account file If the file is lost, regenerate it from the Admin Dashboard: 1. Sign in to the Admin Dashboard. 1. Go to **System | Settings**. 1. Open the **Licenses** tab. 1. Click **+ Generate New License**. A new `service-account.json` file downloads. Older files remain valid until revoked. ### Complete the process Click **Complete setup** to finish onboarding. Where to go next Data plane installation Install the data plane with the `service-account.json` credential from Step 5. Configure SSO (if deferred) Complete OIDC setup if SSO was skipped in the wizard. Required before developer handoff.