Skip to main content
OpenLegion managed hosting gives you a dedicated VPS running your own agent fleet — no infrastructure to set up or maintain. Sign up at app.openlegion.ai, pick a plan, and your fleet is live in roughly 5-15 minutes.

​
The journey end-to-end

1. Sign in (OAuth: Google / GitHub / Discord)
2. Pick a plan and check out via Polar (no free trial — card charged immediately)
3. Choose a subdomain   →   my-fleet.engine.openlegion.ai
4. Wait for provisioning (~5-12 min) — server, install, configure, go live
5. Click "Open Dashboard" to single-sign-on into the engine
6. Work with your fleet in the engine UI (Chat / Work / Team / Settings)
The app at app.openlegion.ai handles account, billing, and instance lifecycle. Your dedicated server at {subdomain}.engine.openlegion.ai runs the full OpenLegion engine — the same software available to self-hosted users.

​
1. Sign up

Sign in at app.openlegion.ai/signin with Google, GitHub, or Discord (whichever your operator has enabled). There is no email / password option, no magic link, no anonymous mode. The first OAuth callback creates your account; subsequent sign-ins reuse it. Sessions use a stateless JWT strategy — there is no server-side session revocation.

​
2. Pick a plan

Four self-serve tiers are available; Enterprise is contact-sales only.
PlanMonthlyYearlyAgentsBrowsersProjects
Basic$19/mo$170/yr110
Growth$59/mo$530/yr552
Pro$149/mo$1,340/yr15105
Pro Max$279/mo$2,510/yr303010
Yearly billing saves approximately 25%. See Plans & Billing for upgrade / downgrade / cancellation rules.
No free trial. Your card is charged at checkout. Payments are processed by Polar (the checkout, webhooks, and billing portal are Polar-hosted). For higher limits, dedicated infra, or a custom contract, email admin@openlegion.ai.

​
3. Choose a subdomain

After checkout you land on the setup wizard. Pick a subdomain — this becomes your permanent fleet URL: 
https://my-fleet.engine.openlegion.ai
Rules: 3-20 chars, must start with a lowercase letter, must end with a lowercase letter or digit, only lowercase letters / digits / hyphens, no consecutive hyphens. About 30 reserved names (api, admin, dashboard, app, auth, www, etc.) are blocked. The page live-checks availability as you type (500ms debounce). Subdomains held by deprovisioned or failed instances are released back into the pool.

​
4. Provisioning

Your dedicated server is being set up. The setup page polls every 10s and shows live progress through four stages:
  1. Creating your dedicated server — a Hetzner Cloud VPS is provisioned. ARM is preferred (cax11/cax21/cax31/cax41) with x86 fallback (cpx21/cpx31/ccx23/ccx43). Provisioner tries the fallback chain up to 3 times with 30s / 120s / 300s backoff.
  2. Installing OpenLegion — cloud-init installs the ufw firewall, hardens SSH, installs Docker (GPG-verified), Caddy (auto-SSL via Let’s Encrypt), and a tiny Python auth-gate sidecar on 127.0.0.1:9401. The engine repo is cloned and the systemd openlegion service is enabled (but not yet started).
  3. Configuring your instance — your selected LLM API keys (11 allowlisted providers, 256-char per value) are written, the auth-gate’s access token is provisioned, and the engine starts.
  4. Go live — DNS (Cloudflare A record, TTL 60s, dns_only=True) propagates, Caddy issues your TLS cert, and the engine becomes reachable on your subdomain.
Typical total: 5-12 minutes. After running the app polls /api/instance/ready for up to 5 minutes waiting for the public URL. Every configured managed instance is provisioned with OpenLegion’s credit-backed proxy as the default model (openlegion/openai/gpt-5.4). You don’t need to bring your own API key to start chatting; BYOK keys you supply at configure time overlay on top of the credit proxy.

​
If provisioning fails

The setup wizard renders an error card with a Retry button. Three failure modes:
  • failed (generic) — full VPS cleanup, retry runs from scratch
  • bootstrap_failed — SSH never came up or cloud-init failed — VPS is cleaned up
  • configuration_failed — VPS is healthy but the configure step failed — the VPS is kept and retry just re-runs /configure
A stuck-instance scheduler also recovers anything that hangs: >45 min in queued / provisioning / bootstrapping → failed; >10 min in configuring → configuration_failed; >45 min in deprovisioning → deprovisioned.

​
5. Open Dashboard (SSO into the engine)

Once your instance is running, the app dashboard surfaces an Open Dashboard button. This is the only way to enter the engine from the app — direct navigation to your subdomain requires an active engine session. Click it and:
  1. The app calls /api/auth/engine-login?subdomain=... (rate-limited 10/60s).
  2. The app decrypts your stored access token (AES-256-GCM) and signs a short-lived token: {expiry}.HMAC-SHA256(raw_token, "{subdomain}:{expiry}") with a 5-minute TTL.
  3. Your browser is 302-redirected to https://{subdomain}.engine.openlegion.ai/__auth/callback?token=....
  4. The auth-gate sidecar (running on the VPS, separate from the engine) verifies the HMAC, enforces TTL, rejects replays, and sets an ol_session cookie (HttpOnly, Secure, SameSite=Lax, 24h max-age).
  5. You’re redirected to your engine root.
Subsequent requests inside the engine go through Caddy’s forward_auth checking that cookie. The cookie auto-renews if its remaining life is below half the max age.

​
6. The engine dashboard

You land on the engine SPA at {subdomain}.engine.openlegion.ai. Four top-nav tabs:
TabWhat you do here
ChatMulti-agent chat. Your primary conversation surface.
WorkKanban (Pending / Working / Blocked / Done), “Needs You” panel, activity feed with pinned blockers, recently delivered previews.
TeamAgent grid. Inspect, edit, and manage individual agents.
Settings11 sub-tabs: Activity, Costs, Automation, Integrations, API Keys, Wallet, Network, Storage, Operator, Browser, Settings.
The engine SPA streams real-time updates via a /ws/events WebSocket (50 event types, 500-event ring buffer).

​
What you get with every plan

  • Dedicated single-tenant VPS — one VPS per subscription. No shared engine processes between users.
  • Custom subdomain — {your-name}.engine.openlegion.ai
  • Container-isolated agent execution — each agent in its own Docker container with private memory, tools, schedule, and budget
  • OpenLegion-managed LLM credits — every instance ships with the credit-backed openlegion/openai/gpt-5.4 default model. BYOK keys overlay on top to add more providers.
  • 100+ LLM providers via LiteLLM
  • Multi-channel support — Telegram, Discord, Slack, WhatsApp, and Webhook
  • Real-time monitoring dashboard with cost tracking and budgets
  • Browser automation — plan-dependent concurrent browsers (1, 5, 10, or 30)
  • Automatic health monitoring — provisioner pings every 5 minutes and auto-restarts unhealthy instances up to 3 times

​
Self-hosting vs managed

Managed HostingSelf-Hosted
SetupSign up and go live in ~5-12 minutesClone repo, install dependencies, configure
InfrastructureHetzner Cloud VPS provisioned + maintained by usYou manage the server
UpdatesPushed by the OpenLegion team; no user action requiredYou pull and restart
MonitoringBuilt-in health checks + auto-recoveryYou set up monitoring
LLM creditsOpenLegion credit proxy included; BYOK overlaysBYOK only
Cost19−19-279/mo + your LLM API costs (or use managed credits)Your VPS + LLM API costs
ControlFull engine via SSO; some operations user-gated (see below)Full source + filesystem access

​
What the app dashboard does NOT do

The app at app.openlegion.ai is intentionally narrow. It handles signup, billing, provisioning, and SSO — it does not offer:
  • User-initiated pause / resume (pause happens automatically after 3 days past-due)
  • Region picker (server location chosen by provisioner fallback chain)
  • “Rotate access token” UI
  • Re-configure-API-keys UI (configure is fire-once; change keys from the engine’s Settings → API Keys tab)
  • Multi-instance support (one VPS per subscription)
  • Log streaming or per-agent metrics dashboards

​
Billing problems

If a payment fails, your subscription enters past_due and a banner appears on the app dashboard. You keep service for a 3-day grace period to update your payment method. After 3 days the instance is paused (systemctl stop); after 14 days without payment the VPS is permanently deprovisioned (and all data with it). See Plans & Billing for details.

Get Started

Sign up and launch your fleet in roughly 5-12 minutes.