Get started with Tessera

Rent Linux machines by the hour and run them with a prompt. You can go from nothing to a machine you control through Claude with a single command — no dashboard visit required.

Get started in one line

Two real paths. If you have never signed up, create your whole account straight from the terminal or from Claude itself. If you already have an API token, connect and go.

Brand new? Create an account through Claude — no website

Two equivalent ways, both with the free trial above — and both hand you a full-access token, so Claude can create your machine and build inside it (open a shell, run commands), the whole flow from one chat. Pick whichever fits how you work.

curl -fsSL https://tesserahosting.com/start | sh

claude mcp add --transport http tessera-start https://api.tesserahosting.com/mcp

Already have a token? Connect and go

If you already created an account (on the web or earlier), connect the full Tessera server with your token. Paste your token in place of orb_YOURPREFIX_YOURSECRET:

claude mcp add --transport http tessera https://api.tesserahosting.com/mcp --header "Authorization: Bearer orb_YOURPREFIX_YOURSECRET"

Sign up & create your first machine

Prefer a dashboard? Sign up in the browser and build your first machine with the guided wizard. This creates exactly the same account the one-liner does — you can add AI access to it any time.

1. Create your account

Head to dashboard.tesserahosting.com and create an organisation. Everything you build lives inside your organisation, and you can invite teammates to it later.

1. Open the sign-up page and fill in your organisation name, your name (optional), your email, and a password of at least 12 characters. Result: your organisation is created and you are signed straight in.
2. Choose Create an API key when prompted, or skip it — you can always mint one later under Settings → API tokens. Result: if you create one, the key is shown once along with a ready-to-paste command for Claude Code. Copy it before you leave the screen.
3. Choose Create my first machine to jump straight into the wizard, or Skip to dashboard.

2. Create your first machine

The New machine wizard walks you through everything a machine needs. Its steps stay open on a rail down the left — go back to any of them to change your mind before you build.

1. What are we making? — give the machine a name (like orders-api), an optional note about what it is for, and pick an operating system. Optionally choose a one-click stack (like LAMP) to have software installed and configured at first boot.
2. How big should it be? — pick a preset size, or choose Custom and set processors, memory and storage yourself. An allowance panel shows how much of your quota the choice uses. Result: storage can be grown later but never shrunk, so choose it deliberately.
3. How should the storage be laid out? — keep one system disk, or add a separate data disk with its own mount point.
4. Where does it live? — join a private network (or create one on the spot). The machine's address is assigned for you out of the network's range.
5. What can reach it? — nothing is open until you say so. Add the ports you need, and choose who each is reachable from. (SSH on port 22 is handled separately and is always available through the secure door.)
6. Who can sign in? — tick the SSH keys to install, make a new key in your browser, or paste a public key. Set a console username and password for the in-browser console. Result: a browser-made private key is downloaded to you when the machine is created — the platform only ever receives the public half.
7. Ready to build — review every choice, optionally attach a git repository to deploy from, then press Create machine. Result: the wizard takes you to the machine's own page, where the one-time console password, the connect command, and any stack credential are shown. Save the password — nothing keeps a readable copy of it.

AI access (MCP)

Connect Tessera to Claude Code or ChatGPT and your AI can build and run your infrastructure for you — create machines, wait for them to come up, run commands inside them, open ports, attach domains, and check your spend, all in plain language.

Get an API token

Your AI authenticates with an API token. Every token looks like orb_YOURPREFIX_YOURSECRET and carries only the scopes you grant it — a read-only token is perfect for letting an assistant explore; creating and deleting machines needs the matching :write scopes.

1. In the dashboard, open Settings → API tokens and mint a new token (the onboarding screen can create one named "AI access (MCP)" for you). Result: the secret is shown once and never again. Copy it now.
2. Keep the whole string, including the orb_ prefix. This is what you paste below.

Connect Claude Code

Run this once in your terminal, pasting your token in place of orb_YOURPREFIX_YOURSECRET:

$ claude mcp add --transport http tessera https://api.tesserahosting.com/mcp \
    --header "Authorization: Bearer orb_YOURPREFIX_YOURSECRET"

Connect ChatGPT

Tessera publishes an OpenAPI description you can import as a custom GPT Action:

1. In the GPT editor, add a new Action and import the schema from https://api.tesserahosting.com/api/openapi.json.
2. Set the authentication to API Key → Bearer, and paste your orb_… token as the key. Result: the GPT can now call every Tessera endpoint your token's scopes allow.

Use Tessera on mobile — the Claude connector

There is a third way to connect, and it is the one that reaches your phone. Add Tessera once as a custom connector in claude.ai (in a browser) or in Claude Desktop, and it syncs to the Claude mobile apps automatically — so you can create and run machines, check your spend, and more from a chat on the go. It talks to the same MCP server as the claude mcp add command above; you are just wiring it up through Claude's own settings instead of the terminal.

1. Open claude.ai in a browser, or the Claude Desktop app — not the mobile app. Custom connectors are added from web or desktop; your phone picks them up afterwards.
2. Go to Settings → Connectors and choose Add custom connector.
3. Paste the Tessera MCP server URL, give it a name such as Tessera, and click Add:
   MCP server URL copy

   https://api.tesserahosting.com/mcp

4. Authenticate with your API token. Provide your orb_YOURPREFIX_YOURSECRET token where the connector asks for authentication — for example as an Authorization header with the value Bearer orb_YOURPREFIX_YOURSECRET. Result: the connector shows as connected and Tessera's tools become available in your chats.

What your AI can do

Once connected, your AI has a full toolbox. You never call these tools yourself — you describe what you want and the AI chooses them. A few things to try:

Create, wait, and build inside a machine

The AI can create a machine, block until it is genuinely ready, then run commands and build your app inside it.

Under the hood it creates the machine, polls until it reports running, enables operator access, and runs your build commands — reporting progress as it goes.

Lifecycle: start, stop, reboot, resize, delete

Networking: ports and domains

Check your spend

Accessing your machine

You can reach a machine three ways: over SSH with your own key, through the in-browser console, or by granting your AI operator access so it can work inside the machine for you.

a. SSH with your own key

SSH is key-only — passwords are never accepted over SSH. Every connection goes through a single secure door that authenticates you with a key you registered, then forwards you only to machines your organisation owns. You never need a public address for the machine itself.

1. Install a key on the machine: tick it in the wizard's Who can sign in? step, or add one under Settings → SSH keys and include it when you create a machine. (Keys are installed at build time.)
2. Open the machine's page in the dashboard and copy the connection command shown there. It is generated for your machine and already routes through the secure door.
3. Replace {key} with the path to your private key and run it. Result: you land on the machine as your login user. If SSH for the machine is restricted to your VPN, the page tells you so and gives you the direct command to use once the tunnel is up.

The command takes this shape (copy the real one from your machine's page rather than typing it by hand):

$ ssh -i {key} -o IdentitiesOnly=yes \
    -o "ProxyCommand=ssh -i {key} -o IdentitiesOnly=yes -W %h:%p -p 2222 <door>" \
    {user}@<machine-address>

b. The in-browser console

Every machine has a console you can open from its page in the dashboard — no SSH client, no key, and no network path into the machine required. It is the way back in if you ever lock yourself out over the network.

• Sign in at the console with the console username and password you set in the wizard's Who can sign in? step (the one-time password was shown on the machine's page right after it was built).
• The console works from anywhere and is unaffected by your firewall or VPN rules, because it does not reach the machine over the network at all.

c. AI operator access

To let your AI work inside a machine — run commands, read and write files, tail logs — you grant operator access. It is off by default, granted per machine, and completely revocable.

Enabling it provisions one dedicated, non-root account on the machine called ai-operator. Everything the AI does lands as that account. You will see it in the machine's account list — operator access is a visible, removable account, never a hidden backdoor.

1. Ask the AI to enable operator access (or turn it on from the machine's page). If the machine needs one restart to pick up its agent, you are asked to consent to that first. Result: the AI waits until access is fully live before it runs anything.
2. For native-speed SSH, the AI authorises its own public key onto the ai-operator account — the platform only ever sees the public half.
3. Grant sudo only if the AI needs administrative rights. This is a separate, explicit escalation from enabling access — the operator stays non-root until you grant it, and you can revoke it at any time.

Auto-scaling

Let a machine grow itself when it is busy, between a floor and a ceiling size you choose. It is an opt-in you set per machine — Tessera never resizes a machine you have not put a policy on.

What it does

Auto-scaling moves a machine up and down through the standard sizes (Small → Standard → Large → X-Large) in response to how hard it is working. You set the smallest and largest size it is allowed to reach; it never goes below your floor or above your ceiling.

Wherever the hardware allows, growth is live, with no interruption:

If a machine has to move to make room to grow, that move is also live — you are told it "scaled up to give it room, with no interruption". Every scale is written to the machine's history with an honest note of what happened and whether there was any downtime.

Thresholds, hysteresis and cooldown

A policy decides when to move using sustained utilisation, so a brief spike never triggers a resize:

The scale-down level must sit below the scale-up level — that gap is the hysteresis that stops a machine bouncing between two sizes. The cooldown makes it wait after every change before it will move again.

Enabling a policy

1. Open the machine's Auto-scale settings, or ask your AI to set it up.
2. Pick the smallest and largest size it may use, adjust the levels if you want, and turn it on. Enabling with defaults means "grow up to the largest size if you need to, never below where you are now".

Images & one-click apps

Start from a clean operating system, or from a turnkey stack that arrives already installed and configured. Ask your AI to "list the images" or "list the stacks" any time to see the live catalogue.

Operating system images

Eight current, signature-verified Linux images:

You can also boot from your own installer media instead of an image and install by hand at the machine's console.

One-click stacks

Fourteen turnkey setups. Choose one in the wizard's first step, or pass it when you create a machine, and it is installed and configured at first boot. Stacks that serve the web publish on your domain over HTTPS; database and cache stacks are reachable only from your own machines and your VPN.

Machines

A machine is a Linux server you rent by the hour. Pick a preset size, or dial in exactly the processors, memory and storage you want.

Preset sizes

Custom sizes

Choose Custom in the size step to set your own shape within these bounds:

• Processors: 1 to 16 vCPU
• Memory: 0.5 GiB to 64 GiB, in 0.5 GiB steps
• Storage: 10 GiB to 2 TiB, in 10 GiB steps

Lifecycle

• Start / stop / reboot — a machine bills while it is running; stop it when you are done.
• Resize — change the size at any time. The machine must be stopped to resize by hand, and storage can only grow, never shrink. (Running machines can grow live under an auto-scale policy.)
• Delete — permanently removes the machine and its disks. This cannot be undone.
• Export — download a machine as a standard portable disk image plus its configuration, so you can run it elsewhere. There is no export fee, and no lock-in.

Networking

Private networks wire your machines together; a firewall controls what can reach them; custom domains publish them; and a personal VPN lets you reach them privately.

Private networks

Machines on the same private network reach each other privately, and nothing else can. Each machine is assigned a fixed address out of the network's range when it is built, and keeps it for as long as the machine exists. When you create a network you choose its size:

Firewall (open ports)

Inbound is deny-by-default — nothing is reachable until you open a port. Rules can apply to one machine or to your whole organisation.

• Presets for common services: http, https, postgres, mysql, rdp, ping.
• Or a protocol (tcp, udp, icmp) with a single port like 8080 or a range like 8000-8100.
• Reachable from: Anywhere, only through your VPN, only your other machines, or a specific address or range.

Custom domains & TLS

Attach your own domain (like shop.example.com) to a machine from the machine's own page. You choose who terminates TLS — the platform edge or the machine itself — and, if verification is pending, Tessera gives you the exact DNS record to add. Point the domain elsewhere any time; it is yours.

VPN

Enrol a WireGuard device to reach your private networks over an encrypted tunnel. You generate the keypair and register only the public key — the private key never leaves you — and get back a ready-to-use configuration. Choose a split tunnel (only Tessera traffic goes through it) or a full tunnel.

Billing

Tessera is prepaid: you keep a wallet topped up, and machines draw from it by the hour while they run.

How charges work

• Billing is prepaid, in US dollars.
• A machine is metered by the hour it runs, on its processors, memory and storage. Stop a machine and the compute charge stops.
• Ask your AI "what's my current bill?" or open the wallet in the dashboard to see the running total, the current unit prices, and the per-line charges.

Top-ups

Add funds to your wallet at any time. The dashboard offers quick top-up amounts, or enter your own within the allowed range.

Running low

You choose what happens as your balance runs down (under your wallet's low-balance setting):

• Auto-refill — when the balance drops below a threshold you set, Tessera automatically charges your saved card for a top-up amount you choose, so your machines keep running.
• Pause at zero — let machines stop when the wallet empties, rather than spending more.

If the balance reaches zero (and auto-refill is off or cannot charge), your machines are paused — stopped with their state saved, never deleted — and a top-up brings them straight back. There is a grace period before that pause, and further notice before anything is ever removed, so running out is always recoverable.

API

Every action in Tessera is a REST call with a bearer token. Curl it, put it in CI, or build your own control panel — the same API your AI uses over MCP.

Base URL and authentication

• Base URL: https://api.tesserahosting.com/api
• Auth: send your token as Authorization: Bearer orb_YOURPREFIX_YOURSECRET.
• OpenAPI: the full machine-readable description lives at https://api.tesserahosting.com/api/openapi.json — import it into ChatGPT, Postman, or a client generator.

$ curl -X POST https://api.tesserahosting.com/api/machines \
    -H "Authorization: Bearer orb_YOURPREFIX_YOURSECRET" \
    -H "Content-Type: application/json" \
    -d '{"name":"web-1","image":"debian-13","size":"s1.medium"}'

Tokens and scopes

Mint tokens under Settings → API tokens. The secret is shown once and cannot be shown again — copy it when it appears. You also choose when it expires (30, 90, or 365 days, or never).

Every token carries scopes — grant a token only what it needs. A read-only set is ideal for letting an assistant explore; creating and deleting needs the matching :write scopes. The full scope vocabulary:

Asynchronous operations

Anything that changes a machine (create, start, stop, resize, delete, and more) is asynchronous. The API accepts the request and returns 202 immediately with a job to track. Read the machine back until its status settles into the state you asked for — rather than assuming the change is instant. Your AI does this waiting for you over MCP.