Understanding Orka Credentials

Learn how Orka’s three credential systems work, when to use each, and how to avoid the common mistake of using short-lived tokens in CI/CD pipelines.

New Orka users typically hit three different credential prompts before they can do anything useful, and none of the three are the same thing. Here’s how they fit together.

The three systems

1. MacStadium portal credentials

Your MacStadium account username and password. Use these to log in to portal.macstadium.com to access your IP Plan, manage billing, and request changes to your cluster.

These credentials have nothing to do with Orka itself — they don’t let you deploy VMs or run CLI commands.

2. Orka user tokens

Orka’s own authentication layer, separate from the portal. You log in with:

orka3 login

This mints a short-lived token that expires after 1 hour. The token is scoped to your Orka namespace and lets you run CLI commands, deploy VMs, manage images, and access the web UI.

Do not use orka3 login or orka3 user get-token in CI/CD pipelines. Tokens expire after 1 hour and will break long-running jobs.

For CI/CD, use service accounts instead:

orka3 sa create <SERVICE_ACCOUNT_NAME>
orka3 sa token <SERVICE_ACCOUNT_NAME> --no-expiration

Service account tokens are long-lived (default: 1 year) or non-expiring, and are designed to be injected as environment variables in your pipeline. See Manage Service Accounts for the full workflow.

3. VM credentials

The macOS username and password inside each VM. These are what you use to SSH in or connect via Screen Sharing.

MacStadium base images ship with default credentials:

• Username: admin
• Password: admin

Change the default VM password after your first login. The default admin/admin credentials are well known and your VMs are accessible to anyone with VPN access to your cluster.

Quick reference

Credential	Used for	Expires
MacStadium portal login	portal.macstadium.com — billing, IP Plan, account	No
orka3 login token	CLI and web UI (human use)	1 hour
Service account token	CI/CD pipelines and automation	1 year (or never)
VM credentials	SSH, VNC into VMs	Never (until you change them)

Common mistakes

Using orka3 login in a pipeline. The token will expire mid-job and cause confusing authentication errors. Use a service account.

Rotating portal credentials and expecting Orka to break. They’re independent — changing your portal password doesn’t affect your Orka tokens or service accounts.

Leaving VM credentials at admin/admin. Every VM on your cluster shares the same default, so a single compromised VM credential means all of them are exposed.