1. NGC User Guide

This guide explains how to set up and manage NVIDIA GPU Cloud (NGC), including accounts, users, pretrained models, and NGC AI and HPC tools.

1.1. What Is NVIDIA NGC?

NVIDIA NGC™ is a cloud platform for fully managed services. These services include NVIDIA AI Enterprise, NVIDIA DGX™ Cloud, and NVIDIA Nemotron™ Speech for natural language understanding (NLU) and speech AI.

You can use DGX Cloud for model training, NVIDIA AI Enterprise for the latest NVIDIA NIM™ models, and the NGC Private Registry to share proprietary AI software. NGC also hosts a catalog of GPU-optimized AI software, software development kits (SDKs), and Jupyter Notebooks. NVIDIA AI Enterprise provides support for these workflows.

Enterprises access their AI cloud services through a dedicated virtual NVIDIA Cloud Account (NCA) linked to the NGC organization where their services are enabled.

1.2. Why NGC Software

NGC provides software to meet the needs of data scientists, developers, and researchers across various levels of AI expertise.

All software hosted on NGC is scanned for common vulnerabilities and exposures (CVEs), cryptographic material, and private keys.

In addition to security scanning, NGC software is tested against a wide range of GPU-enabled platforms. These platforms include public cloud instances, workstations, and OEM servers designed for data center or edge deployments. Supported GPUs include H100, V100, A100, T4, Jetson, and the RTX Quadro.

NGC tests software to scale across multiple GPUs and, in some cases, across multiple nodes, so you can use GPU-powered servers as published.

For select containers, NVIDIA offers NGC Support Services to run software on DGX platforms or certified OEM servers. Enterprise IT can contact NVIDIA subject matter experts to resolve software issues and reduce downtime.

1.3. NGC Organizations and Teams

An NGC organization (org) is where administrators manage users, teams, and access to NGC services. Each NGC org maps one-to-one to a linked NVIDIA Cloud Account (NCA) membership record, and both share the same account number.

Users can access an NGC org in the following ways:

1. Sign-Up through the NGC Portal: A user can sign up for a free NGC org through the NGC sign-in portal. NGC creates the linked membership record and enables the org with NGC Catalog access (public artifacts only).

2. Entitlement Certificate Email: NVIDIA grants entitlement to a service delivered in NGC through a purchase order, early trial program, or other commercial offer. NVIDIA then sends an entitlement certificate email, which includes a certificate PDF, to the entitled company or person. The recipient opens the PDF and follows the link in it to begin the entitlement registration flow and activate the service in the NGC org.

3. NGC Org Invitation: An NGC org owner or user admin invites users from the NGC Org Users page and assigns their NGC roles and service access. If the org is linked to an external identity provider (IdP), the owner or user admin can instead manage membership through IdP membership rules mapped to the NGC org. Only enterprise orgs support additional NGC users.

Users who sign up through the NGC sign-in portal receive an individual NGC org that is automatically enabled with NGC Catalog access. An individual org supports a single org owner. Use an enterprise NGC org to add users and assign NGC access.

NVIDIA grants a premium cloud service subscription, such as NVIDIA AI Enterprise or NVIDIA DGX Cloud, through a purchase, an early access program, or the NGC Activate Subscription portal. NVIDIA enables subscriptions on enterprise NGC orgs. An enterprise org supports additional users, NGC teams, and role-based access rules.

1.3.1. NVIDIA Cloud Accounts and NGC

NVIDIA Cloud Accounts (NCA) provide the membership service that an NGC org checks against. Each NGC org maps one-to-one to an NCA membership record, but NCA does not grant NGC roles or service access.

The following diagram shows how NCA, NGC orgs, and teams relate.

Use the NGC Org user-management experience to add users, assign roles, promote, demote, and remove users. NGC automatically updates the linked membership record.

The following screenshot shows the NGC Add User pane.

You also assign NGC roles and service access from the NGC Org UI, including access to services such as NVIDIA AI Enterprise and NVIDIA DGX Cloud.

Use NCA only for account-level tasks that are separate from NGC user management, such as:

• Setting up an account recovery email (recommended)

• Managing billing

• Entering company information

• Configuring IdP federation when required

Removing a user from an NGC org revokes all of that user’s NGC roles and service access. The user remains a member of the linked NCA but can no longer access NGC services through that org.

Important

Do not use the NCA UI to add, remove, promote, or demote users for NGC. NCA cannot grant NGC roles or service access, so changes that you make in NCA do not grant NGC access.

For NGC user management, use the NGC Org UI.

1.3.2. NGC Teams

NGC organizations (orgs) serve as the top-level container for enterprise deployments. Within an org, administrators can create teams to implement role-based access control and segment private registry resources by department or project.

Teams provide isolated registry namespaces, ensuring members can share containers, models, and resources within their team while maintaining separation from other teams in the organization.

The following roles control who can manage users:

• Org owners and org-level user admins: Create teams and manage users across all teams

• Team-level user admins: Manage users within their assigned team only

Note

NVIDIA does not provide user management services. You are responsible for all user provisioning.

To create an NGC team, follow these steps:

1. Log in to your NGC org.

2. Select Organization from the user account menu.

   

3. On the dashboard or in the left navigation, select Teams.

   

4. On the Teams page, click Create Team on the upper right corner.

   

5. Enter a team name and description. Team names must be all lowercase.

6. Click Create Team to finish.

1.3.3. NGC Org Owner and Other Org Users

When an NGC org is created, NGC creates a linked NCA membership record. The initial org owner manages users, roles, and NGC service access from the NGC Org UI.

An individual org is accessible only by the org owner. Additional users are not supported. To verify the type of org you manage, sign in to NGC. Under the user account menu, select Organization, then select Organization Profile under Identity & Access in the left navigation.

The org owner has the highest administrative privileges in an NGC org. In an enterprise org, the owner can use the NGC Org UI to add and remove teams and users, and to assign NGC roles. The owner assigns the organization-level or team-level access that each user needs.

An org supports up to three org owners. Only an org owner can add or invite additional org owners. All org owners must share the same email domain.

For example, if the users’ email addresses are john@intelligence.ai, jane@intelligence.ai, and peter@intelligence.ai, then all three can be added as org owners because their email address domains match. In contrast, if Peter’s email address were peter@artificial.ai, Peter could not be added as an org owner.

Follow the steps in the next section to add a new org owner or additional users with different access permissions.

1.3.3.1. Adding NGC Users to an Org

Only NGC org owners and user admins can perform user management operations. NVIDIA cannot manage users on behalf of a customer.

To add a new org owner or a user with different access permissions, complete the following steps.

1. Sign in to NGC. Select the NCA account linked to the NGC org that you want to manage, and click Continue.

   

2. Select Organization from the user account menu.

   

   On the dashboard or in the left navigation, select Users from the Identity & Access menu.

   

3. Click Invite New User in the top-right corner.

   Important

   If your org is linked to an external identity provider (IdP) or single sign-on (SSO) service, NVIDIA recommends that you manage user membership with NGC IdP Membership Rules. If your IdP does not support groups, use the NGC add user service.

   

4. In the User Invitation section, do the following:

   • Enter the user email address, making sure that the domain matches your email domain.

   • Customize the invitation email to explain the purpose of the invitation (optional).

   • Set an expiration for the invitation link (default: 24 hours).

   • Click Next: Assign Roles.

   

5. On the Assign Roles step, assign roles based on the type of user that you are adding.

   1. Adding an Org Owner

      To make the user an org owner:

      • Select Organization Owner from the Roles list. Since this is an organization-level role, you do not need to choose a scope.

      • Click Add Role to finish.

        

   2. Adding Other Users

      To assign controlled permissions to a user:

      • Roles without the Default scope allow a Custom Scope, so you can choose either Organization or one or more Teams to customize access.

      • Assign a role for each NGC application, depending on the level of access that you want to grant the user.

      • Click Add Role to assign each role.

        

      In this example, the user has the User role for NGC Private Registry. This role limits the user to viewing and pulling artifacts from the NGC Catalog, and to pushing and pulling artifacts in the org’s private registry.

      To learn more about NGC product roles, refer to the documentation for each product.

      Note

      The Public API Endpoints User role controls access to NVIDIA API Catalog NIM endpoints. Assign this role to NGC org users who need to generate an NGC Personal Key for the API Catalog. For more information, refer to Assigning Services to Your Personal API Key. To update user roles, refer to Updating User Roles.

   3. Assigning Team Roles

      Assigning permissions at the Team level grants the user access only to the resources, such as containers and models, that are shared with that specific team. To grant a user access to resources across the entire org, assign roles at the Organization level.

6. The user receives an NCA invitation email and accepts the invitation to access the NGC org.

After all three org owner slots are filled, any org owner can replace another org owner when needed. To remove an org owner, go to the Users list and select Remove User.

When an org owner is removed, NGC sends an email notification to the remaining active owners. To invite a replacement owner, use the same steps described earlier.

1.3.3.2. Updating User Roles

A user’s roles determine which NGC services and resources the user can access. Assign and remove roles in the NGC Org UI, because the NCA UI cannot grant NGC roles or service access.

To update a user’s roles, complete the following steps.

1. Sign in to NGC. Select the NCA account linked to the NGC org that you want to manage, and click Continue.

   

2. Select Organization from the user account menu.

   

   On the dashboard or in the left navigation, select Users from the Identity & Access menu.

   

3. To locate the user, click Filter, select User, enter the email address or name, and then click Apply Filter.

   

4. Click the user that you want to modify. On the Roles tab, click Edit Role Assignments.

   

5. Under Choose Roles, select the role to add to the user, and then click Assign. A confirmation message appears.

   

6. To remove a role, click the X on the assigned role, or select the role under Choose Roles and click Remove.

   

   A confirmation dialog appears.

1.3.3.3. Removing a User from an NGC Org

Only an org owner or an organization-level user admin can remove a user from the org.

To remove a user from an NGC org, complete the following steps.

1. Select Organization from the user account menu.

   

   On the dashboard or in the left navigation, select Users from the Identity & Access menu.

   

2. Use the filtering bar to find the email address of the user that you want to remove.

   

3. Click the Actions ellipsis and select Remove User.

   

Removing a user from an NGC org revokes all of that user’s NGC roles and service access in that org. The user remains a member of the linked NCA, where user tenancy is managed. Remove NGC users in the NGC Org UI, because the NCA UI cannot grant or revoke NGC roles or service access.

1.3.3.4. Securing the Owner Account with Multi-Factor Authentication

When you create your owner account, you receive an NVIDIA identity account. The account is protected by the password you set during owner account creation. You can further secure the owner account by setting up multi-factor authentication:

1. Go to NVIDIA and click the sign-in icon.

   

2. Sign in with the credentials you set up during the org owner account setup.

3. From your NVIDIA user profile page, navigate to the bottom, click Security settings, then Update.

   

4. Enter your password again to access the security settings.

5. Navigate to the Multi-factor Security settings.

   

6. Configure multi-factor authentication for your identity account. Refer to the NVIDIA N-factor help page for setup details.

1.3.3.5. Contacting Your Org Owner

If you need to contact the organization owner to request a new service subscription or add a new user, use the Contact Admin option in your user account menu.

1. Sign in to the NGC application with your organization, then click your user ID in the top-right corner to access the user account menu.

   

2. Select Contact Admin to open the email editor dialog.

   

   Within this editor, you can choose from the following email templates:

   • Product Request: Use this template when requesting a specific product for your <org-name> organization. For example, “I’d like to request the [product name] product for the <org-name> organization.”

   • Team Access Request: Select this template if you need to request access to the org or a particular team, such as “[team-name],” within your <org-name> organization.

   Both templates come with pre-populated message content, but you can edit or delete portions of the message to create a customized message to send to your organization owner.

   

3. When you are ready to send the message, click Send.

   The organization owner receives an email from noreply-ngc@nvidia.com that includes your email address. The following image shows a sample email message:

   

   You can contact your organization owner with the Contact Admin option.

1.3.3.6. External User Groups

As an NGC organization owner or administrator, if you need to share NGC resources with users outside your organization, use External User Groups. Adding external users as regular account members can grant broader account access than intended. External User Groups grant permissions to a group instead of adding those users directly to your NGC organization.

The External User Groups page has tabs for Managed External User Groups, Delegated External User Groups, and API Keys. Use Managed External User Groups when your NGC organization creates and manages group membership. Use Delegated External User Groups when an external company administrator manages membership and your NGC organization controls the permissions.

External User Groups are supported for NGC applications such as Private Registry and Catalog. An organization can have up to 500 external user groups, and each group can include up to 1,000 users.

For managing access in your organization, NGC recommends the following approach:

• For your company’s internal users: Add them as account members through the Users management page or use your enterprise IdP to grant access with IdP groups.

• For external users with email domains outside your company or IdP: Use External User Groups.

1.3.3.6.1. Managed External User Groups (mEUG)

A Managed External User Group (mEUG) is created, owned, and managed by an NGC organization owner or authorized user administrator. Use a managed group when your NGC organization needs direct visibility into the group membership and wants to add or remove external users itself.

Managed external user groups are designed for secure collaboration with external users while keeping their tenancy separate from the main NGC organization. External users receive only the permissions granted to the group and do not receive the broader access that internal account members can have.

NGC organization owners and user administrators are not automatically granted management access to a managed external user group. To manage the group’s members, an owner or administrator must be explicitly added to the group by the group owner.

1.3.3.6.1.1. Creating a Managed External User Group

1. Sign in to NGC and open the NGC organization you want to manage.

2. From the user account menu, select Organization.

   

3. In the left navigation or on the main panel, select External User Groups.

   

4. On the Managed External User Groups tab, click Create Group.

5. Enter the group name and description.

   

6. Create the group, then assign permissions for the NGC resources the external users should access.

1.3.3.6.1.2. Inviting Users to a Managed External User Group

1. Open the Managed External User Groups tab.

2. Select the managed external user group you want to update.

3. Invite the external users who should join the group.

4. Assign the appropriate group role to each user you invite to the group.

5. Ask invited users to check their inbox for the invitation email. If the invitation does not arrive within a few minutes, ask them to check their junk or spam folder.

1.3.3.6.1.3. Managing Managed External User Group Permissions and Membership

1. From the Managed External User Groups tab, open the group you want to manage.

2. Add or remove group permissions to control which NGC resources the group can access.

3. Add or remove group members as external collaboration changes.

4. Review access regularly to make sure group permissions still match the intended collaboration.

1.3.3.6.1.4. Guide for External Users: Accepting a Managed External User Group Invitation

1. Open the invitation email from NVIDIA NGC.

2. Click Accept Invitation.

3. Sign in with an existing NVIDIA account or create an account if prompted.

4. After accepting the invitation, sign in to NGC to access the resources shared with the managed external user group.

1.3.3.6.1.5. API Access for Managed External User Group Users

To access shared NGC resources programmatically, a managed external user must generate a Personal API Key in their NGC account.

The permissions on the key are derived from the managed external user group’s access grants. External users cannot expand these permissions themselves.

Depending on the permissions granted to the group, the key can allow viewing and listing shared artifacts, pulling artifacts, or pushing artifacts.

1.3.3.6.2. Delegated External User Groups (dEUG)

A Delegated External User Group (dEUG) allows an NGC organization owner or administrator to grant an external company access to specific NGC resources without adding those users directly to the NGC organization. The NGC organization controls which resources the group can access, while the external company’s administrator manages the group membership.

Delegated external user groups support three personas:

• NGC organization owner or administrator: Initiates the delegation, assigns access permissions, and monitors or manages the delegated group.

• External dEUG administrator: Accepts the invitation, creates the delegated group, and manages membership in the NVIDIA UCS Team portal.

• External group user: Accepts membership in the delegated group as a member, administrator, or operator and can access the shared NGC resources assigned to the group.

1.3.3.6.2.1. Persona 1: NGC Organization Owner or Administrator

The NGC organization owner or user administrator initiates the delegated EUG invitation, assigns access permissions, and monitors or manages the delegated group.

1.3.3.6.2.2. Initiating a Delegated EUG Invitation

1. Navigate to the Delegated External User Groups tab in your NGC organization settings.

   

2. Enter the email address of the person who creates and manages the external user group.

   

3. Assign the permissions for the group. All users added to the group by the external group administrator inherit the access level you define here. You can set permissions at the organization level or at the NGC team level.

   

   Only subscriptions that support external group sharing are available for selection. Subscriptions that do not support external sharing appear disabled with a tooltip explaining why they are unavailable.

4. Review the invitation settings, including the email subject line and message preview, then confirm to send the invitation and assign access.

   

5. If the invitee reports not receiving the email, ask them to check their junk or spam folder.

1.3.3.6.2.3. Tracking and Monitoring Delegated EUGs

After the invitation is sent, it appears in the Delegated External User Groups list with a Pending status. The invitation can be tracked or revoked from this view.

After the external administrator accepts the invitation and creates the group, its status changes to Accepted. You can open the group details to view the group administrator name, group name, and group ID. Member lists are not visible to the NGC organization owner or administrator.

1.3.3.6.2.4. Advanced Security and Management for Delegated EUGs

To suspend access for an existing delegated EUG, suspend role permissions in the NGC UI. A confirmation prompt helps prevent accidental changes.

After suspension, all members and administrators of the group lose access to the NGC organization’s shared resources within a maximum of 30 minutes.

You can restore access by updating the group’s roles.

To revoke access associated with an external user’s Personal API Key, navigate to External User’s Personal Keys in the NGC UI. Search by personal key ID or key value, then deactivate.

1.3.3.6.2.5. Persona 2: External dEUG Administrator

The external dEUG administrator receives the invitation from the NGC organization, creates the delegated group, and manages all user membership within it.

1.3.3.6.2.6. Accepting the Invitation and Creating the Group

1. Check your inbox for an invitation email from NVIDIA NGC. If you do not see it, check your junk or spam folder.

2. Click the link in the email to open the invitation.

   

3. Complete account setup if prompted, including password creation or terms acceptance.

4. Click Accept Invitation to create the delegated external user group.

5. To access NGC resources, go back to your email message and click Log In To NGC Org after accepting and creating the group.

From the NGC org UI, you can navigate back to your external user group to manage additional users.

1.3.3.6.2.7. Managing Delegated Group Membership

As the group administrator, you control all user membership within your delegated EUG in the NVIDIA UCS Team portal. The NGC organization owner manages the access permissions granted to the group.

Note

Roles are assigned at the invitation level. All users included in a single invitation batch receive the same role. To assign different roles, send separate invitations for each role group.

• Admin is the highest-privilege role and can add or remove Admins, Members, and Operators.

• Operator can add and remove Members only. Operators cannot manage other Operators or Admins, modify the group name or description, delete the group, change their own role, or change group assignments.

• Member can access shared resources but does not have user-management privileges.

Users invited with the Member role are redirected to NVIDIA NGC and can begin accessing the shared NGC resources after accepting the invitation.

Users invited with the Admin or Operator role are redirected to NVIDIA NGC after accepting the group invitation. To manage group users, they should open the NGC organization application and then use the NVIDIA UCS Team link to access External User Groups in the UCS Team portal.

1.3.3.6.2.8. Monitoring and Resending Invitations

1. Use the Pending Invitations tab to track invitations that have not yet been accepted.

2. After a user accepts an invitation, they move to the Confirmed Users tab.

3. You can resend expired invitations. Resent invitations keep the same validity period as the original invitation.

1.3.3.6.2.9. Persona 3: External Group User

External group users receive an invitation to join an existing delegated EUG and access the NGC resources shared with that group.

1.3.3.6.2.10. Accepting the Group Membership Invitation

1. Check your inbox for the invitation email. If you do not see it, check your junk or spam folder.

2. Click Accept Invitation in the email.

3. If you were assigned the Member role, you are redirected to the NGC sign-in page to access your assigned resources.

4. If you were assigned the Admin or Operator role, you are directed to NGC to access your assigned resources. From the NGC organization application, you can access the UCS Team portal to manage users in the delegated external user group.

1.3.3.6.2.11. API Access for Delegated External User Group Users

To access shared NGC resources programmatically, generate a Personal API Key in your NGC account.

1. Navigate the NGC UI to discover the artifacts shared with your group.

2. Go to your NGC account settings and generate a Personal API Key.

The permissions on the key are derived from the delegated external user group’s access grants. These permissions are set by the NGC organization owner and cannot be edited by the external user.

Depending on the permissions granted to the group, the key can allow viewing and listing shared artifacts, pulling artifacts, or pushing artifacts.

1.3.3.6.3. Managing External Users’ Personal API Keys

The API Keys tab under External User Groups lets an NGC organization owner or administrator review and manage Personal API Keys that external users generate for access to shared resources.

Use this tab when you need to revoke or restore API-key access for an external user without changing the whole group membership.

1. Search for the key by entering the personal key ID or key value.

2. If the key is active and has permissions to the shared organization, deactivate it to revoke current permissions to the shared assets.

3. If the key is deactivated, reactivate it only when access should be restored.

4. If the key has no permissions to your shared resources, the system confirms that no action is available.

Refer to the NGC API keys documentation for general API key information.

1.3.3.6.4. Setting Up API Access

To access shared organization resources through the CLI or API, generate a personal key:

1. On the API Keys page, click Generate Personal Key.

   Important

   If the Generate Personal Key button is inactive, follow these steps:

   1. Create an NVIDIA Cloud Account (NCA) where you are an active member.

   2. Create and activate an NGC organization in that account. This organization authorizes your personal key for the shared organization where you are an external user.

   3. Return to generate your key.

   To create your NCA and NGC organization:

   1. Click Create NVIDIA NGC Org and authenticate with your NVIDIA Cloud Account credentials.

      

   2. Enter a name for your NCA and click Create NVIDIA Cloud Account.

      

   3. Click Continue to return to the NGC Personal Key management page.

2. Configure your personal key:

   1. Key Name: Enter a descriptive name that identifies the key’s purpose.

   2. Expiration: Choose a preset period, set a custom date, or select “never expire”.

   3. Services Included: Select the services this key can access.

   4. User Organization: Select an NGC organization you belong to (required for key authorization).

   

   Click Generate Personal Key.

   Warning

   Copy and store your key immediately. NGC displays the key only one time.

   For additional information:

   • Refer to the NGC API keys documentation for general API key information.

   • Refer to the NGC Catalog and NGC CLI guide for using your key with CLI clients.

1.3.4. Transferring Your Product Activation Invitation

When you receive an NGC product activation email and want to activate the product in an account you do not own, transfer the product activation invitation to the account owner. Complete the following steps.

Note

The account selector supports activation invitation transfers only for invitations received directly from NGC. For “NVIDIA entitlement certificate” activations, contact your org owner.

1. To transfer a product, at the Activate Product page, click View All NVIDIA Cloud Accounts. This displays accounts you are a member of but do not own; those without the ‘owner’ tag are not owned by you. Review carefully to identify the account associated with the desired NGC organization before starting the transfer process.

   

2. Click the Transfer Product Activation link under the Actions column.

3. Review the pop-up indicating that the transfer cannot be undone and confirm that you are certain about proceeding with the transfer.

   

4. Check the default email template for accuracy, then click Transfer Product Activation. Editing is optional if the content is correct.

   

1.4. Accessing NGC Org

Activating an NVIDIA NGC product depends on how you obtained the product activation message. This section explains how to activate your NGC product after an NGC email invitation from noreply-ngc@nvidia.com, an NVIDIA commercial entitlement certificate from noreply@nvidia.com, or registration for a free individual NGC organization. It also explains how to create and link your NVIDIA identity account and NVIDIA Cloud Account to your NGC organization.

1.4.1. Activating Your NGC Product from an NGC Email Invitation

You can try upcoming NVIDIA NGC AI products through NVIDIA Developer or by working directly with the NVIDIA product team. After approval, you receive a welcome email from NVIDIA NGC. The following image shows a sample welcome email. To access NGC, you need to be a tenant of an NVIDIA Cloud Account that manages access for you and additional users. The following sections explain how to use your NVIDIA NGC welcome email.

If you are already an NVIDIA NGC user, go directly to NGC Product Activation by Invitation - Existing User.

1.4.1.1. NGC Product Activation by Invitation - New User

This section describes the steps necessary to activate a new NGC product as a new user on NVIDIA NGC.

1. Go to your inbox to find the email “Welcome to NVIDIA NGC”. Click the Accept invitation and sign-in button.

   

2. To create your NVIDIA sign-in identity account, type in a password and confirm it (must meet the complexity check), review the NVIDIA account Terms of Use and Privacy Policy, and click Create Account to accept and proceed with your identity account creation.

   

3. A verification email is sent to your email address.

   

4. Open the email, copy the code, paste it in the Verify Your Email screen, and click Continue.

   

   An additional browser page can open to validate the creation of your user account. Close this page and return to the browser page you started on.

5. In the Almost done! dialog, select your communication preferences, and then click Submit.

   

6. You must now complete the creation of your new NVIDIA Cloud Account. Provide a meaningful name (spaces are not allowed) that helps you identify it easily against other accounts you own or are a member of.

   Note

   Creating a new NCA also creates a new NGC org where your product is activated. The NGC org is linked to this NCA.

   

7. You have activated your NGC product. NGC redirects you to the NGC org subscription page, where you can verify that your product is active.

   

Your product is now active.

Optional: You also receive a welcome email from your NVIDIA Cloud Account. You can complete the account setup now or later.

Complete the steps in Setting Up Your NCA Account to configure your NCA account. The users you add to your NGC org are automatically added to the NCA account. To remove users or update NCA-related tenancy settings for a user, you need to take these actions in NCA.

Note

You cannot access NGC and NGC permissions cannot be assigned in NCA. NCA only manages user tenancy membership. To add users and assign NGC permissions, perform these actions in Adding NGC Users to an Org.

1.4.1.2. NGC Product Activation by Invitation - Existing User

This section describes the steps to activate a new NGC product invitation when you already have an NVIDIA NGC organization.

1. Go to your inbox to find the email “Welcome to NVIDIA NGC”. Click the Accept invitation and sign-in button.

   

2. Sign in to your NVIDIA identity account.

   

3. On the Activate Product page, review the product details, select the account for the product, and click Activate Product. By default, the page shows only accounts that can activate the product. To activate the product in a new account and NGC organization, click Activate with a new NVIDIA Cloud Account.

   

   Note

   If you want to activate the product in an account you do not own, transfer the product activation invitation to the owner. Refer to Transferring Your Product Activation Invitation for the transfer steps.

4. You have activated your NGC product. NGC redirects you to the NGC org subscription page, where you can verify that your product is active. Click Launch for the service you want to access.

   

Your product is now active.

Optional: You also receive a welcome email from your NVIDIA Cloud Account. You can complete the account setup now or later.

Complete the steps in Setting Up Your NCA Account to configure your NCA account. The users you add to your NGC org are automatically added to the NCA account. To remove users or update NCA-related tenancy settings for a user, you need to take these actions in NCA.

Note

You cannot access NGC and NGC permissions cannot be assigned in NCA. NCA only manages user tenancy membership. To add users and assign NGC permissions, perform these actions in Adding NGC Users to an Org.

1.4.2. Activating NGC Product from an NVIDIA Commercial Entitlement Certificate

When you purchase a software subscription for an NVIDIA product, you receive an entitlement certificate attachment in an email with instructions on how to claim your entitlement. The following steps guide you through the entitlement registration process.

1. Find the Entitlement Certificate Email

   Open your email inbox and locate the email titled “NVIDIA Entitlement Certificate - Ref” containing your entitlement certificate attachment.

   Here is a sample entitlement certificate email:

   

   The entitlement certificate is provided as a PDF attachment. The following is an example:

   

   The PDF also includes instructions for using the certificate. Here is an example:

   

2. Login or Register

   • If you are an existing NVIDIA customer, click Already have an entitlement? Please Login.

   • If you are a new NVIDIA customer, click register to begin claiming your entitlement.

3. Sign In

   Enter your username. If you are using an NVIDIA user account, your username is your email address. If you are signing in through your corporate single sign-on portal, use your company username. After entering your username, click Sign In.

   

   • Existing NVIDIA customers: Enter your password, and then click Login.

   • New customers: Create a new identity user account by setting a password.

4. Select or Create an NVIDIA Cloud Account (NCA)

   Follow these steps for returning or new customers.

   • For returning customers:

     The registration page displays different options for product activation.

     

     • Option A: Use an existing NCA

       1. In the NCA pane, select View Eligible NVIDIA Cloud Accounts to review available accounts that you own.

       2. Check the associated NGC org and active product subscriptions for each account.

       3. Select the desired account and click Continue.

     • Option B: Create a separate org

       1. Click Create new NCA to activate your product in a separate NGC org.

       2. Follow the steps for creating a new account.

     • Option C: Use an account you do not own

       If you need to activate the product in an account you belong to that is owned by someone else (under View Other NVIDIA Cloud Accounts):

       1. Cancel the current registration process.

       2. Contact the account owner to request product activation.

       3. Refer to Contacting Your Org Owner for more details.

   • For new or returning customers choosing to create a new account:

     The page prompts you to create a new NCA.

     1. Choose a meaningful account name for easy identification.

     2. Click Create NVIDIA Cloud Account when done.

     

5. Complete Entitlement Registration

   After you select or create an NCA, the entitlement registration page opens. Fill in the required fields and click Register.

   

   Required Information:

   • Primary Contact Information

     • First Name

     • Last Name

     • Email Address

   • Primary Contact Details

     • Location (Country)

     • Address

     • Phone

     • Job Role

6. Email Confirmation and Access

   After a successful registration, you receive an email from NVIDIA Application Hub:

   Click Log In to go to the hub.

   

7. Click the NVIDIA NGC card to access your software subscription in NGC.

   

   When you are in NGC, you can add additional users so they can access NGC by following the steps in Adding NGC Users to an Org.

   Your registration is now complete!

Optional: You can log in to NVIDIA Cloud Accounts to set up your recovery email.

Note

You cannot access NGC and NGC permissions cannot be assigned in NCA. NCA only manages user tenancy membership. To add users and assign NGC permissions, perform these actions in Adding NGC Users to an Org.

1.4.3. Signing Up for a Free Individual NGC Org

This section describes the steps to sign up for an individual NGC org to access NGC Catalog artifacts gated by authentication. While setting up the NGC org, an NVIDIA Cloud Account is also created.

1. Go to the NGC sign-in page from your browser, enter your email address, and then click Continue.

   

2. To create your NVIDIA sign-in identity account, type in a password and confirm it (must meet the complexity check), review the NVIDIA account Terms of Use and Privacy Policy, and click Create Account to accept and proceed with your identity account creation.

   

3. A verification email is sent to your email address.

   

4. Open the email, copy the code, paste it in the Verify Your Email screen, and click Continue.

   

   An additional browser page can open to validate the creation of your user account. Close this page and return to the browser page you started on.

5. In the Almost done! dialog, select your communication preferences, and then click Submit.

   

6. Give your NVIDIA Cloud Account (NCA) a name that helps you identify it the next time you sign in.

   

7. Complete your user profile at the Set Your Profile screen, agree to the NVIDIA GPU Cloud Terms of Use, and then click Submit.

   

   Your NVIDIA account is created, and you are automatically redirected to your individual NGC org.

   

   Your registration is now complete.

Optional: From the NCA email, complete the steps in Setting Up Your NCA Account to configure your NCA account. The users you add to your NGC org are automatically added to the NCA account. To remove users or update NCA-related tenancy settings for a user, you need to take these actions in NCA.

Note

You cannot access NGC and NGC permissions cannot be assigned in NCA. NCA only manages user tenancy membership. To add users and assign NGC permissions, perform these actions in Adding NGC Users to an Org.

1.4.4. Setting Up Your NCA Account

To finish setting up your NVIDIA Cloud Account, find your NCA invitation email message in your inbox and click Log In Now.

1. Your NVIDIA Cloud Account (NCA) provides the services to set up a recovery email address in case your existing one becomes unavailable, manage access for additional users (subscription required), and set up billing information to purchase consumption-based NVIDIA cloud products.

   

2. Enter your email address to log in and click Continue.

   

3. Enter the credentials you created for your NVIDIA identity account.

   

4. On the NCA landing page you can find the details of your account. Here you can set up a recovery email address that can be used to regain access if the email address you used to create your account becomes unavailable. Go to Setting Up NCA Recovery Email for steps on how to set up your recovery email.

1.4.4.1. Setting Up NCA Recovery Email

To set up your NVIDIA Cloud Account (NCA) recovery email, follow these steps.

1. Click Edit on the Account Details pane under the Account Management > Details page.

   

2. On the Edit - Details dialog, enter the email address that you want to use for account recovery. This email address must be different from the address used to create the account. You can optionally set a description for this account. Click Save.

   

3. Confirm that the recovery email status on the Account Details pane changed to Pending.

   

4. Go to your recovery email inbox, search for the NVIDIA message with the title “NVIDIA Cloud Account, Verify Your Recovery Email”, and click Verify.

   

5. Confirm that your email is verified.

   

6. Go back to your NCA console and check that the recovery email status has been updated with the address you assigned.

   

1.4.5. Accepting an NCA Invitation to Access NGC

Follow these steps to accept an invitation to join an NVIDIA Cloud Account and access NGC.

1. Check your email inbox for a message titled “You’ve been invited to an NVIDIA Cloud Account.” Open the email and click Login to proceed.

   

2. If you are new to NVIDIA, you are prompted to create an NVIDIA identity account. Create a password that is at least 9 characters long and uses a mix of uppercase and lowercase letters, numbers, and special characters. If you already have an NVIDIA identity account, enter your password to continue. You can skip to step 6.

   

   A confirmation email asks you to verify your email address.

   

3. Check your email inbox for a message titled “NVIDIA Accounts”. Open the email and click Verify Email Address.

   

   The email confirmation message appears in your browser.

   

4. Select whether NVIDIA can send you product news and information about how you use NVIDIA websites, and then click Submit.

   

5. You are prompted by NVIDIA Cloud Accounts to accept the invitation to join your company’s account. Click Accept Invitation to continue joining.

   

6. Enter your password (required for security).

   

7. Accept the terms of use and privacy policy to access your software subscription.

   

   You can now access the NGC org.

1.5. Using an External SSO for Enterprise Platform Authentication

An enterprise org can federate with an external identity provider (IdP) to allow users to authenticate to NVIDIA cloud platforms using their corporate credentials. The process involves submitting a request, configuring your IdP, activating the federation, and notifying impacted account owners to restore access.

1.5.1. Federating Your IdP with NVIDIA Cloud Services

The IdP onboarding process follows a five-step workflow tracked in the NVIDIA Cloud Account portal under Identity Federation > SSO Integration. The following table maps each workflow step to the section that describes it.

IdP Onboarding Workflow

Step	Name	Description
1	Request	Submit the SSO integration request with your company and domain details.
2	Configure	Configure your IdP and verify domain ownership in the NVIDIA Identity Federation Portal.
3	Linked	NVIDIA reviews and validates your configuration. After approval, your domains are integrated and assigned.
4	Activate & Notify	Review impacted accounts, customize the restore-access email, and activate the IdP. Refer to Activating the IdP and Notifying Account Owners.
5	Restore Account Access	Impacted account owners use the restore-access email to re-verify and regain access. Refer to Restoring Account Access After IdP Activation.

1.5.1.1. Submitting the SSO Integration Request

1. Go to NVIDIA Cloud Accounts and sign in using the email address whose domain you plan to federate.

2. In the left navigation, select Identity Federation > SSO Integration.

3. On the SSO Integration page, review the five workflow steps, then click Get Started.

4. In the confirmation dialog, read the eligibility notice, then click I confirm and want to continue.

   

   Note

   To proceed, your organization must have an active enterprise subscription or ongoing contract, or it must be working with NVIDIA to evaluate services.

5. Complete the SSO request form:

   • Company name: Enter your company name.

   • Additional domains: Enter any additional domains your users use to sign in to NVIDIA. The domain from your sign-in email is automatically populated.

   • Technical contacts: Add email addresses for delegates who assist with the integration.

6. Click Submit. A Request submitted successfully dialog appears and shows your Ticket ID.

   

   Note

   Record the Ticket ID. You can reference it when contacting NVIDIA support.

7. Review the next-steps summary in the dialog:

   • Open the Identity Federation Portal and complete IdP configuration.

   • Add your Security Assertion Markup Language (SAML) or OpenID Connect (OIDC) settings, then complete domain ownership verification.

   • Run the login test so NVIDIA can review and link your IdP.

   • Return to this page after your IdP is linked to review impacted accounts and activate the IdP.

8. Click Go to Identity Federation Portal.

1.5.1.2. Configuring Your IdP in the NVIDIA Identity Federation Portal

The NVIDIA Identity Federation Portal guides you through domain verification and IdP configuration. Use the following tabs in order: Basic info > Domain verification > Configuration details > Login test > Login test result > Summary.

Prerequisite

To sign in to the Identity Federation Portal, you need an NVIDIA account registered with your work email address. An NVIDIA account is NVIDIA’s identity system. If you do not already have one, create an NVIDIA account at the NVIDIA Identity Federation Portal before proceeding.

How-to Guides

The portal welcome screen links to step-by-step guides for Entra ID, Okta, and Google Workspace. You can also open these guides from the Configuration details tab.

1.5.1.2.1. Basic Info

1. On the Welcome screen, review and confirm the pre-populated fields:

   • Company name: Add your company name.

   • Public website: Add the URL of your company’s public website.

   • Email domains: NVIDIA uses these to determine which users must authenticate through your IdP. Add any additional domains if needed.

   The following screenshot shows the basic information fields.

   

2. Click Next.

1.5.1.2.2. Domain Verification

In this step, you verify ownership of the email domains you entered. Follow the on-screen instructions to complete domain ownership verification. For example, add a DNS TXT record at your domain registrar.

The following screenshot shows completed domain verification.

1. After verification is confirmed, the Summary tab displays Domain verification completed.

2. Click Continue to proceed to IdP configuration.

1.5.1.2.3. Configuration Details

Select your identity management system from the options provided, then complete the configuration form for your IdP type. The portal supports the following integrations:

• Entra ID (Azure AD) through OpenID Connect.

• Okta through OpenID Connect.

• Google Workspace through SAML.

• Other systems through generic OpenID Connect or SAML options.

For an OpenID Connect integration with Entra ID, Okta, or a generic OIDC provider, provide the following information:

• OpenID Provider configuration discovery URL: Enter the well-known configuration URL for your IdP, which typically ends with /.well-known/openid-configuration.

• Redirect URI (callback URL): Copy the NVIDIA redirect URI shown on the page and add it to your IdP application’s allowed redirect URIs: https://login.nvidia.com/callback/redirect.

• Client ID assigned to NVIDIA: Enter the client ID generated by your IdP for the NVIDIA application.

• Client secret assigned to NVIDIA: Enter the corresponding client secret.

• Scopes enabled for the client: At minimum, include openid, email, and profile. Add groups if you plan to use NGC IdP Membership Rules to manage user roles through group claims.

For a SAML integration with Google Workspace or a generic SAML provider, provide your IdP metadata using one of the following methods:

• Enter the URL where your IdP advertises its SAML metadata.

• Upload an XML metadata file.

• Enter the individual SAML parameters manually.

The following screenshot shows the configuration details form.

Click Next.

1.5.1.2.4. Login Test

Follow the on-screen instructions to run a test login. NVIDIA uses the test to validate the connection between your IdP and NVIDIA identity federation.

1.5.1.2.5. Login Test Result

Review the following information returned by the login test:

• Unique identifier.

• Username.

• Email address.

• Full name.

• Group memberships, if the groups scope was included.

The following screenshot shows the login test results.

1. If the results are correct, click Confirm.

2. If the test failed or returned unexpected values, click Go Back, adjust your IdP configuration or scopes, and repeat the test.

1.5.1.3. Identity Provider Linked for NVIDIA Review

After you confirm the login test, you return to the SSO Integration page in the NVIDIA Cloud Account portal. The workflow now shows you at Step 3: Identity Provider Linked.

A banner confirms: “We have received your inputs and are reviewing them. We will notify you when the process is completed.”

The following screenshot shows the Identity Provider Linked workflow step.

NVIDIA typically completes the review and links your IdP within one business day. You receive a confirmation email when it is ready.

At any point in the Identity Federation Portal, click Help to find the support email address. You can also reassign the onboarding task to a colleague if needed.

1.5.1.4. Activating the IdP and Notifying Account Owners

After NVIDIA has linked your IdP, the SSO Integration page advances to Step 4: Activate & Notify. NVIDIA has not changed authentication yet.

A banner on the page states: “Your Identity Provider is linked but not active yet. No account access changes have been made. Start the account scan to find NVIDIA Cloud Accounts that would be impacted by activation, then review the results before deciding whether to activate.”

1.5.1.4.1. Starting the Activation

On the SSO Integration page, click Review & Activate Identity Provider.

The following screenshot shows the SSO Integration page when you are ready to review and activate.

The Activate Identity Provider dialog opens. Complete the three steps in the following sections to review the impact and activate your IdP.

1.5.1.4.2. Reviewing Impacted Account Owners

The portal identifies NVIDIA Cloud Account (NCA) owners whose email domains match your federated domain. It groups impacted accounts by owner. The table shows the following information:

Impacted Account Owners

Column	Description
Account Owner	Email address of the NCA owner.
NGC PEC ID	The NGC product entitlement certificate ID, if applicable.
NGC Entitlement	Active NGC product subscriptions for accounts under this owner.
NVIDIA Cloud Accounts	Number of NCAs associated with this owner.

Note

These are the NGC orgs and cloud accounts whose owners receive a restore-access email after you activate. Only account owners can restore access to their accounts. Users under those accounts must be removed and re-invited by the account owner after restoration.

The following screenshot shows the impacted account owners table.

1. Click Export to download the full list for review or to send advance communications to account owners. The list is exported as a CSV with the following columns:

   • NCA Name

   • NCA Account #

   • Account Owner

   • Owner Email

   • NCA Owner Email

   • NGC Owner Emails

   • NGC Org

   • NGC PEC ID

   • NGC Entitlement

2. Click Continue to Restore-Access Email.

1.5.1.4.3. Previewing the Restore-Access Email

Preview the restore-access email that NVIDIA sends to impacted account owners after activation. The email includes a Verify & Restore Access button and explains the following outcomes:

• Users sign in with their corporate credentials.

• NVIDIA verifies their identity.

• NGC restores their account access under the organization’s SSO.

Optional: Add a Personal Note

Select Include a personal note from your team in the email and type a plain-text message. This note appears in the email before the NVIDIA Cloud Account Team signature. Use the note to give account owners context, such as the identity of your IT team and the reason for the change.

Optional: Prepare Account Owners Before Activating

To notify account owners before you activate, use one of the following options.

• Click Copy Email to copy a draft of the restore-access email.

• Click Download Account List to download the impacted accounts list again.

The following screenshot shows the preview of the restore-access email.

Note

NVIDIA sends the official restore-access email only after activation succeeds.

Click Continue to Confirm & Activate Identity Provider.

1.5.1.4.4. Confirming and Activating the IdP

Review the activation summary:

Activation Summary

Field	Value
Impacted Accounts	Total number of NCAs that are affected.
Impacted Owners	Number of account owners who receive restore-access emails.
Identity Provider Activation	Immediately after confirmation.
Restore-Access Link Expiration	30 days after the email is sent.

Review what happens next:

1. Activation: NVIDIA activates the IdP for the matching domains.

2. Sign-in change: NVIDIA requires users with matching domains to authenticate through the new IdP.

3. Restore access: NVIDIA sends restore-access emails to eligible account owners so they can verify and restore accounts linked to the previous IdP.

4. Result: Account owners regain access to their NVIDIA Cloud Accounts under the new IdP.

5. Restore user access: NCA owners must remove and re-invite users in the applicable NGC organization or NVIDIA Cloud Accounts.

Important

Activation is immediate and cannot be reversed. Users with federated domains must authenticate through your corporate IdP. Affected account owners lose access until they complete the restore-access verification.

1. Select the acknowledgment: “I understand activation is immediate, affects all users who use these domains to sign in, cannot be reversed, and requires account owners to re-invite affected users after restoring access.”

   The following screenshot shows the confirmation and acknowledgment.

   

2. Click Activate Identity Provider.

1.5.1.5. Restoring Account Access After IdP Activation

After NVIDIA activates the IdP, NVIDIA automatically sends a restore-access email to each impacted account owner.

Email subject: Action Required: Restore Access to Your NVIDIA Cloud Account

Sender: noreply-cloud-accounts@nvidia.com

The email contains the following information:

• A Verify & Restore Access button. The link expires 30 days after the email is sent.

• An explanation of what happens when the owner clicks the link.

• Any personal note added by the IdP administrator during the activation step.

Complete the following steps as the NGC org owner:

1. Open the restore-access email from noreply-cloud-accounts@nvidia.com.

   

2. Click Verify & Restore Access.

3. Sign in with your corporate credentials through your company’s IdP. Complete authentication.

4. After successful authentication, the Restore Account Access workflow opens in the NVIDIA Cloud Account portal. The workflow tracks progress across five steps: Restore Access > Review & Confirm > Access Restored > Post-Migration Actions > Verify Access.

5. On the Post-Migration Actions page, review the required follow-up actions.

   • Restore user access

     Note

     Users from your company’s federated domains are not migrated automatically. You must remove and re-invite them in the applicable NGC organization or NVIDIA Cloud Account to restore their access.

     • For each user in your NGC org, complete the following steps:

       1. Note the user’s current roles.

       2. Remove the user from the NGC organization or NVIDIA Cloud Account.

       3. Re-invite the user through Invite New User in the NGC org portal under Identity & Access > Users.

       4. Assign the correct roles when re-inviting.

   • Review NGC API keys

     This workflow does not change API keys. Review existing keys in the NGC portal.

     Note

     NVIDIA’s identity federation uses OpenID Connect and SAML 2.0. These protocols cannot communicate membership changes in real time. If a user’s access is revoked through your corporate IdP, their NGC account persists, and any previously generated API keys remain valid. To fully revoke access, remove the user from the applicable NGC organization or deactivate the user’s associated API keys through the NGC web portal.

   The following screenshot shows the required post-migration actions.

   

6. Select the acknowledgment and continue through the workflow to complete account restoration.

7. After completing the Post-Migration Actions, sign in to your NGC org at NVIDIA NGC using your corporate SSO credentials.

8. In the NGC org portal, go to Identity & Access > Users and re-invite each user who needs access. Re-invited users receive an invitation email and must accept it to rejoin the org. After accepting, they sign in using their corporate SSO credentials.

   Choose the user to re-invite, then click Invite New User.

   The following screenshot shows the Invite New User action.

   

   NGC sends the invitation to the user.

   The following screenshot shows the user details for an NGC org invitation.

   

   Review and confirm the invitation.

   The following screenshot shows the invitation confirmation.

   

   Note

   Users who accept an invitation authenticate through your company’s IdP. The IdP Type column in the Users table shows SSO for accounts successfully migrated to corporate SSO.

1.5.2. Authenticating and Managing User Access

This section describes how users authenticate through an enterprise SSO or IdP, how to add new users, and how to manage user permissions and roles.

After your company’s IdP is onboarded and federated with NVIDIA, users who sign in to NGC with those domains authenticate through your enterprise IdP. NGC redirects them back after a successful sign-in.

To add new users to an org that is federated to an external SSO or IdP, follow the steps in Adding NGC Users to an Org.

If your IdP provides OIDC or SAML group membership claims, NGC can map those claims to NGC org, team, and role assignments. Refer to NGC IdP Membership Rules.

Note

NGC orgs do not manage user tenancy directly. Users and groups receive permissions to access NGC org resources. Those users and groups are tenants of the NVIDIA Cloud Account (NCA) linked to the NGC org. Add users and groups in the NVIDIA Cloud Account.

If you manage memberships with IdP group tags (claims), add those groups in the NCA. Then assign NGC access permissions under External IdP > IdP rules.

To keep access to the NCA and NGC org when the IdP is unavailable, configure a recovery email address on the NCA account. NVIDIA uses this email address to authenticate you outside your IdP. For more information, refer to Setting Up NCA Recovery Email.

1.5.3. NGC IdP Membership Rules

When your organization’s IdP is federated with NVIDIA and your NGC org is linked to that account, the org owner can create membership rules. Open the Organization > Enterprise IdP configuration page.

Important

Only the org owner or users with the user_admin role at the organization level can manage IdP rules.

If you are an org owner, an IdP rule does not update your roles, even when you are a member of a group configured in that rule. By default, the org owner inherits admin privileges across all enablements and services in the owned org, and these role assignments are immutable.

If the NGC org is not linked to an enterprise-owned SSO IdP provider, the Enterprise IdP option is disabled and a message states that the org is not linked to an IdP. To link your org, sign in to NVIDIA Cloud Accounts as described in Using an External SSO for Enterprise Platform Authentication.

The membership rules feature uses OpenID Connect (OIDC) or SAML group claims that contain the user’s membership attributes.

Confirm that your IdP sends the group claim values you expect. Check that the login test results include those group values. Refer to Login Test in Federating Your IdP with NVIDIA Cloud Services.

An org owner or organization-level user_admin creates membership rules by mapping the IdP groups claim name to NGC org roles and permissions. Users in those groups in the enterprise Active Directory (AD) receive the roles and permissions that the NGC IdP rule assigns to the group name.

1.5.3.1. Example

This example uses Okta as the enterprise SSO IdP. The same person who manages Okta also has NGC org owner permissions.

Okta Settings

1. Link the NGC org as a client application in the Okta IdP service.

   

2. In Okta, assign managed users to the NGC client application so they can sign in to NGC with their Okta SSO account.

   Users are not assigned to a group yet.

   

3. In Okta, create secure Active Directory groups, and assign users to a group or a set of groups.

   

4. In this example, Adam and Amy are assigned to the NGC_AIE_PR_Admin group. This example assigns the group manually in Okta. An enterprise Active Directory that is integrated with the IdP typically assigns groups automatically.

   

5. Adam and Amy can sign in to NGC, but no IdP rule assigns them NGC org roles and permissions. The next section describes how to create the NGC IdP membership rules that grant those roles.

1.5.3.2. Configuring NGC

After you create the IdP groups and assign users to secure Active Directory groups in Okta, configure the NGC IdP membership rules. Open the Organization > Enterprise IdP configuration page.

1. Create a rule and name it as follows:

   1. Click Create Rule.

   2. In the Rule Name field, enter a name that describes the purpose of the rule.

2. Create an Identity Provider (IdP) group:

   1. Click Create IdP Group.

   2. In the IdP Group Equals to field, type the group name exactly as it appears in your IdP.

   3. In the Role for IdP Group field, select Member.

   4. Click Create IdP Group.

      

3. Select the team and NGC access roles that the rule applies to:

   1. Select Assign to Organization to apply this rule to the entire NGC org.

   2. Select the roles that group members receive for each cloud service. In this example, select NVIDIA AI Enterprise Viewer and Private Registry Admin.

4. Finish creating the rule by clicking Create IdP Rule.

   

5. After you save the rule, click Activate Rules to apply the membership roles to your IdP users. NGC applies the roles when each user signs in.

The org owner or organization-level user_admin can create multiple rules for multiple group claim values from the IdP. The following screenshot shows multiple IdP membership rules.

Important

NGC IdP membership rules do not take effect until you activate them. User accounts that were added manually keep the NGC role permissions assigned through Users invitations.

When you click Activate Rules, confirm activation of the IdP rules. After activation, NGC reviews user memberships that were added with a user invitation. NGC checks whether each user account maps to an IdP membership rule. If NGC finds a match, it removes the previous membership and creates a new membership with the same email address and IdP association. The new membership uses the permissions and roles from the IdP groups claim.

Note

Previous user accounts that do not map to an IdP rule remain as active user accounts under Users account memberships. An org owner or organization-level user_admin can remove these users if the org should only be accessible by members mapped to IdP rules.

1.6. Activating Your Subscription (Offer Dependent)

This section describes activating a subscription and linking it to your NGC Account.

Note

These steps are only required for customers who have been given an activation code as part of the purchase of a GPU or DPU.

1. Access the activation page through Activate Subscription.

2. Sign in to NGC with your email address and password if prompted. If you have not created an NGC account, create one now.

3. On the Activate Subscription page, enter your Business Information using your company’s headquarters address and the serial number or activation code described by the specific offer. If entering multiple serial numbers or activation codes, use a comma to separate each.

4. Click Activate Subscription.

   

5. After the system validates the serial numbers, review the information displayed and click Request Activation.

   

6. The Subscriptions page displays for your organization with the active NVIDIA AI Enterprise subscription.

7. Use the left navigation and click Enterprise Catalog to access the NVIDIA AI Enterprise software suite.

   

1.7. Switching Orgs or Teams After Logging into NGC

This section describes how to switch to a different org or team after you sign in.

In the top menu bar, click your user account icon. Select your org menu to view other available orgs. If you manage many orgs, use the search field to find the org, and then select it.

Depending on the org or team you select, your current page can also refresh.

1.8. NGC API Keys

NVIDIA NGC API keys are required to authenticate with NGC services using NGC CLI, Docker CLI, or direct API requests.

NGC provides two types of API keys: personal keys and service keys.

Personal Keys

Personal keys have the following characteristics:

• Any NGC org user can generate a personal key.

• An NGC org user can grant a personal key up to the permissions assigned to them in the NGC org.

• A personal key is linked to the user’s NGC org lifecycle.

  • If the user’s permissions change, the available permissions that can be or are assigned to the personal key also change.

  • If the user is removed from the NGC org, the key’s validity is revoked.

• Supports updating permissions, rotation, and deletion (immediate revocation).

  • Org owners and organization-level user_admins can revoke any member’s key on demand.

• Each user can generate up to 32 personal keys across all organizations they are a member of.

Use personal keys to begin using NGC services within your sandbox. Personal keys are suited to individuals working on early development and testing code before moving to pre-production and production releases.

To authorize the services you can access in the org and generate a personal key, go to Generating a Personal API Key.

Important

Use the legacy NGC API Key for cross-org authorization. NVIDIA encourages you to use the Personal Key, but if you need to continue using the legacy API key, go to Generating a Legacy NGC API Key to find out where to create a new one. Your current NGC API key continues to work.

Service Keys

Service keys have the following characteristics:

• The lifecycle of service keys is linked to the NGC org account, not associated with an individual user.

• Only NGC org owners and organization-level user_admins can manage service keys.

• A service key can be scoped to access only the permissions and services required, or full access to the services enabled in the org.

• Supports scoped permissions, updating permissions, on-demand revocation, rotation, and deletion.

• An NGC org can have up to 64 service keys.

Use service keys when you require automated communication between machines and need to deploy to pre-production and production environments where you do not want to depend on a user’s membership status in the NGC org.

Note

Service keys currently do not support listing artifacts in the NGC CLI or Docker CLI. NVIDIA plans to add this functionality. Until then, use a Personal API key to list artifacts.

Examples using NGC API Keys

Here are some examples of using NGC API keys to authenticate with NGC CLI and Docker CLI:

NGC CLI

$ ngc config set

Paste your key value at the API_KEY prompt:

[Enter API key [****API-Key]. Choices: [<VALID_APIKEY>]

Important

Always use the latest NGC CLI version to access the newest features, bug fixes, performance improvements, and security updates. Check for the latest versions at NGC CLI Installers or run ngc version list to view the latest releases, then upgrade using the following command:

ngc version upgrade

Docker CLI

docker login nvcr.io --username '$oauthtoken'

For the username, enter '$oauthtoken' exactly as shown. It is a special name that indicates that you authenticate with an API key. Paste your key value at the Password prompt.

1.8.1. Supported NGC Applications and API Key Types

The following NVIDIA NGC applications and services support Personal and Service Keys.

NGC Applications and Services

NGC Application/ Services	Service Description
NVIDIA NGC Catalog	Grants your key permission to access or download containers and artifacts from the NGC Catalog. The permission level matches your account’s permissions for the catalog.
NVIDIA NGC Private Registry	The key is authorized to perform actions on your organization’s private registry service, such as pulling, retrieving, creating, or deleting containers and artifacts. The permission level assigned to the key matches the permission level of your user account. Therefore, your user account must have permissions for the Private Registry.
NVIDIA Cloud Functions	This authorization allows your key to perform actions on your organization’s cloud functions service. If your organization has private functions published by NVIDIA, or if your cloud functions service enables you to create, deploy, and run your own functions, your personal key has the same permissions as your user account for the cloud functions service. Your user account must have the necessary permissions for Cloud Functions.
NVIDIA Public API Endpoints	Grants permission for your key to access NVIDIA NIM inference endpoints listed in the NVIDIA API Catalog. Therefore, your user account must have Public API Endpoints permissions.
NVIDIA Secrets Manager	Authorizes your key to perform actions on the NVIDIA Secrets Manager service, which is used to store and manage secrets. Your key has the same permission level as your user account, so your user account must have Secrets Manager permissions.

1.8.2. Generating NGC API Keys

Generating API keys is essential for authenticating with NGC services using the NGC CLI, Docker CLI, or direct API requests.

1.8.2.1. Generating a Personal API Key

1. Sign in to the NGC website. From a browser, go to the NGC sign-in page and then enter your email and password.

2. Click your user account icon in the top-right corner and select Account Settings.

   

3. Scroll to the bottom and click Generate API Key under API Keys.

   

4. On the Account > API Keys page, click + Generate Personal Key on the menu or the pane.

   

5. In the Generate Personal Key dialog, fill in the required information for your key.

   

   • Key Name: Enter a unique name for your key.

   • Expiration: Choose the expiration date for the key.

     

   • Services Included: Choose from the available services the key is permitted to access. Refer to Assigning Services to Your Personal API Key to learn more about each service and when to assign service access to your Personal Key.

6. Click Generate Personal Key when finished.

7. Your API key appears in the following dialog.

   NGC does not save your key, so store it securely. You can copy your API Key to the clipboard by selecting Copy Personal Key or using the copy icon to the right of the API key.

   

   You can generate up to 32 personal keys and manage them from the Account > API Keys dashboard. Use the vertical ellipsis menu to rotate or delete a personal key.

   

1.8.2.1.1. Assigning Services to Your Personal API Key

The services you can assign to a personal API key depend on two factors:

• The services enabled for the NGC org where you generate the API key.

• The service roles assigned to you by your NGC org owner or administrator.

For example, consider an NGC org with the following services enabled:

An NGC user account might have the following access roles assigned:

In this scenario, the NGC org has enabled NVIDIA Microservices, Private Registry, NVIDIA AI Enterprise, and Cloud Functions (NVCF). The user account has been granted access roles for all these services. Therefore, a personal API key can be generated with permissions to access one or all of them.

If a service is unavailable for assignment to the API key, the org owner or administrator has not granted you the necessary role for that service.

For details about each service and its function, refer to Supported NGC Applications and API Key Types.

1.8.2.1.2. Generating a Legacy NGC API Key

Important

Legacy API keys are the original key type in NGC. This type supports only one active key per user account. When a new key is generated, the previous key is revoked and cannot be rotated. NVIDIA continues to support this key type for services that have not transitioned to Personal or Service API keys. Migrate to Personal or Service API keys when you can, because they provide stronger security.

To generate a legacy API key, go to Setup > API Keys and click + Generate Legacy Key in the Legacy Keys drop-down.

In the Generate Legacy Key dialog, click + Generate Legacy Key.

1.8.2.2. Generating a Service API Key

1. Sign in to the NGC website. From a browser, go to the NGC sign-in page and then enter your email and password.

2. Select Organization from the user account menu on the upper right.

   

3. Select Service Keys on the organization dashboard.

   

4. On the Organization > Service Keys page, click + Create Service Key to create a key.

   

5. In the Create Service Key dialog, you can select one or more services to authorize for the service API key, and configure scoped permissions that apply to either all entities or a specific subset accessible through those services. Begin by entering the required configuration details.

   

   1. Service: Select a service. Service keys currently support a range of services, including NVIDIA Cloud Functions, NIM API endpoints, NGC Catalog, and Private Registry.

      

   2. Scope: Specifies the exact permissions or actions the key can perform for a selected NGC service. Examples for Private Registry and NGC Catalog include “Get Container”, “Get Container list”, “Get Artifact”, and “Get Artifact list”. Other services list the scopes (actions) that can be assigned to the key.

      

      Note

      Select only the permissions you need (least privilege). Refer to Least-Privilege Service Key Recipes for more information.

      Important

      When generating a key for Private Registry or NGC Catalog services and granting access to containers, assign the scopes Get Container and Get Container list to your service key. For other artifact types, assign Get Artifact and Get Artifact list. These are the minimum scopes required to discover artifacts that need to be managed. Refer to the NGC Catalog User Guide and Private Registry User Guide for more information.

   3. Entity Type: An entity is a resource that can be managed with the appropriate permissions and access controls. In Private Registry, an entity can be a container or a collection of containers that, depending on the permitted scopes, can be downloaded, updated, or deleted. In NVIDIA Cloud Functions, an entity is an “inference function” that can be listed, invoked, or deleted based on the scopes assigned to the service key.

      

      Note

      Choose the smallest unit that matches your use case. Refer to Least-Privilege Service Key Recipes for more information.

   4. Entity Value: Specifies whether the key has access to all entities in the NGC org and teams, or only to a single entity or a defined list of entities within the org.

      

      Important

      If a service key requires access to all organization-level and NGC team-level entity types, define two entity values for the key.

      

      This example shows the Entity Value configuration required for the service key to access all entities at the organization level and across all NGC teams. For additional examples, refer to Configuring Access to NGC Catalog Artifacts.

6. Click Next Step to review your key configuration.

   

7. After you have verified the configuration, click Confirm to generate your service key. Your service key appears in the next dialog.

   

8. NGC does not save your key, so store it securely. You can copy your API Key to the clipboard by clicking the copy icon to the right of the API key or the Copy Service Key button.

   

   Copy the key value before you leave this page. After you leave the page, the key value cannot be retrieved, and you must generate a new key to replace it.

1.8.2.2.1. Configuring Access to NGC Catalog Artifacts

To configure a service key for NGC Catalog access, you must specify the path where each artifact is published. Include all required paths, as artifacts are published under different NVIDIA-managed NGC organizations depending on type.

Here are some examples:

• NVIDIA NIMs are published in the nim NGC org (for example, nim/*/*).

• The NVIDIA GPU Operator and other artifacts are published in the nvidia NGC org (for example, nvidia/*/*).

1.8.2.2.1.1. Setting the Path for Specific Artifacts

To access a specific artifact, check its publishing details (for example, by examining the GET path information).

• For artifacts in the nim NGC organization, configure the service key so it can access the relevant repository. The following configuration provides access to all NVIDIA NIM artifacts. You can restrict the key by specifying the path to one artifact in the Entity Value field (for example, nim/<team>/<artifact>).

  

• If you need to access artifacts in a different NVIDIA-managed NGC org, such as the nvidia org (for artifacts like the NVIDIA GPU Operator), add that specific path to your service key configuration (for example, nvidia/*/*).

  

1.8.2.2.1.2. Comprehensive Access Configuration

To grant a service key access to all entities (artifacts) available in both primary NVIDIA-managed orgs, include both wildcard paths. For example:

• nim/*/*

• nvidia/*/*

This configuration grants the service key access to all entities published in the root and all subfolders of the NVIDIA-managed nim and nvidia orgs.

Important

Access to certain restricted artifacts in the catalog, such as those requiring NVIDIA AI Enterprise, depends on active subscriptions. If your NGC organization does not have the necessary subscription, a service key can be denied access to specific artifacts even when the permissions are configured this way. Always check the access requirements for each product listed in the NGC Catalog.

1.8.2.2.2. Configuring Service Keys for NVIDIA Cloud Functions

To configure a service key for NVIDIA Cloud Functions (NVCF), select the Scopes, Entity Types, and Entity Values for the operations the key must perform. Scopes are the actions the key can perform. Entity Types are the resources those actions apply to. The following entity types are available for NVCF:

• All Functions: all functions in this org.

• Function: a single function, specified by function ID.

• Function Version: a single function and a specific version of that function.

• All Clusters: cluster and GPU infrastructure information.

• All Entity: all resource types in the org. Required by certain org-level scopes. Refer to the important note that follows.

Refer to the NVCF Service Keys Documentation for the full list of scopes, compatible resource types, and troubleshooting guidance.

Important

The following scopes work only with the All Entity resource type. Selecting any other resource type results in a 403 error: Manage Registry Credentials, Manage Telemetries, Read GPU Quota Rule, and GPU Capacity.

1.8.2.2.3. Managing Service API Keys

NGC supports multiple Service API keys, which are managed from the Organization > Service Keys dashboard.

To activate or deactivate a key, click the Active toggle. The Actions (ellipsis) menu allows you to rotate or delete a service key.

1.8.2.2.4. Least-Privilege Service Key Recipes

Here are some examples of least-privilege service key recipes:

• Private Registry: List, push, and pull containers only

  • Service: Private Registry

  • Entity Type: All Containers

  • Entity Value: <org name>/* and <org name>/*/*

  • Scope: List Container, Upload Container, Download Container

  Note

  In the entity value, <org name>/* includes all org-level entities, while <org name>/*/* includes all team-level entities across the org.

• NGC Catalog: Read-only pull for a single model

  • Service: Catalog

  • Entity Type: Specific Model

  • Entity Value: nvidia/ace/nemovision-4b-v2-instruct

• NVCF: Invoke-only (production inference client)

  • Service: Cloud Functions

  • Scope: Invoke Function, Queue Details

  • Entity Type: Function → <function-id> (or All Functions for access to all functions)

• NVCF: Manage function lifecycle

  • Service: Cloud Functions

  • Scope: Register Function, Deploy Function, List Functions, List Function Details, Update Function, Delete Function

  • Entity Type: All Functions → Account-owned Functions

1.8.3. Troubleshooting API Key Errors

You might encounter the following errors. Use this guidance to resolve each one.

• 401 Unauthorized

  A 401 Unauthorized response indicates that you are not signed in to nvcr.io. Confirm that your authentication secret is correct, or run docker logout and sign in again.

• 403 Forbidden

  A 403 Forbidden response indicates that either a required scope is missing or the entity type and value are not correctly configured for the resource the API is trying to access. You likely need to select Update Authorizations and reconfigure the service key.

• Recently updated keys

  After you modify a service key’s scopes or entity type and value, the changes can take up to 15 minutes to propagate. Requests made before propagation completes are still evaluated against the previous authorization policy and can return an error.

1.8.4. Rotating NGC API Keys

API key rotation is the practice of replacing an existing API key with a newly generated one. Long-lived API keys carry more security risk than keys that expire after a short period. NVIDIA recommends creating a personal API key with a short expiration when your workflow allows it. If you use a long-lived Personal Key or Service Key, rotate the key on a regular schedule.

NGC supports rotation for Personal Keys and Service Keys. NGC does not support rotation for Legacy API keys. Key owners are responsible for rotating their keys.

1.8.4.1. Rotating a Personal API Key

To rotate a personal API key:

1. Sign in to the NGC website. From a browser, go to the NGC sign-in page and then enter your email and password.

2. Click your user account icon in the top-right corner and select Account Settings.

3. Scroll down and click Generate API Key under API Keys, or navigate directly to Account > API Keys.

4. On the Account > API Keys page, locate the personal key you want to rotate.

5. Click the vertical ellipsis menu next to the key and select Rotate Personal Key.

   

6. A new key is generated. NGC does not save your key, so store it securely. Copy your new key before navigating away.

7. Update your applications, scripts, or services with the new key value. The old key remains active until you are ready to revoke it.

8. To revoke the old key, return to Account > API Keys, click the vertical ellipsis menu next to the old key, and select Delete.

Note

The old key is named the same as the new key, but the “Created Date” is the earlier date. You can also use the last three characters of the key value to match the old key and delete it.

1.8.4.2. Rotating a Service API Key

To rotate a service API key:

1. Sign in to the NGC website. From a browser, go to the NGC sign-in page and then enter your email and password.

2. Select Organization from the user account menu on the upper right.

3. Select Service Keys on the organization dashboard.

4. On the Organization > Service Keys page, locate the service key you want to rotate.

5. Click the Actions (ellipsis) menu next to the key and select Rotate Service Key.

   

6. A new key is generated. Store it securely and copy the key value before navigating away. After you navigate away, the key value cannot be retrieved.

7. Update your applications, scripts, or services with the new key value. The old key remains active until you are ready to deactivate it.

8. To deactivate the old key, click the Active toggle next to the old key on the Organization > Service Keys page.

Note

The old key is named the same as the new key, but the “Created Date” is the earlier date. You can also use the last three characters of the key value to match the old key and deactivate it.

1.8.4.3. API Key Rotation Recommendations

NVIDIA recommends rotating long-lived NGC API keys on at least a 90-day cycle as a security best practice.

1.9. Secure Sharing Service

NGC Secure Share is a security-focused service designed to help NGC users share sensitive credentials and secrets with each other. This service eliminates risky credential-sharing practices such as sending passwords or API keys through email, chat, or public forums.

Important

Exchanging credentials in clear text or through unprotected channels can compromise user artifacts and the hosted services in NGC. Use Secure Share to distribute sensitive information.

Secure Share enables secure, auditable, and short-lived sharing of secrets, including API keys, usernames and passwords, and tokens, between NGC users and collaborators. Instead of transmitting credentials in an unsafe medium, users generate a secure, time-limited Secure Share link that is strictly controlled by access policies.

Secure Share provides the following capabilities:

• End-to-end encryption for all shared secrets

• Recipient restriction: limit access to specified organization

• One-time access: the link expires after it is viewed

• Short link lifespan: customizable expiration (5 minutes to 24 hours)

• No secrets stored after access: secrets are unrecoverable after viewing or expiration

Typical uses include:

• Safely hand off API keys between team members

• Securely provide one-time passwords or recovery codes to partners or support

• Distribute model secrets or other credentials during project onboarding

1.9.1. Securely Sharing Secrets

Follow these steps to securely share credentials using NGC Secure Share:

1. Log in and access Secure Share Service.

   • If not already signed in, log in to the NGC web portal using your NVIDIA credentials.

   • In the top right corner, click your profile and go to Account Settings, then click Secure Share.

   • Alternatively, you can open the Secure Share page.

2. Enter secret content by pasting or typing the credential or secret (for example, API key, username/password) you want to share.

3. (Optional) Configure additional share details:

   • Set the recipient organization.

     • For organizations you belong to, pick from the list.

     • For an external organization, you must enter the exact NGC organization name provided by the recipients. This is needed to ensure proper access controls. If your recipient needs help finding their organization name, they can refer to the Finding Your Organization Name section.

   • Set the expiration time for the link: from 5 minutes to 24 hours.

   • Set a display name to help you track the share.

4. Click Create Link.

   

5. Click Copy Link to copy the link to your clipboard before closing.

   

6. Provide the link directly to the intended recipient, for example through email or direct chat.

1.9.2. Receiving a Secure Share Link

When someone invites you to access a shared secret:

1. Receive Secure Share link.

   • Watch for a direct message (for example, email or chat) with a secure share link.

2. Open the link and authenticate.

   • Click the link. If prompted, sign in with your NGC credentials.

   • The site redirects you to the Secure Share access page.

3. Decide to view now or wait until later.

   • You have only one opportunity to view and copy the secret.

   • Choose Reveal Now, or click Close to reveal the secret later.

   

4. If you choose to access the secret now:

   • Click Reveal Now.

   • You can copy the secret to your clipboard.

   • Copy the content before you close the page. The secret is no longer accessible after you close it.

   

   Note

   If access is denied (wrong org, expired, or already viewed), contact the sender for a new link.

1.9.3. Finding Your Organization Name

If you need to confirm or provide your organization name so a Secure Share link opens only for your NGC organization, use the Secure Share service UI.

To find your NGC organization name, follow these steps:

1. Open the Secure Share page.

2. Click Request Content.

3. If you belong to multiple organizations, locate the correct one and click Create Link.

   

4. Review the pre-configured share link, then click Copy Link.

   Send this link to the person who shares secure content with you. When they open it, your organization is already selected, and they can encrypt and send their data.

   Important

   For security, always verify you are entering or selecting the correct organization to avoid access issues or failed link attempts. If you are unsure or you cannot find your organization name, contact your NGC administrator.

   Note

   You cannot receive shares to organizations in which you are an external user.

1.9.4. Viewing Active Links

You can review your active, unclaimed Secure Share links on the View Active Links tab. On this tab, you can see each link’s display name, target organization, creation time, and expiration status. You can also delete links you no longer need; deleted links become immediately inaccessible.

1.10. Notification Services

NGC Notification Services lets you subscribe to email notifications for service change events.

You can receive notifications for the following changes:

• Customer-impacting service enhancements (release notes)

• Security vulnerabilities (CVEs) and scanning reports

• Software end-of-life announcements

• Scheduled web portal maintenance to an NGC property

You can confirm your notification subscription settings on the NGC user Account Settings page:

1.11. Appendix

1.11.1. NVIDIA NGC Network Protocols

The following table lists the required network protocols and port configurations for communication with NVIDIA NGC services.

To enable access, ensure that these ports are open in your web proxy, which connects your network to external services.

Required Network Protocols

Location	Description	URL	Port
NGC	Authentication URL	https://authn.nvidia.com	443
NGC	Container Registry URL	https://nvcr.io	443
NGC	Container Registry URL	https://layers.nvcr.io	443
NGC	Helm Chart Registry	https://helm.ngc.nvidia.com	443
NGC	API URL	https://api.ngc.nvidia.com	443
NGC	Telemetry URL	https://prod.otel.kaizen.nvidia.com	8282
NGC	Catalog	https://files.ngc.nvidia.com	443
NGC	Catalog	https://xfiles.ngc.nvidia.com	443
NGC	Catalog	https://xlfiles.ngc.nvidia.com	443