Connect your clouds
Surfra does not rent machines for you. You connect your own provider accounts, and Surfra starts and stops replicas in them. Each provider bills you directly, at its own price. Surfra adds no markup.
Connect a cloud
Section titled “Connect a cloud”Open Credentials → Cloud accounts in the dashboard and click the plug icon next to a provider. Owners and admins can connect, replace, and remove clouds. Everyone in the organization can use them.
| Provider | What to enter |
|---|---|
| RunPod | An API key |
| Salad | An API key, the organization name, and the project name |
| Vast.ai | An API key |
| Yotta | An API key |
| DigitalOcean | A personal access token with write access |
| Shadeform | An API key |
| Lambda | An API key. Optionally an SSH key name |
| Verda | An OAuth client ID and secret. Optionally a location |
| Hyperstack | An API key. Optionally an environment |
| Vultr | An API key. Optionally a region |
| Scaleway | A secret key and the project ID |
| AWS | An access key ID and secret access key that can run EC2 instances. Optionally a region and subnet |
| Oracle Cloud | Tenancy and user OCIDs, an API signing key and its fingerprint, a region, and a public subnet. Optionally a compartment |
| Crusoe | An access key, secret key, and project ID. Optionally a location |
| Hetzner | A Cloud API token with read and write access. Optionally a location |
| Novita | An API key |
| Paperspace | An API key. Optionally a region: ny2, ca1, or ams1 |
| TensorDock | An API token |
Surfra checks the key with the provider before saving it. A key the provider rejects is not saved.
A provider that is not connected still shows its machines and prices on the create page. Its cards say Connect and cannot be picked until you connect it.
Beta clouds
Section titled “Beta clouds”Clouds marked Beta follow the provider’s published API but have not yet placed a machine on a real account. Rank a tested cloud below a Beta row so a replica still starts if the Beta cloud fails.
Lambda, Verda, and Hyperstack refuse to start a machine without an SSH key. Surfra uses the first key on your account. If there is none, it adds a public key whose private half is never kept, so nobody can sign in with it. Crusoe, TensorDock, and Oracle machines always get a key like that.
Oracle’s private key is the PEM file you downloaded when you added an API key to your user. Paste the whole file, including the BEGIN and END lines. Line breaks may be lost in the field; Surfra puts them back.
Hetzner Cloud has CPU servers only. Crusoe rents GPU machines only.
Prices come from each provider’s published list: AWS and Oracle from dstack’s gpuhunt catalog, Paperspace from SkyPilot’s catalog, Hetzner from Spare Cores, and Crusoe from its pricing page. TensorDock publishes no price list without an account, so its cards appear once Surfra can read its prices.
Shadeform resells capacity from other clouds, including Crusoe, Nebius, Lambda, and Massed Compute. Its cards show the cheapest machine with capacity right now.
How keys are stored
Section titled “How keys are stored”A cloud key cannot be viewed after you save it, not even by the person who saved it. The table shows the last four characters, who added it, and when it was checked.
Keys are encrypted with AES-256-GCM using two keys:
- Each organization has its own key. Your cloud keys and credentials are encrypted with it, tied to your organization, so a value copied into another organization cannot be opened.
- Your organization’s key is encrypted with a global key that never leaves the Surfra API.
Surfra decrypts a cloud key only to start, check, or stop one of your machines.
Replace or remove a cloud
Section titled “Replace or remove a cloud”Replace, the arrows icon, saves a new key over the old one, after the same check. Use it to rotate a key.
Remove, the trash icon, is refused while replicas are running on that provider, because Surfra would have no way to stop them. Scale those apps to zero first. After a cloud is removed, apps that rank it skip that row.
What machines are named
Section titled “What machines are named”Each machine in your provider’s console is named after its Surfra replica id, so you can match it to the replica in the dashboard. Surfra only stops machines it started.