Getting started

This guide walks you from a new account to your first verified connection to a remote asset, and shows you how to confirm it in the audit trail. The required path is only six steps; SSH client access, MCP and browser assets can be added when you need them. Steps that require Owner or Admin permissions are marked.

Roles used in this guide

• Owner / Admin: can manage Organization members, Projects, connectors, Assets and grants.
• Member: can use granted access to open sessions; cannot manage the steps marked below.

The required path

Finish these six steps and you have your first verified asset access.

1. 1

   Register and complete MFA enrollment

   Create your account from the registration form. WingGate requires a first MFA factor during onboarding: scan the QR code with an authenticator app to enroll TOTP, or register a passkey (Touch ID / Windows Hello / a security key). Registering a passkey issues one-time recovery codes — write them down immediately. Your account comes with a default Organization and Project automatically.

   Done:

   You are signed in and land in the console.

   On failure:

   If a code or passkey confirmation is rejected, check that your device clock is in sync or that the credential is on this device, then retry.

   Open registration
2. 2

   Deploy and bind a connector Owner/Admin

   Install the wing-connector on a host in the network that can reach your assets. The connector dials out to WingGate over mTLS, so no inbound exposure is needed. Bind it to your Organization from the connector page.

   Done:

   The connector shows as online in the Organization's connector inventory.

   On failure:

   If the connector stays offline, verify outbound connectivity to WingGate and check the connector service logs. See the connector deployment article.

3. 3

   Add an Asset and a Connection Profile Owner/Admin

   Open the Organization asset pool and choose Add asset. To follow this guide, connect an SSH host with its address and a Connection Profile. Browser assets are bound from the WingGate extension instead of this form.

   Done:

   The Asset appears with its profile in the Organization's asset inventory.

   On failure:

   If the Asset cannot be reached, verify its address from the connector's network, not from your laptop.

4. 4

   Create an access grant in the Project Owner/Admin

   A Project access grant gives a member the full data plane of that Project. Authorize only the members who need it.

   Done:

   The grant is listed on the Project's access page.

   On failure:

   If a member reports "not authorized", check they have a grant for the Project and the asset is ready.

5. 5

   Open your first session

   On first connection, WingGate probes the target host's SSH host key for you to verify out of band; confirming pins it, and later mismatches are flagged instead of silently accepted. Then open a Web Terminal session against the Asset from the Project.

   Done:

   A shell opens on the target host.

   On failure:

   On host key mismatch, re-probe and confirm deliberately — never override a mismatch you cannot explain (see the Security page); if the session fails to open, check connector status, grant scope, and the credential on the Connection Profile, in that order.

6. 6

   Confirm the access in Audit

   Every session and grant-relevant action is recorded in the Organization's Audit view (viewing requires the appropriate role). Open it and confirm your first connection appears with the expected actor, asset and time.

   Done:

   The audit entry matches your session.

   On failure:

   If an entry is missing, confirm you are viewing the correct Organization and time range.

Optional extensions

Capabilities beyond the core path — add them when you need them.

Troubleshooting entry points

• connector offline
• Host key mismatch
• Not authorized
• MCP authentication failed