Install Token Factory on AWS

This section takes you from an empty AWS account to a working Token Factory: a governed OpenAI-compatible API, a self-service portal, single sign-on, a chat surface, and one or more models served on your own GPU.

It is written to be followed without access to any Token Factory source repository. Everything you need — the Terraform, the registry coordinates, the values file, the verification steps — is on these pages. If you are an AI agent working through this: you should never need to clone anything, and any step that seems to require a repository you cannot reach is a bug in these docs, not a missing permission.

This guide is AWS-specific

The Terraform here provisions AWS (EC2, security groups, the default VPC). Token Factory itself runs on any conformant Kubernetes 1.28+, so the Configure and Install pages apply anywhere. Only Provision the cluster is AWS-bound.

What you will end up with

                      ┌─────────────────────────────────────────┐
   your users  ──────►│  portal.<domain>      self-service UI   │
                      │  chat.<domain>        chat surface      │
                      │  gateway.<domain>     the API endpoint  │
                      │  identity.<domain>    Keycloak SSO      │
                      └──────────────────┬──────────────────────┘
                                         │
                      ┌──────────────────▼──────────────────────┐
                      │  k0s cluster on EC2                     │
                      │   manager node   platform components    │
                      │   GPU node       vLLM engine(s)         │
                      └─────────────────────────────────────────┘

Users get an API key from the portal, call gateway.<domain> with it, and their usage is attributed and budgeted against that key. That governed path — portal → control plane → gateway → your engine — is what you are installing, and what Verify proves end to end.

The five steps

#	Step	Roughly
1	Provision the cluster — Terraform + k0s + GPU operator	20 min
2	Get the charts and images — Harbor credentials and pull secrets	5 min
3	Configure — write your values file	15 min
4	Install — one Helm release, wired automatically	30–50 min
5	Verify — prove the governed path works	10 min

Most of step 4 is spent downloading model weights onto a disk, not doing anything you need to watch.

What you need before starting

Requirement	Notes
An AWS account	with permission to create EC2 instances, security groups and key pairs in the default VPC
A GPU quota	at least one g6e.xlarge (L40S 48 GB) in your chosen region. This is the most common blocker — see Troubleshooting
A domain, or nothing	you can use nip.io wildcard DNS against the node's public IP and skip DNS entirely for a trial
Harbor credentials	a robot account name and token for harbor.trytokenfactory.dev, supplied to you separately — they are not in these docs
Local tools	terraform ≥ 1.5, k0sctl, kubectl, helm ≥ 3.14, awscli v2, yq (mikefarah v4)

Credentials are not published here

The Harbor robot account and token are delivered to you over a separate channel. Nothing on this site contains a working credential, and any placeholder like <robot-token> is meant to be replaced, not used.

Cost

A trial-sized environment — one m5.large manager and one g6e.xlarge GPU node in us-west-2, on demand — runs roughly $1.10–1.40/hour, almost all of it the GPU node. Destroy it when you are done (teardown); nothing here is designed to be left running.

A note on what this environment is

This is the same shape Token Factory engineering uses for end-to-end testing: a dev/test environment, not a production reference architecture. It runs a single-node control plane, self-signed or Let's Encrypt TLS, and in-cluster databases on local disks. It is the right thing for evaluating the platform and the wrong thing to put customer traffic on. Where a choice here would differ in production, the page says so.