FloxHub, orgs, plans, compliance
FloxHub is where Flox environments live once they leave one machine. Organizations add three roles (Owner, Writer, Reader), service accounts for CI and a private catalog; Team is $20/seat/month, Enterprise is custom-priced and adds SSO-class controls and custom deployment. Flox lists SOC 2 Type II and ISO/IEC 27001:2022, and since October 20, 2026 resolving catalog packages needs a free FloxHub account.
This page is drawn from https://flox.dev/docs/concepts/floxhub, https://flox.dev/docs/concepts/organizations, https://flox.dev/docs/concepts/enterprise-sso, https://flox.dev/docs/concepts/service-accounts, https://flox.dev/docs/concepts/personal-access-tokens, https://flox.dev/docs/concepts/authentication, https://flox.dev/pricing/, https://flox.dev/compliance/, https://flox.dev/ and https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/ (checked 2026-11-04).
FloxHub
FloxHub is a cloud service for sharing your Flox environments (https://flox.dev/docs/concepts/floxhub). The account name is the GitHub username by default, and you reach the web UI at hub.flox.dev (https://flox.dev/docs/concepts/floxhub). flox push publishes an environment as a generation, and the Environment Detail page shows its live generation and history (https://flox.dev/docs/concepts/floxhub). Where a browser is unavailable, use a personal access token; for CI, use a service account (https://flox.dev/docs/concepts/floxhub).
Organizations and roles
An organization is a shared workspace with a private catalog, scoped access control and a base for collaboration (https://flox.dev/docs/concepts/organizations). The docs flag organizations as a paid feature “included with Flox for Teams” (https://flox.dev/docs/concepts/organizations). A user can belong to more than one organization (https://flox.dev/docs/concepts/organizations).
| Role | What it can do | Source |
|---|---|---|
| Owner | Full administrative access, including members and settings | https://flox.dev/docs/concepts/organizations |
| Writer | Create and update environments and packages; cannot manage members or settings | https://flox.dev/docs/concepts/organizations |
| Reader | View and pull environments and install packages; cannot create or modify them | https://flox.dev/docs/concepts/organizations |
An organization needs at least one owner and may have several. Owners cannot change their own role or remove themselves (https://flox.dev/docs/concepts/organizations). Environments and packages created in an organization are visible to all members, with access governed by RBAC (https://flox.dev/docs/concepts/organizations).
Say: “Three roles: owner, writer, reader. Owners manage people, writers publish, readers consume.” Ask: “Who should be allowed to publish to the shared catalog, and who only needs to install from it?”
SSO
Enterprise SSO is flagged as “a paid feature included with Flox Enterprise” (https://flox.dev/docs/concepts/enterprise-sso). Per the docs, Flox supports “any SAML or OIDC identity provider”, including Okta Workforce Identity, Entra ID and Google Workspace (https://flox.dev/docs/concepts/enterprise-sso).
- Self-serve setup. Organization owners set it up from the organization’s Settings tab, in a guided flow that includes verifying the company’s email domain with a DNS TXT record (https://flox.dev/docs/concepts/enterprise-sso). Each setup link is valid for 24 hours (https://flox.dev/docs/concepts/enterprise-sso).
- Sign-in. It is driven by email domain, on both FloxHub and
flox auth login(https://flox.dev/docs/concepts/enterprise-sso). - Provisioning. A new member joins the organization on first sign-in with the Reader role, and owners can raise it later (https://flox.dev/docs/concepts/enterprise-sso).
- Changes. To update or remove the connection, the docs say to contact support@flox.dev (https://flox.dev/docs/concepts/enterprise-sso).
- Not documented. SCIM or automatic deprovisioning does not appear in the page [verify].
Service accounts and tokens
A service account belongs to the organization rather than to the person who set it up. Facts (https://flox.dev/docs/concepts/service-accounts):
- Two access levels, Read-only (pull) and Read & write (also push and publish), applied across the whole organization and not narrowable to a subset.
- Only organization owners can create service accounts and issue tokens, and a service account is never an owner.
- Tokens begin
flox_sat_, last 30 days (default), 90 days, 1 year or no expiration, and are shown once. - Set the token in
FLOX_FLOXHUB_TOKEN; rotation needs no downtime because an account can hold several live tokens. - Service accounts need Flox CLI 1.14.0 or newer, and personal accounts cannot have them.
Personal access tokens (flox_pat_) carry your own access and “are available on every plan” (https://flox.dev/docs/concepts/personal-access-tokens). The August 2026 announcement frames them as one credential for a person and one for a machine (https://flox.dev/blog/flox-account-tokens-for-people-and-machines/).
Private and air-gapped distribution
- Private catalog. Each organization gets a private catalog (https://flox.dev/docs/concepts/organizations), and
flox publishuploads packages to it (https://flox.dev/docs/concepts/publishing). - Own storage. By default Flox provides a pre-configured Catalog Store for each organization; an organization may instead provide its own AWS S3 bucket (https://flox.dev/docs/customer/catalog-store).
- Air-gapped. The home page lists “Private distribution”: “Ship environments and packages from your own registry, on your network, air-gapped, with no dependency on the public internet.” (https://flox.dev/). The pricing page ties “Custom deployment options” to Enterprise, “so your software never “leaves the building"" (https://flox.dev/pricing/). The docs I read do not describe how an air-gapped install is built, so route that to a conversation with Flox [verify].
- Custom base catalog. Enterprise lists a “Custom base catalog” to curate open source software (https://flox.dev/pricing/). The base catalog itself is generated from a fork of nixpkgs (https://flox.dev/docs/concepts/base-catalog).
Plans, as the pricing page shows them
| Tier | Price | Includes beyond the tier below | Source |
|---|---|---|---|
| Personal | Free | Flox CLI, Flox Catalog, unlimited public FloxHub envs, 3 private FloxHub envs, 5 private packages, community support via Slack or Discourse | https://flox.dev/pricing/ |
| Team | $20/seat/month | Team catalog, unlimited publishing of packages, unlimited team FloxHub envs, platform support, paid consulting with Flox packaging experts | https://flox.dev/pricing/ |
| Enterprise | Custom pricing | Custom deployment options, custom base catalog, software policy engine, comprehensive packaging support, paid consulting with Nix packaging experts | https://flox.dev/pricing/ |
Say: “Individuals are free. Teams are twenty dollars a seat a month. Anything about curation, policy or deployment on your network is Enterprise and quoted.” Do not invent seat minimums, annual discounts or overage rules: the page lists none [verify with Flox sales]. Note that the organizations page says organizations come with Flox for Teams, while the pricing table lists the “team catalog” under Team (https://flox.dev/docs/concepts/organizations, https://flox.dev/pricing/).
Support and the SLA
Support is tiered in the pricing table: Personal gets “Community support” via Slack or Discourse, Team gets “Platform support”, and Enterprise adds “Comprehensive packaging support” (https://flox.dev/pricing/). The home page’s Enterprise section describes “Support with an SLA” as “A named team, response-time commitments, and a roadmap you can influence.” (https://flox.dev/). No response-time numbers, severity levels or support hours appear on that page or the pricing page [verify the actual SLA terms with Flox before quoting anything]. The login post lists support@flox.dev for questions, plus community Slack and Discourse (https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/).
Compliance
The compliance page says Flox has “achieved SOC 2 Type II and ISO/IEC 27001:2022 certifications” (https://flox.dev/compliance/). SOC 2 Type II is described as covering security, availability, processing integrity, confidentiality and privacy, performed by independent third-party auditors (https://flox.dev/compliance/). The page says customers and prospects can request the SOC 2 Type II report and the ISO/IEC 27001:2022 certificate, existing customers through their account representative or the security team, and security issues go to security@flox.dev (https://flox.dev/compliance/). The audit period and the auditor are not stated [verify].
Advice: lead with “request the report during security review”, not with a badge.
The October 20, 2026 login requirement
“Starting Tuesday, October 20, 2026”, Flox CLI commands that install, upgrade or resolve packages from the Flox Catalog require a free FloxHub account (https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/). The stated reason is that as agents generate more Catalog traffic, authentication helps identify and curb abusive automation (same post). “This isn’t a paywall.” The post says FloxHub accounts are 100% free and the free tier keeps all its existing capabilities (same post).
| Needs a login | Stays public |
|---|---|
flox install, flox upgrade, flox run, flox include upgrade, and flox init, flox edit or flox activate when they must resolve packages with no valid lockfile | flox search, flox show, and flox pull for public packages and environments; activating an environment with a valid lockfile |
(https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/). Log in with flox auth login using GitHub, Google or GitLab. For CI, commit manifest.lock or provide a service account token in FLOX_FLOXHUB_TOKEN, which needs Flox v1.14.0 or newer. Versions 1.3.5 through 1.13.x support interactive login only, and older than v1.3.5 must upgrade (same post).
Two sources differ on the release: the blog says the change ships with Flox v1.19.0 (https://flox.dev/blog/flox-catalog-login-requirement-what-you-need-to-know/) and the docs page says Flox 1.19.3 (https://flox.dev/docs/concepts/authentication) [verify which to quote]. Both say it applies to older versions too.
Say: “Reading is open, resolving needs a free account, and a committed lockfile keeps CI working without credentials.” Ask: “Do your pipelines install packages every run, or activate a locked environment?”