Calix Cloud

This guide walks through connecting Calix Cloud to Layer 9 by creating an API user and assigning the APIUser role.

If your Calix Cloud organization is configured to require all user accounts to share your BSP email domain, you will also need to set up an email forwarding group so the Layer 9 connection email appears to be on your domain. See Does my organization require a BSP-domain email? below.

Prerequisites

Administrator access to Calix Cloud
The Layer 9 connection email address (for example: yourcompany@layer9.com), provided by Layer 9

Does my organization require a BSP-domain email?

Calix Cloud organizations can be configured to restrict user accounts to the organization’s BSP email domain. When this restriction is active, any user added to the org must have an email address on your company’s domain (for example, user@yourcompany.com). Third-party or external addresses are rejected, and Calix documents federated access as the alternative for outside users.

You most likely have this restriction if:

You cannot add a user with an arbitrary external email address on the Administration > Users page
Your Calix account representative has told you that user emails must match your BSP domain
Your organization was onboarded with a BSP domain lock

If the restriction is not active, skip to Step 1: Create the Calix Cloud user and use the Layer 9 connection email directly.

If the restriction is active, complete the email forwarding setup first, then continue with Step 1.

Optional: Email forwarding setup (domain-restricted orgs only)

Complete this section only if your Calix Cloud org requires user emails to match your BSP domain.

Create a mail distribution list on your domain (for example, layer9@yourcompany.com) that forwards all incoming messages to the Layer 9 connection email. You will use the on-domain forwarding address when creating the Calix Cloud user in Step 1.

Option A: Google Workspace

Create a group and configure it to forward mail from layer9@yourcompany.com to the Layer 9 connection email.

Create and manage Google groups in the Google Cloud console

Option B: Office 365 (Exchange Online)

Create a mail-enabled security group or distribution list and configure forwarding from layer9@yourcompany.com to the Layer 9 connection email.

Create and manage groups in the Exchange admin center

Once forwarding is verified, share:

The forwarding address (the group/distribution address on your domain)
Confirmation that messages sent to the group address are received at the Layer 9 connection email

Step 1: Create the Calix Cloud user

In Calix Cloud, create a user account and set the email to:

The Layer 9 connection email directly (for example, yourcompany@layer9.com), if your org does not restrict users to your BSP domain
The on-domain forwarding address (for example, layer9@yourcompany.com), if your org does restrict users to your BSP domain

Step 2: Apply the APIUser role

Log in to Calix Cloud as an Organization Administrator
Navigate to Administration > Users
Locate the API user and click the pencil icon to edit
Select APIUser from the Add/Delete Roles dropdown
Click Add to assign the role