Contractor Getting Started

Your organization invites you to ARROW for a fixed period and assigns the devices you need. You finish your own account setup, protect your sign-in with two-factor authentication, and connect your workstation to the organization’s VPN.

Have your invitation email and an authenticator app ready. ARROW shows you your organization’s VPN connection details. Your organization administrator manages your assignments, VPN approval, and access expiry.

1. Accept your invitation

Open the ARROW contractor invitation email and select Accept your invitation.
Check Organization, Invited email, Invitation expires, and Account access until.
Select Set up your account.
When ARROW shows Check your email, open the new setup email and follow the instructions to finish your account setup.
Return to ARROW and select Continue to ARROW sign in.

Contractor Invitation page with organization, invited email, two expiry dates, and Set up your account

Check your organization and email before starting. The dates shown are from the BeeWare demonstration account.

Your invitation expiry is the deadline for using that link. Account access until is the separate deadline for your access to ARROW. Completing setup does not restart the access period.

Check your email page with Continue to ARROW sign in

Finish the setup email first, then return here to sign in.

The setup email may use the wording Reset ARROW Password. Use the setup email you just requested to choose your password. If sign-in asks for E-Mail Verification, enter the code from the verification email and select Next. Use Resend Code if needed. After successful verification, select Next to continue.

E-Mail Verification screen with an empty Code field and Resend Code button

Email verification confirms your address. It is separate from authenticator setup.

If the page says This link is no longer valid, ask your organization administrator for help with a new invitation. Do not forward your invitation or account setup link to anyone else.

2. Complete two-factor authentication

Sign in using the identity from your invitation. ARROW requires two-factor authentication before you can use the contractor console.

You may go straight from email verification to 2-Factor Verification. Open your authenticator app, add an account by scanning the QR code shown on your own screen, and enter the current code. Select Next. When 2-factor Verified appears, select Next again to continue to ARROW.

2-factor Verified confirmation with a Next button

Enrollment is complete when this confirmation appears. Select Next to continue.

If you reach ARROW’s MFA setup page instead:

Select Continue to sign in and set up MFA.
Follow the identity provider’s instructions to enroll your authenticator app and verify a code.
Return to ARROW. If the setup page remains open, select I’ve finished setup - check again.

If you use Open Zitadel account settings instead, look under Multifactor Authentication and add an Authenticator app (OTP). An empty list means you have not enrolled one yet. If no option to add one appears after reloading, contact your organization administrator.

Keep your password, authenticator codes, and recovery information private. Your administrator can manage your access without asking for them.

3. Connect your workstation to the VPN

You need the NetBird client to reach assigned devices over the private network. Signing in to the ARROW website does not connect your workstation to the VPN.

ARROW gives you your organization’s VPN address and the exact command to connect. Open Connect to VPN in the sidebar for the full guide, with tabs for macOS, Windows, and Linux. The card at the top of Devices, such as Connect to BeeWare VPN, carries the same steps in short form, and its Setup guide button opens the guide. Your invitation email includes these steps too when your organization’s VPN is set up in ARROW.

Install the NetBird client on the computer you work from. The guide links to NetBird’s installation page.
Copy the connect command from ARROW and run it in a terminal. It points NetBird at your organization’s Management URL. If you use the NetBird app instead, enter that URL in the app’s settings, then connect.
When the ARROW sign-in page opens, enter your email address and complete two-factor authentication as you do for ARROW.
If approval is required, ask your administrator to approve you in ARROW > VPN > Team.
After approval, reconnect the VPN client if needed and refresh Devices in ARROW.

To check the connection, run netbird status. Management and Signal should both read Connected.

Use the workstation sign-in flow. Do not use a device setup key for your workstation.

If ARROW says no VPN is set up for your organization yet, there is no address to connect to. Ask your organization administrator how to reach your devices.

ARROW shows a message above your devices if your VPN access is awaiting approval, blocked, still being enrolled, or cannot be verified, or if your VPN account could not be set up. Your administrator handles approval in ARROW; you do not need access to the NetBird administration site.

If the NetBird client says Login Failed with user pending approval cannot add peers, your VPN account needs administrator approval. Ask your administrator to open ARROW > VPN > Team, approve your access, and then retry the client sign-in.

NetBird client login error stating user pending approval cannot add peers

This message requires VPN approval in ARROW before you can connect.

4. Find your assigned devices

After account setup and MFA, ARROW opens Devices. You use the same device console as the rest of your organization, with the controls that apply to your account.

Switch between the grid and list views to browse your devices.
Use search and filters to find the device you need.
Select Show Details to inspect the device, including its location and available network, software, and status information.
Check the access expiry notice above the device list.
Use the VPN card at the top of the page for your connection details. It starts collapsed once your VPN account is ready, and the arrow on the card shows or hides the steps.

Your console contains Devices, Connect to VPN, and Account Settings, with a link to documentation. Organization-wide user administration, billing, requests, and VPN administration are managed by your organization administrator.

Contractor Devices console showing access expiry, VPN enrollment guidance, and no assigned devices

Before assignments, Devices can be empty. The notice above the list shows your access expiry and VPN guidance.

If a device is missing, ask your administrator to check its assignment. A VPN connection alone does not make unassigned devices appear.

5. Open a device

Keep the NetBird client connected, then use the device’s connection control in ARROW. Physical devices open ARROW Manager; virtual appliances open ARROW Control.

A physical device can also run virtual machines of its own. Select Show Details, or open the device details panel, and the VMs & Containers card lists them. Control beside a VM opens ARROW Control on it, already signed in. Only a VM whose ARROW Control is registered to your organization has the button.

On a running virtual appliance, the window on its card can also show the appliance’s desktop as it is now. Click the window to open that desktop in a new browser window, already signed in to ARROW Control. The desktop comes over the VPN, so it only appears while your NetBird client is connected and your VPN access is ready.

Connections provide administrative access to the assigned device. Follow your organization’s instructions for the work you perform there.

If ARROW refuses the connection, check the message before retrying. VPN approval, current account access, a current assignment, and a compatible available device are all required. Do not try to work around a denied connection with a shared administrator login. Ask your organization administrator to check the device and your access.

For the tools available after connecting, see ARROW Manager and ARROW Control.

Manage your account and access period

Use Account Settings for your own profile and account security. Sign out when you finish, especially on a shared workstation.

You cannot change your account’s expiry or reactivate it yourself. Contact your organization administrator before the expiry date if you need more time. They can extend access from your row’s Actions menu in Users.

If access expires or is deactivated, ask the administrator to reactivate the account if the work should continue. You can use the same account after reactivation, but you must sign in again and verify two-factor authentication. Your administrator may also need to review VPN approval.

Troubleshooting

What you see	What to do
No invitation email	Check spam and confirm your email address with the administrator.
This link is no longer valid	Ask your administrator for a replacement invitation.
MFA setup keeps appearing	Finish authenticator enrollment, return to ARROW, and select I’ve finished setup - check again.
No assigned devices	Ask the administrator to assign you under the device’s Assigned Consultants list.
NetBird says user pending approval cannot add peers	Ask the administrator to approve you in ARROW > VPN > Team, then retry VPN sign-in.
VPN access is awaiting approval	Ask the administrator to approve you in ARROW > VPN > Team, then refresh.
VPN access is blocked	Ask the administrator to review the block.
VPN status cannot be verified	Refresh and ask the administrator to check VPN > Team.
VPN account setup could not be completed	Contact your administrator, then refresh to retry. The message clears once your VPN account is ready.
Your administrator must enable VPN restrictions	Your organization must finish its VPN access review before connections are available.
No VPN is set up for your organization in ARROW yet	Ask your administrator how to reach your devices.
Your computer is already on another NetBird network	Run `netbird down`, then run the connect command from Connect to VPN again.
Device is listed but will not open	Check that your workstation VPN is connected and the device is available. Give your administrator the error message.
Location or another detail is blank	The device may not have that information recorded. Ask your administrator to check the device record.
Access has expired	Ask your administrator to reactivate your account with a new expiry.

Your administrator’s instructions are in Managing Contractors.