Sonar Getting Started: Setup and First Scan (2026)

Getting started overview

Getting started with Sonar involves selecting the appropriate product—either SonarQube for self-managed deployments or SonarCloud for cloud-based analysis—and then integrating it into your development workflow. Both platforms provide static code analysis capabilities to identify bugs, vulnerabilities, and code smells across various programming languages. The initial setup requires creating an account or installing the server, setting up a project, and then performing your first scan.

This guide focuses on the streamlined process for both SonarQube (Community Edition) and SonarCloud, covering account creation, obtaining necessary credentials, and executing a preliminary code analysis. While SonarLint offers immediate feedback within an Integrated Development Environment (IDE), the broader SonarQube and SonarCloud platforms provide comprehensive project-level analysis and reporting.

Quick Reference Steps

Create an account and get keys

The first step involves either signing up for SonarCloud or installing SonarQube Community Edition. The choice depends on whether you prefer a managed cloud service or a self-hosted solution.

SonarCloud Setup

1. Sign Up: Navigate to the SonarCloud registration page. You can sign up using an existing account from GitHub, GitLab, Bitbucket, Azure DevOps, or a standalone email.
2. Organization Creation: After signing up, you will be prompted to create an organization. This is a logical grouping for your projects.
3. Project Creation: Within your organization, you can create a new project. SonarCloud can automatically import projects from connected SCMs (Source Code Management systems) like GitHub, simplifying the initial setup. Follow the on-screen prompts to connect your repository.
4. Generate Token: To allow the SonarScanner to authenticate and submit analysis results, you need to generate a user token. In SonarCloud, go to your account settings (top-right user icon) > Security. Under 'Tokens', generate a new token and record it securely. This token acts as your API key for scanning.

SonarQube Community Edition Setup

1. Download: Download the latest SonarQube Community Edition from the official SonarQube download page.
2. Installation: Follow the SonarQube 2-minute setup guide for your operating system. This typically involves unzipping the distribution and running a start script. SonarQube usually runs on http://localhost:9000 by default.
3. Initial Login: Log in to the SonarQube interface using the default administrator credentials (admin/admin). You will be prompted to change the password.
4. Project Creation: From the SonarQube dashboard, click 'Create new project'. Provide a project key and display name.
5. Generate Token: In SonarQube, go to your user icon (top-right) > My Account > 'Security'. Under 'Tokens', generate a new token for your project and save it.

Your first request

A "request" in the context of Sonar typically refers to initiating a code analysis scan. This involves using a SonarScanner tool to analyze your codebase and send the results to your SonarQube or SonarCloud instance.

Prerequisites

• A SonarCloud project created with a generated token, or a running SonarQube instance with a project and token.
• The appropriate SonarScanner installed. You can find instructions for various scanners (CLI, Maven, Gradle, .NET, Ant) in the SonarScanners documentation. For most general-purpose projects, the SonarScanner CLI is suitable.
• Java Runtime Environment (JRE) 11 or higher for the SonarScanner CLI (Mozilla JRE definition).

Example: Performing a Scan using SonarScanner CLI

This example assumes you have the SonarScanner CLI installed and configured in your system's PATH, and you are running it from the root directory of your source code project.

For SonarCloud:

1. Navigate to Project Directory: Open your terminal or command prompt and navigate to the root directory of your source code project.
2. Execute Scan Command: Run the following command, replacing placeholders with your specific details:

sonar-scanner \
  -Dsonar.projectKey="[YOUR_ORGANIZATION_KEY]_[YOUR_PROJECT_KEY]" \
  -Dsonar.organization="[YOUR_ORGANIZATION_KEY]" \
  -Dsonar.host.url="https://sonarcloud.io" \
  -Dsonar.token="[YOUR_GENERATED_TOKEN]"

Replace [YOUR_ORGANIZATION_KEY] and [YOUR_PROJECT_KEY] with the keys from your SonarCloud project setup, and [YOUR_GENERATED_TOKEN] with the token you created.

For SonarQube:

1. Navigate to Project Directory: Open your terminal or command prompt and navigate to the root directory of your source code project.
2. Execute Scan Command: Run the following command, replacing placeholders:

sonar-scanner \
  -Dsonar.projectKey="[YOUR_PROJECT_KEY]" \
  -Dsonar.host.url="http://localhost:9000" \
  -Dsonar.token="[YOUR_GENERATED_TOKEN]"

Replace [YOUR_PROJECT_KEY] with the key from your SonarQube project, and [YOUR_GENERATED_TOKEN] with the token you created. If your SonarQube instance is not on localhost:9000, adjust sonar.host.url accordingly.

Viewing Results

After the scanner completes, it will output a link to your project's dashboard in SonarCloud or SonarQube. Click this link or navigate to your project in the respective web interface to view the analysis results, including detected issues, code smells, vulnerabilities, and code coverage metrics.

Common next steps

Once your initial scan is complete and you have reviewed the results, consider these common next steps to integrate Sonar more deeply into your development workflow:

• Integrate with CI/CD Pipeline: Automate scanning as part of your Continuous Integration/Continuous Delivery pipeline. Sonar provides integrations with popular CI/CD tools like Jenkins, GitLab CI, GitHub Actions, and Azure DevOps to ensure every code change is analyzed automatically (SonarQube CI/CD integration guide). This helps enforce quality gates and prevent new issues from being introduced.
• Configure Quality Gates: Define and customize Quality Gates to set thresholds for code quality and security metrics. A Quality Gate is a set of conditions that a project must meet before it can be considered releasable. If a project fails its Quality Gate, the CI/CD pipeline can be configured to break the build, preventing the deployment of substandard code.
• Install SonarLint: For immediate feedback, install the SonarLint IDE extension for your preferred IDE (e.g., VS Code, IntelliJ IDEA, Eclipse). SonarLint provides real-time analysis as you code, highlighting issues directly in your editor before they are committed. It can be connected to SonarQube or SonarCloud to synchronize quality profiles and issue definitions.
• Customize Quality Profiles: Adjust the default quality profiles to match your team's coding standards and project requirements. Quality profiles determine which rules are applied during analysis. You can enable or disable rules, create custom profiles, and manage rule severities within the SonarQube or SonarCloud interface.
• Onboard Team Members: Ensure all developers understand how to interpret Sonar analysis results and integrate SonarLint into their local development environment. Effective use of Sonar requires team-wide adoption and commitment to addressing identified issues.

Troubleshooting the first call

Encountering issues during the initial setup or first scan is common. Here are some troubleshooting tips for common problems:

• "Project not found" or "Unauthorized" errors:
  • Token Validity: Ensure the sonar.token in your scan command is correct and has not expired or been revoked. Generate a new token if unsure.
  • Project Key Mismatch: Verify that sonar.projectKey (and sonar.organization for SonarCloud) exactly matches the key defined in your SonarQube/SonarCloud project settings. Keys are case-sensitive.
  • Permissions: For SonarQube, ensure the user associated with the token has 'Execute Analysis' permission on the project. For SonarCloud, ensure the token's user has appropriate access to the organization and project.
• "Unable to connect to SonarQube/SonarCloud server" errors:
  • URL Correctness: Double-check sonar.host.url. For SonarQube, ensure the server is running and accessible from where you are running the scanner. For SonarCloud, ensure there are no network restrictions blocking access to https://sonarcloud.io.
  • Firewall/Proxy: If you are behind a corporate firewall or proxy, you may need to configure proxy settings for the SonarScanner. Refer to the SonarScanner CLI documentation on analysis parameters for proxy configuration options.
  • SonarQube Server Status: If using SonarQube, confirm that the SonarQube server process (e.g., ./bin/[OS]/sonar.sh start or Windows service) is actively running and listening on the specified port.
• "Java version not supported" or "No Java Runtime Environment (JRE) found" errors:
  • JRE Installation: Ensure that Java Runtime Environment (JRE) version 11 or higher is installed on the machine running the SonarScanner.
  • PATH Configuration: Verify that Java is correctly configured in your system's PATH environment variable, allowing the scanner to locate it.
• Scanner logs not showing progress or errors:
  • Verbose Logging: Run the scanner with -Dsonar.log.level=DEBUG flag to get more detailed output, which can help pinpoint the exact failure point.
  • Review Documentation: Consult the official SonarSource documentation for specific error messages or configurations related to your language and build system.