Install and enrollment tokens

Where the credentials computers join with are made, what Settings › API tokens still creates, and why revoking a package’s token disconnects its computers.

Computers join your organisation with one of two credentials, and both are made in Add machines, not on Settings › API tokens:

• An install package, for a group of computers. Its join code is inside the files your management tool pushes. It adds computers until it is full, it expires after a year, or you stop it in Machines & licensing.
• A one-time install code, for one computer. It adds one computer and stops working after 24 hours.

Creating and revoking tokens needs the Admin or Owner role.

​

What API tokens creates

Under Create a token, the Type list offers two types:

• Service is a read credential for a system that pulls the API, such as a SIEM, CI or a script. It never expires unless you pick a lifetime.
• Personal is your own read access from a script. It lasts up to 90 days.

Neither type can enrol a computer.

1. Open API tokens

   Open Settings › API tokens. Until you create one, the table reads “No API tokens issued for this org yet.”

2. Fill in the form

   Under Create a token, enter a Name, choose the Type and an Expires in value. Scopes and expiry are set by the token type.

3. Copy it now

   The token appears once, under the notice “Copy this token now — it is shown once and cannot be retrieved again”. Paste it into your password manager or secret store, then click I’ve stored it — dismiss.

4. Confirm it was used

   The table shows Token (prefix only, never the secret), Scopes, Created by, Created, Last used and Expiry. Last used changes after the first request with it.

​

Package and install tokens in the table

Each install package’s join code is listed in the table as an enrollment token, with the link Install package · in Machines & licensing. Manage it in Machines & licensing, where you see how many computers joined with it, and where you stop it.

A one-time install code’s token is listed too, as an install token. It is single-use: once its computer joins, the token is spent and listed as Used, and the computer keeps reporting with the credentials it was issued. Revoking a used install token disconnects that computer, as revoking a package’s token disconnects the package’s computers.

​

Revoking disconnects computers

Revoking an enrollment or install token takes effect immediately, and it reaches the computers that joined with it: every computer it enrolled loses the credentials it was issued and stops sending data until it is enrolled again. The revoke dialog says what it reaches before you confirm. Revoking can’t be undone.

To end a rollout and keep the joined computers running, stop the package in Machines & licensing instead. Revoke only when the computers themselves must be cut off.

​

Fleet settings for enrolment

Under Settings › Fleet, Require an install or enrollment token refuses a machine that arrives without one. Live install tokens, at most caps how many one-time install codes can be live at once; the default is no limit. Both need an Admin or Owner.

​

If this fails

What you see	What it means	What to do
”No API tokens issued for this org yet.”	No token has been created in this workspace	Click Create a token.
You need the token value again	It was shown once and is not retrievable	Revoke it and create a new one.
There is no Enrollment type in the list	Credentials for computers are made in Add machines	Open Add machines.
”Admin only — your role can view this setting but not change it.” under Settings › Fleet › Agent rollout	Your role is Read or Policy Writer: you can see the rollout target, but the fields and Save are disabled	Ask an Admin or Owner to change it.
A machine enrols with no token	Require an install or enrollment token is off	Turn it on under Settings › Fleet.

​

Next

• Add machines
• Machines & licensing