> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Install and enrollment tokens

> Where the credentials computers join with are made, what Settings › API tokens still creates, and why revoking a package's token disconnects its computers.

Computers join your organisation with one of two credentials, and both are made in [Add machines](https://docs.quintai.dev/install/add-machines.md), not on **Settings › API tokens**:

* An **install package**, for a group of computers. Its join code is inside the files your management tool pushes. It adds computers until it is full, it expires after a year, or you stop it in [Machines & licensing](https://docs.quintai.dev/settings/machines-and-licensing.md).
* A **one-time install code**, for one computer. It adds one computer and stops working after 24 hours.

Creating and revoking tokens needs the **Admin** or **Owner** role.

## What API tokens creates

Under **Create a token**, the **Type** list offers two types:

* **Service** is a read credential for a system that pulls the API, such as a SIEM, CI or a script. It never expires unless you pick a lifetime.
* **Personal** is your own read access from a script. It lasts up to 90 days.

Neither type can enrol a computer.

**1. Open API tokens**

Open **Settings › API tokens**. Until you create one, the table reads "No API tokens issued for this org yet."

**2. Fill in the form**

Under **Create a token**, enter a **Name**, choose the **Type** and an **Expires in** value. Scopes and expiry are set by the token type.

**3. Copy it now**

The token appears once, under the notice "Copy this token now — it is shown once and cannot be retrieved again". Paste it into your password manager or secret store, then click **I've stored it — dismiss**.

**4. Confirm it was used**

The table shows **Token** (prefix only, never the secret), **Scopes**, **Created by**, **Created**, **Last used** and **Expiry**. **Last used** changes after the first request with it.

## Package and install tokens in the table

Each install package's join code is listed in the table as an enrollment token, with the link **Install package · in Machines & licensing**. Manage it in [Machines & licensing](https://docs.quintai.dev/settings/machines-and-licensing.md), where you see how many computers joined with it, and where you stop it.

A one-time install code's token is listed too, as an install token. It is single-use: once its computer joins, the token is spent and listed as **Used**, and the computer keeps reporting with the credentials it was issued. Revoking a used install token disconnects that computer, as revoking a package's token disconnects the package's computers.

## Revoking disconnects computers

Revoking an enrollment or install token takes effect immediately, and it reaches the computers that joined with it: every computer it enrolled loses the credentials it was issued and stops sending data until it is enrolled again. The revoke dialog says what it reaches before you confirm. Revoking can't be undone.

To end a rollout and keep the joined computers running, stop the package in [Machines & licensing](https://docs.quintai.dev/settings/machines-and-licensing.md) instead. Revoke only when the computers themselves must be cut off.

## Fleet settings for enrolment

Under **Settings › Fleet**, **Require an install or enrollment token** refuses a machine that arrives without one. **Live install tokens, at most** caps how many one-time install codes can be live at once; the default is no limit. Both need an **Admin** or **Owner**.

## If this fails

| What you see | What it means | What to do |
| - | - | - |
| "No API tokens issued for this org yet." | No token has been created in this workspace | Click **Create a token**. |
| You need the token value again | It was shown once and is not retrievable | Revoke it and create a new one. |
| There is no **Enrollment** type in the list | Credentials for computers are made in **Add machines** | Open [Add machines](https://docs.quintai.dev/install/add-machines.md). |
| "Admin only — your role can view this setting but not change it." under **Settings › Fleet › Agent rollout** | Your role is **Read** or **Policy Writer**: you can see the rollout target, but the fields and **Save** are disabled | Ask an **Admin** or **Owner** to change it. |
| A machine enrols with no token | **Require an install or enrollment token** is off | Turn it on under **Settings › Fleet**. |

## Next

* [Add machines](https://docs.quintai.dev/install/add-machines.md)
* [Machines & licensing](https://docs.quintai.dev/settings/machines-and-licensing.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.