Enroll a host

Before enrollment, confirm that sshd -t succeeds and that an independent administrative path is tested.

Issue the token

In Resources, choose Enroll a host and select the target host group. The token is:

• returned and downloaded once;
• scoped to one host group;
• single-use; and
• valid for ten minutes.

Do not put it in a command argument, environment variable, image, ticket, or shared deployment script.

Linux

sudo install -d -o root -g root -m 0700 /etc/tenvyr
sudo install -o root -g root -m 0600 \
  /secure/staging/tenvyr-enrollment-TOKEN_ID.token \
  /etc/tenvyr/enrollment-token

sudo tenvyr-agent \
  -api https://agents.tenvyr.com \
  -enrollment-token-file /etc/tenvyr/enrollment-token \
  -once

The agent generates its private mTLS key locally. After durable enrollment, it securely consumes the token file and keeps an empty mode-0600 placeholder.

Verify

sudo test -s /var/lib/tenvyr/identity.json
sudo test "$(stat -c '%U:%G %a' /etc/tenvyr/enrollment-token)" = "root:root 600"

The token file should be empty after successful enrollment. Confirm the host appears in the intended group and that reported host keys match the machine.

Endpoint check

This request contains no credential:

curl -i -X POST https://agents.tenvyr.com/agent/v1/enroll \
  -H 'Content-Type: application/json' \
  --data '{}'

A reachable agent plane returns 400 with invalid_enrollment. https://app.tenvyr.com/agent/... intentionally returns 404.

Retry behavior

If a response is lost before the agent accepts its identity, a current agent preserves the original key, CSR, and non-secret request metadata for a safe retry with the same unexpired token. Do not replace the key or create a second host record manually.