Connect tokens

Connect tokens authenticate the agent to the edge. Hashed at rest, plaintext only at issue time.

What a token does

When you run engress-agent tunnel serve, the agent presents a connect token to prove it is allowed to register for a specific endpoint. The control plane checks the token, associates the session with your endpoint, and lets the edge accept traffic for that hostname.

Tokens are not API keys for your model. They only authorize the outbound tunnel. Model-level auth (if any) stays on your local server.

Issue and store

1. In the Capacitor dashboard, open your endpoint.
2. Click Issue connect token.
3. Copy the value immediately. The UI will not show it again.

This plaintext token is shown once. Copy it before closing.

Pass the token to the agent through your environment or secret store — not committed to git.

Scopes

Each token is bound to a single endpoint. You can issue multiple tokens for the same endpoint (for example one per laptop). Revoke any token independently without affecting the others.

Revocation

Revoke a token from the dashboard when:

• You pasted it into a shared channel by mistake.
• You decommission a machine that had the token in its environment.
• You rotate credentials on a schedule.

After revocation, existing agent processes using that token fail to re-register on reconnect. Issue a new token and restart the agent.

Next

CLI reference — full command and flag list for engress-agent.