Enroll a new agent
Before a server can report into Demerzel it needs an identity. That starts with an enrollment token — a short-lived, single-use secret that authorizes one machine to join your organization.
How enrollment works
You never type your organization’s credentials onto a server. Instead:
- You generate an enrollment token in Demerzel.
- The agent exchanges that token for a certificate that carries a unique, server-assigned identity (
demerzel://tenant/agent). - The token is burned on first use and expires automatically.
Generate a token
In Demerzel, open Agents in the sidebar and click Generate enrollment token (owners and admins only). The token is shown once — copy it right away, along with the ready-to-run enroll command:
demerzel-agent --enroll 3f3bb78180e0a68d4226584f4327dbccd42de37e
Each token is single-use and valid for 24 hours. Need to connect several servers? Generate one token per machine.
Treat the token like a password. Copy it over a secure channel to the target server. A single-use token with a short lifetime keeps the blast radius small if it ever leaks — and once a machine has enrolled, it authenticates with its own certificate, not the token.
The Agents page also lists every server that has enrolled, with its status and when it connected.
Next
With a token in hand, continue to Download & run the agent.