Open app
Docs/Installing the Agent

Enroll a new agent

Before a server can report into Demerzel it needs an identity. That starts with an enrollment token — a short-lived, single-use secret that authorizes one machine to join your organization.

How enrollment works

You never type your organization’s credentials onto a server. Instead:

  • You generate an enrollment token in Demerzel.
  • The agent exchanges that token for a certificate that carries a unique, server-assigned identity (demerzel://tenant/agent).
  • The token is burned on first use and expires automatically.

Generate a token

In Demerzel, open Agents in the sidebar and click Generate enrollment token (owners and admins only). The token is shown once — copy it right away, along with the ready-to-run enroll command:

demerzel-agent --enroll 3f3bb78180e0a68d4226584f4327dbccd42de37e

Each token is single-use and valid for 24 hours. Need to connect several servers? Generate one token per machine.

Treat the token like a password. Copy it over a secure channel to the target server. A single-use token with a short lifetime keeps the blast radius small if it ever leaks — and once a machine has enrolled, it authenticates with its own certificate, not the token.

The Agents page also lists every server that has enrolled, with its status and when it connected.

Rename or delete an agent

Owners and admins can give an agent a readable name, or delete it from the Agents page. Deleting revokes it: the agent drops off the list and its certificate is refused from then on, so a retired or duplicate host stops reporting. The data it already sent is kept, and nothing changes on the host — uninstall the binary there yourself. Both are recorded in the activity log.

Next

With a token in hand, continue to Download & run the agent.