Enrollment Tokens and Ephemeral Machines

Enrollment tokens create short-lived machine identities for CI jobs, autoscaling services, serverless functions, preview environments, and other workloads that appear and disappear automatically. Each machine is approved as it enrolls, receives the projects and secret grants defined by the token, and stops authenticating when its lifetime ends.

#Choose the right machine type

Use the lifecycle that matches the workload:

A single enrollment token can create many ephemeral machines from the same policy. Each enrollment still creates a separate machine ID and keypair, so reads remain attributable to the individual machine.

#How enrollment works

The token lifetime and machine lifetime are independent. When the token expires, is exhausted, or is revoked, it stops creating new machines. Machines it already created continue until their own expiration unless you disable or revoke them separately.

#Create an enrollment token

Limits

Token settings are fixed after creation. To change the project scope, secret grants, lifetime, restrictions, or capacity, create a replacement token and revoke the old one after the new deployment is ready. Secrets created later are not added to an existing token automatically.

#Add enrollment restrictions

A name pattern supports {uuid} for eight random lowercase letters and numbers, or {uuidN} for 4 to 32 characters. For example, worker-{uuid12} can create a name such as worker-f4k9m2q7r1dx.

The vault IP Allowlist also applies during enrollment and during later secret reads. The token’s source CIDR is an additional enrollment restriction. After enrollment, project availability, the machine’s explicit grants, and any policy attached to a secret are checked on every read.

#Copy the token and enrollment commands

After creation, SikkerKey shows the plaintext token and ready-to-run Linux, macOS, and Windows commands. This is the only time the plaintext is available from the dashboard.

curl -sSL https://api.sikkerkey.com/v1/VAULT_ID/enroll/TOKEN | sh

irm https://api.sikkerkey.com/v1/VAULT_ID/enroll/TOKEN/ps | iex

Copy the token or complete command before closing the result. Sensitive clipboard copies are cleared after 30 seconds when the browser permits it. If the value is lost, create a replacement token; the stored token cannot be revealed later.

#Enroll a machine with the command

The enrollment script:

• checks for openssl and curl;

• generates an Ed25519 keypair on the machine;

• sends only the public key, token, and hostname to SikkerKey;

• stores the identity under ~/.sikkerkey/vaults/{vaultId}/ on Linux and macOS, or under %USERPROFILE%\.sikkerkey\vaults\{vaultId}\ on Windows;

• applies restrictive file permissions on Linux and macOS; and

• records the machine ID, name, service address, key location, and expiration in the identity file.

The machine is approved immediately and can use the token’s grants as soon as enrollment completes. No separate approval or access-configuration step is required.

#Enroll without writing an identity to disk

Serverless functions and read-only containers can enroll directly through a SikkerKey SDK. The SDK creates the keypair in memory, registers an ephemeral machine, and uses the in-memory private key for signed reads. The private key disappears when the process ends.

Node.js

import { SikkerKey } from '@sikkerkey/sdk'

const sk = SikkerKey.bootstrap(
  process.env.SIKKERKEY_VAULT_ID,
  process.env.SIKKERKEY_ENROLLMENT_TOKEN,
).inMemory()

const value = await sk.getSecret('sk_example')

Python

import os
from sikkerkey import SikkerKey

sk = SikkerKey.bootstrap_in_memory(
    os.environ["SIKKERKEY_VAULT_ID"],
    os.environ["SIKKERKEY_ENROLLMENT_TOKEN"],
)

value = sk.get_secret("sk_example")

Memory-only bootstrap is also available in the Go, .NET, Kotlin/JVM, and PHP SDKs. Use a short machine lifetime for cold-started workloads, choose a maximum-enrollment count that covers expected starts and concurrency, and use a unique name pattern so instances are easy to distinguish in the dashboard.

#Understand token status

The Enrollment Tokens table shows the token name and description, status, used and maximum enrollments, enrolled machine count, machine lifetime, token expiration, and creation time. Search by name or description. Revoked tokens are hidden by default; select Show revoked to include them.

Open Configure to review the token’s projects, secret grants, restrictions, machine lifetime, remaining uses, and machines enrolled through it. The machine list shows current status and last-seen activity, with additional rows available through Load more.

#Revoke a token

Revocation takes effect immediately for new enrollments and cannot be reversed. It does not disable or revoke machines already created by that token. Open Machines and revoke those machine identities separately when they must stop immediately.

#Manage enrolled machines

Ephemeral machines appear in All Machines with an ephemeral badge and their remaining lifetime. From the machine row you can:

• rename the machine;

• open History to review name changes and audit activity;

• disable it before expiration and enable it again while its lifetime remains active; or

• revoke it immediately, removing its registration, project memberships, and secret grants.

The machine lifetime is fixed at enrollment. When a workload needs a different lifetime, enroll a replacement through an appropriately configured token.

#Expiration and cleanup

An expired or disabled machine no longer counts as an active machine for the vault’s machine allowance. A retained record can still appear in token and machine views until automatic cleanup removes it.

A token’s own expiration is separate. It simply stops accepting new enrollments and receives an expiration entry in the Audit Log. Existing machines keep their individual lifetimes.

#Permissions

Vault owners receive full access. Organization members receive these permissions through their vault role. When a member creates a token, its projects must also be within that member’s project access.

#Troubleshoot enrollment and access