Standard Machines

Standard machines are long-lived identities for servers, developer workstations, and other trusted hosts that need controlled access to secrets. Each machine receives its own identity, is approved from the dashboard, and can read only the secrets explicitly granted to it.

#How standard machines work

A machine moves through a short setup flow before it can read a secret:

Project membership and secret grants work together. Adding a machine to a project establishes where it may operate; granting secrets defines exactly what it may read within that project.

#Prepare the machine

Run the bootstrap command directly on the host that will use the identity.

• Linux and macOS require curl and OpenSSL.

• Windows requires OpenSSL in PATH. The dashboard provides a PowerShell command.

• You need permission to manage machines in the vault.

• The host must be able to connect to SikkerKey from an address permitted by the vault IP Allowlist when that control is enabled.

#Bootstrap a standard machine

The bootstrap command uses the host name as the initial machine name. You can rename it from the dashboard after registration.

Identity files

During bootstrap, the host creates a private key and a public key. Only the public key is registered with SikkerKey. The private key stays on the host and is used to sign future requests.

• Linux and macOS store the identity under ~/.sikkerkey/vaults/{vaultId}/.

• Windows stores it under %USERPROFILE%\.sikkerkey\vaults\{vaultId}\.

• The identity file records the machine ID, machine name, vault, service address, and private-key location.

#Approve or deny the registration

A newly bootstrapped standard machine is pending and cannot access secrets until it is approved.

Approval activates the identity, but it does not grant access to any project or secret. Complete the access setup separately for each project the machine needs.

#Add the machine to a project

The project’s Machines page shows the machine name, ID, registration IP, number of granted secrets, and the date it was added.

#Grant secret access

The grant list can be changed at any time. Clearing a secret and saving removes that access immediately. A machine can list and read only secrets that are both in one of its projects and explicitly granted to it.

Any access policy attached to a granted secret also applies to machine reads. The machine must satisfy the policy’s conditions each time it requests the value.

#Review machines in the dashboard

The All Machines table provides a vault-wide view of every machine identity.

Search by machine name. Filter the list by status, project, last-seen period, or registration date. Name, secret count, Last Seen, and Added can be sorted from their column headings.

#Manage a standard machine

Rename

Select the machine name in the table, enter the replacement, and press Enter or move focus away to save it. Names can contain 1–255 characters.

Open History from the row menu to review previous names. You can restore an earlier name directly from the Names tab.

Disable and enable

Disable blocks the machine’s authenticated requests while preserving its identity, project memberships, and secret grants. Use it when access should stop temporarily without rebuilding the configuration.

Select Enable from the row menu to resume authenticated access with the same identity and grants.

Revoke

Revoke permanently removes the machine registration, its project memberships, and all of its secret grants. The identity stored on the host can no longer authenticate.

To connect that host again, bootstrap a new standard machine, approve it, and configure its project and secret access.

Bulk revoke

Select multiple rows in All Machines and choose Revoke to remove them together. Review the affected identities before confirming because each selected machine loses all secret access.

#Review machine history and activity

Open a machine’s row menu and select History.

• Names shows every rename with the previous name, new name, and change time.

• Audit shows events for that machine and supports action, severity, time, and text filters.

Machine activity appears in the Audit Log throughout its lifecycle, including:

• bootstrap token creation and machine registration;

• approval, denial, rename, disable, enable, and revocation;

• project additions and removals;

• secret grant changes;

• successful, denied, and policy-blocked secret reads; and

• authentication failures and secret exports.

#Control access to machine management

Vault-roles and Access-roles control different parts of the workflow.

Vault owners receive full machine access. Organization members receive these permissions through their vault role and project access.

#Troubleshoot access