Agent Tokens

Each monitored application has a 32-byte pre-shared key (PSK). Agents use it to authenticate the handshake and encrypt the session with the server. Without a matching token the agent cannot connect, and the instance does not appear in the Workstation.

Manage tokens in Administration → Agent Tokens (permission: Edit agent tokens). The server stores them sealed with the master key; see Cryptography & Key Management.

Screenshot placeholder: Workstation → Administration → Agent Tokens. Token list with application names and a masked token column; New Token in the header.

Create a token

1. Open New Token.

2. Enter the application name exactly as agents will pass in app= (for example my-java-app).

3. Create the token and copy it immediately. The list shows a masked value; you can copy the full hex string from the row actions.

Pass the token to the agent with key=env:<NAME>, key=file:<PATH>, or (for testing only) key=hex:<64 hex characters>. Prefer env: or file: — command-line arguments are visible in the process list. See Installation → Agent.

Rotate or revoke

Generate a new token for the same application name and redeploy it to every agent of that application. Delete removes the token on the server; any agent still using it fails the handshake.

One token is stored per application name. Creating a token for a name that already has one replaces the previous key.

How agents use the token

The agent channel is not TLS. After the PSK authenticates the peer, the session uses X25519, XChaCha20-Poly1305, and BLAKE2b. Details are in Cryptography & Key Management.