> For the complete documentation index, see [llms.txt](https://docs.flopsar.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flopsar.com/7/administrator-guide/agent/agent-tokens.md).

# Agent Tokens

Each monitored application has a 32-byte pre-shared key (PSK). Agents use it to authenticate the handshake and encrypt the session with the server. Without a matching token the agent cannot connect, and the instance does not appear in the Workstation.

Manage tokens in **Administration → Agent Tokens** (permission: **Edit agent tokens**). The server stores them sealed with the master key; see [Cryptography & Key Management](/7/security/cryptography-and-key-management.md).

<figure><img src="https://1957839935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQzShZISPoFZ9zIHUdjNB%2Fuploads%2FZyoivp4h5PcGz1GvRlFB%2FScreenshot%202026-09-21%20at%2012-20-30%20.png?alt=media&amp;token=da8348c3-ae52-4755-b253-221ae67e5b0b" alt=""><figcaption></figcaption></figure>

## Create a token

1. Open **New Token**.
2. Enter the **application name** exactly as agents will pass in `app=` (for example `my-java-app`).
3. Create the token and copy it immediately. The list shows a masked value; you can copy the full hex string from the row actions.

Pass the token to the agent with `key=env:<NAME>`, `key=file:<PATH>`, or (for testing only) `key=hex:<64 hex characters>`. Prefer `env:` or `file:` — command-line arguments are visible in the process list. See [Installation → Agent](/7/administrator-guide/installation/agent.md).

## Rotate or revoke

Generate a new token for the same application name and redeploy it to every agent of that application. **Delete** removes the token on the server; any agent still using it fails the handshake.

One token is stored per application name. Creating a token for a name that already has one replaces the previous key.

## How agents use the token

The agent channel is not TLS. After the PSK authenticates the peer, the session uses X25519, XChaCha20-Poly1305, and BLAKE2b. Details are in [Cryptography & Key Management](/7/security/cryptography-and-key-management.md).