Enrollment tokens
Create, scope, and revoke the tokens your MDM uses to enroll workstations without a developer signing in.
An enrollment token lets an installer register a workstation with no browser and no human. Your MDM delivers it as managed configuration or over standard input; the runtime exchanges it for a per-device credential and discards it.
| Where | Settings → Access → Keys → Enterprise installer enrollment |
| Role | Owner or Admin |
| Default lifetime | 12 months |
| Reusable | Yes — one token enrolls many devices |
The token value is shown once, when you create it. Store it in your MDM's secret field, not in a script you commit.
Create one
Pick the platform
Windows, macOS, or Linux RPM. macOS then asks which MDM you use — Jamf Pro, Microsoft Intune, or Iru / Kandji — because the deployment ID differs.
Scope the surfaces
All covers every surface the installer can configure. Choose a single surface when a pilot group should only get, for example, Claude Code.
Set the lifetime
Default is 12 months. Shorten it for a pilot so it expires on its own.
Copy the token
Paste it straight into your MDM configuration profile or deployment script.
Deployment IDs
The token carries a deployment ID that tells AgentKeeper how the device was installed. It is set for you when you pick a platform.
| Platform | MDM | Deployment ID |
|---|---|---|
| Windows | Microsoft Intune | intune-windows |
| macOS | Jamf Pro | jamf-macos |
| macOS | Iru / Kandji | kandji-macos |
| macOS | Microsoft Intune | intune-macos |
| Linux | Any | linux-rpm |
Surface scope
A token can be scoped to any of nine surfaces:
claude_code, cursor, windsurf, copilot, codex, gemini,
antigravity, cowork, mcp_gateway
The unified Windows package configures the seven IDE and CLI surfaces in one pass. Cowork and the MCP Gateway have their own Windows lifecycles and enroll separately.
Token states
| State | Meaning |
|---|---|
| Active | Enrolls new devices |
| Expired | Past its lifetime. Devices already enrolled keep working. |
| Revoked | Manually killed. Devices already enrolled keep working. |
Revoking or expiring a token never disconnects an enrolled workstation — the device holds its own credential by then. To remove a device, use Uninstall and rollback.
Rotate
Create the new token, update the MDM profile, confirm new enrollments carry the new deployment, then revoke the old one. There is no overlap requirement.