Passwordless enrollment

The console mints one shared invite link; everyone in the org runs the same command.

Get the invite command

Console → Users → Add user. With no SSO configured, the modal opens on the org's shared link (enl_…), shown as a copy-paste command. Post it in Slack. The same one works for everyone.

The raw link appears once, at mint. Reopen the modal later to rotate or revoke it.

Enroll

Run the copied command. Nothing to install, and Node is not required.

macOS / Linux

macOS / Linux

curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --enroll https://app.anyray.ai/enroll/enl_… --yes

Windows PowerShell

Windows PowerShell

& ([scriptblock]::Create((irm https://app.anyray.ai/connect.ps1))) "--enroll" "https://app.anyray.ai/enroll/enl_…" --yes

The machine generates an Ed25519 keypair and redeems the link for a signed DevCert. The gateway mints a client key (ark_…) pinned to it. anyray-connect writes the tool configs and renews the key with a device-proof heartbeat that carries no inference content.

The person is enrolled

They appear on the Users roster.

Set who the enrollee is

Identity is self-asserted. anyray-connect submits the git email from the user-level config, so a repo-local user.email never wins. It falls back to the git name, then the OS user.

Use Set who this is for in the same modal to append --user and --team to the command. That makes the command specific, so send it only to the person or team it names.

When to override the detected identity

Use --user when detection would be wrong. A shared image reports the same OS user for everyone, so every developer on it enrolls as one person. Use --team to place someone on a team. With no identity provider, this is the only place a team gets set. Once you connect SSO, leave it blank and your IdP's groups set the team.

If the detected identity looks like a machine account (root, ubuntu, unknown), enrollment prints a warning and continues. anyray-connect doctor reports the same on an enrolled machine.

The certificate identity wins later

After enrollment, usage is attributed to the identity on the certificate. It beats any --user passed on a later run. That stops one person from splitting into two attributed users, and on a subscription deployment, two billable seats. To change who a machine enrolls as, re-enroll it.

Other ways to get the command

npx anyray-connect@latest --enroll <link> --yes works too. The link also opens in a browser to a page showing the same command. A roster row's Regenerate action mints an email-bound link, with identity fixed at the link instead of self-asserted.

Passwordless mint and redemption stay available until your SSO connection is active. After that, the backend switches to SSO enrollment, and links minted earlier stop working. An admin can still issue an email-bound personal link for one developer as a recovery path.

Link states

The shared link is not a roster row. Its status lives in the Add user modal. Enrollees and email-bound links show on the Users roster.

Status	Meaning
Pending	Not yet enrolled.
Enrolled	Key minted. Permanent, and not a liveness signal.
Revoked	Admin revoked the link before anyone enrolled.
Expired	TTL passed without enrollment.

Offboard

Revoking a link does not offboard an enrolled machine

The machine holds a 1-year DevCert and renews its key from it. While the machine stays in use, that certificate rolls forward before it expires.

1

Revoke the user

Use the Users page or post /admin/revoked-users. This blocks every heartbeat and re-mint. It propagates in ~15 min.

2

Revoke the live key

Use delete /admin/client-keys/:id for an immediate cutoff.

Under the hood

The machine signs a challenge. The gateway verifies it offline against the pinned vendor key and mints the client key. Later heartbeats are domain-separated with purpose: "key-heartbeat". Any failure returns one generic message.

Knob	Default	Controls
post /connect/verify	n/a	Verify-and-mint endpoint. Public, rate-limited by ANYRAY_RATE_LIMIT_UNAUTH_RPM (default 10/min).
post /connect/key/heartbeat	n/a	Extends the same key using the current key, the DevCert, and a fresh device proof. Never returns a replacement key.
post /v1/cert/renew	n/a	Rolls a live DevCert forward. Refused for a revoked user or deployment.
ANYRAY_VERIFIED_DEV_KEY_TTL_DAYS	90	Key renewal window, capped at the cert's expiry. Active keys slide-renew up to 2×.
ANYRAY_REFRESH_DISABLE	unset	true turns auto-refresh off.