Passwordless enrollment

The console mints one shared invite link; everyone in the org runs the same command.

Enroll everyone

One command covers the whole org. Post it in Slack.

1

Copy the command

Console, then Users, then Add User, then open Add users with CLI tool. With no SSO set up, it shows the org's shared link (enl_…), already written as a command, and creates the link the first time. Everyone uses the same link, and it shows again each time. Rotate or revoke it from the same place.

2

Say who it is for, if you need to

Anyray reads the person's git email from their user-level git config. A repo's own user.email never wins. To pin it, add --user and --team after --yes in the command below, such as --yes --user ada@example.com --team platform. That makes the command specific, so send it only to that person.

3

They run it

Nothing to install. Node is not needed.

macOS / Linux

macOS / Linux

curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --enroll https://app.anyray.ai/enroll/enl_… --yes

Windows PowerShell

Windows PowerShell

& ([scriptblock]::Create((irm https://app.anyray.ai/connect.ps1))) "--enroll" "https://app.anyray.ai/enroll/enl_…" --yes

The machine makes a keypair, trades the link for a signed certificate, and gets a client key (ark_…) tied to it. anyray-connect then sets up every tool it finds.

The person is enrolled

They appear on the Users roster.

When to set the user yourself

Use --user when detection would be wrong. A shared machine image reports the same OS user for everyone, so every developer on it would enroll as one person. Use --team to place someone on a team. Without an identity provider, this is the only place a team gets set. Once you connect SSO, leave it blank and your IdP's groups set the team.

If the detected identity looks like a machine account (root, ubuntu, unknown), enrollment warns and carries on. anyray-connect doctor says the same on an enrolled machine.

The certificate wins later

After enrollment, usage is filed under the identity on the certificate. It beats any --user passed on a later run, so one person never splits into two users and two billable seats. To change who a machine enrolls as, enroll it again.

Other ways to get the command

npx anyray-connect@latest --enroll <link> --yes works too, and the link opens in a browser on a page showing the same command. A roster row's Regenerate action mints an email-bound link, which fixes the identity instead of letting the machine assert it.

Shared links work until your SSO connection is active. After that, enrollment moves to SSO and earlier links stop working. An admin can still issue an email-bound link for one developer as a recovery path.

Link states

The shared link is not a roster row. Its status lives under Add User → Add users with CLI tool. Enrollees and email-bound links show on the Users roster.

Status	Meaning
Pending	Not yet enrolled.
Enrolled	Key minted. Permanent, and not a liveness signal.
Revoked	Admin revoked the link before anyone enrolled.
Expired	TTL passed without enrollment.

Offboard

Revoking a link does not offboard an enrolled machine

The machine holds a 1-year DevCert and renews its key from it. While the machine stays in use, that certificate rolls forward before it expires.

1

Revoke the user

Use the Users page or post /admin/revoked-users. Within ~15 min their enrollment keys stop working, and the machine can no longer renew or enroll again.

2

Revoke the live key

Use delete /admin/client-keys/:id to cut it off, and for any key you minted by hand. Every gateway replica refuses it within a second, or within 30 s while the gateway cannot reach its database.

Under the hood

The machine signs a challenge. The gateway checks it offline against the pinned vendor key, then mints the client key. Any failure returns one generic message.

Knob	Default	Controls
post /connect/verify	n/a	Verify-and-mint endpoint. Public, rate-limited by ANYRAY_RATE_LIMIT_UNAUTH_RPM (default 10/min).
post /connect/key/heartbeat	n/a	Extends the same key using the current key, the DevCert, and a fresh device proof. Never returns a replacement key.
post /v1/cert/renew	n/a	Rolls a live DevCert forward. Refused for a revoked user or deployment.
ANYRAY_VERIFIED_DEV_KEY_TTL_DAYS	90	Key renewal window, capped at the cert's expiry. Active keys slide-renew up to 2×.
ANYRAY_REFRESH_DISABLE	unset	true turns auto-refresh off.