Passwordless enrollment
The console mints one shared invite link; everyone in the org runs the same command.
Enroll everyone
One command covers the whole org. Post it in Slack.
Console, then Users, then Add user. With no SSO set up, the modal opens on the org's
shared link (enl_…), already written as a command. The raw link is shown once. Reopen the
modal later to rotate or revoke it.
Anyray reads the person's git email from their user-level git config. A repo's own
user.email never wins. Use Set who this is for in the modal to pin a --user and a
--team instead. That makes the command specific, so send it only to that person.
Nothing to install. Node is not needed.
- macOS / Linux
- Windows PowerShell
curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --enroll https://app.anyray.ai/enroll/enl_… --yes
& ([scriptblock]::Create((irm https://app.anyray.ai/connect.ps1))) "--enroll" "https://app.anyray.ai/enroll/enl_…" --yes
The machine makes a keypair, trades the link for a signed certificate, and gets a client key
(ark_…) tied to it. anyray-connect then sets up every tool it finds.
They appear on the Users roster.
When to set the user yourself
Use --user when detection would be wrong. A shared machine image reports the same OS user for
everyone, so every developer on it would enroll as one person. Use --team to place someone on
a team. Without an identity provider, this is the only place a team gets set. Once you connect
SSO, leave it blank and your IdP's groups
set the team.
If the detected identity looks like a machine account (root, ubuntu, unknown), enrollment
warns and carries on. anyray-connect doctor says the same on an enrolled machine.
The certificate wins later
After enrollment, usage is filed under the identity on the certificate. It beats any
--user passed on a later run, so one person never splits into two users and two billable
seats. To change who a machine enrolls as, enroll it again.
Other ways to get the command
npx anyray-connect@latest --enroll <link> --yes works too, and the link opens in a browser on
a page showing the same command. A roster row's Regenerate action mints an email-bound link,
which fixes the identity instead of letting the machine assert it.
Shared links work until your SSO connection is active. After that, enrollment moves to SSO and earlier links stop working. An admin can still issue an email-bound link for one developer as a recovery path.
Link states
The shared link is not a roster row. Its status lives in the Add user modal. Enrollees and email-bound links show on the Users roster.
| Status | Meaning |
|---|---|
| Pending | Not yet enrolled. |
| Enrolled | Key minted. Permanent, and not a liveness signal. |
| Revoked | Admin revoked the link before anyone enrolled. |
| Expired | TTL passed without enrollment. |
Offboard
The machine holds a 1-year DevCert and renews its key from it. While the machine stays in use, that certificate rolls forward before it expires.
/admin/revoked-users. This blocks every heartbeat and re-mint. It propagates in ~15 min./admin/client-keys/:id for an immediate cutoff.Under the hood
The machine signs a challenge. The gateway checks it offline against the pinned vendor key, then mints the client key. Any failure returns one generic message.
| Knob | Default | Controls |
|---|---|---|
post /connect/verify | n/a | Verify-and-mint endpoint. Public, rate-limited by ANYRAY_RATE_LIMIT_UNAUTH_RPM (default 10/min). |
post /connect/key/heartbeat | n/a | Extends the same key using the current key, the DevCert, and a fresh device proof. Never returns a replacement key. |
post /v1/cert/renew | n/a | Rolls a live DevCert forward. Refused for a revoked user or deployment. |
ANYRAY_VERIFIED_DEV_KEY_TTL_DAYS | 90 | Key renewal window, capped at the cert's expiry. Active keys slide-renew up to 2×. |
ANYRAY_REFRESH_DISABLE | unset | true turns auto-refresh off. |