Passwordless enrollment

The console mints one shared invite link; everyone in the org runs the same command.

Get the invite command

Console → Users → Invite users. The console mints the org's shared enrollment link (enl_…) and renders it as a copy-paste command. Drop the command in Slack or your onboarding doc — the same one works for everyone.

• The raw link is shown once, at mint. Reopening the pane later shows that a link is active and lets you rotate it (revoke it and get a fresh command) or revoke it without replacing it.
• Identity is self-asserted at enrollment: anyray-connect submits the developer's detected identity (git name/email, else OS user), and --user you@company.com overrides it. For IdP-verified identity use SSO enrollment; for managed fleets, MDM bulk enrollment.
• Need a link locked to one person? A roster row's Regenerate action mints an email-bound link — identity fixed at the link, not self-asserted.
• Passwordless mint and redemption stay available until your SSO IdP connection is active; once it is, the backend switches to SSO-only enrollment. Opening the SSO setup portal alone doesn't switch anything — links minted before the connection went live keep working until then.

Enroll

Run the copied command — nothing to install, no Node required:

bash

macOS / Linux

curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --enroll https://app.anyray.ai/enroll/enl_… --yes

powershell

Windows PowerShell

& ([scriptblock]::Create((irm https://app.anyray.ai/connect.ps1))) "--enroll" "https://app.anyray.ai/enroll/enl_…" --yes

Prefer npm? npx anyray-connect@latest --enroll <link> --yes works too. The link itself also opens in a browser to a page showing the same command.

The machine generates an Ed25519 keypair and redeems the link for a signed DevCert bound to the enrollee's identity; the gateway mints a client key (ark_…) pinned to it. anyray-connect writes the tool configs and auto-refreshes the key. Each person who enrolls appears on the Users roster.

Link states

The shared link itself is not a roster row — its status lives in the Invite users pane. Enrollees and email-bound links show on the Users roster:

Status	Meaning
Pending	Not yet enrolled.
Enrolled	Key minted. Permanent — not a liveness signal, and later revocation/expiry doesn't change it.
Revoked	Admin revoked the link before anyone enrolled.
Expired	TTL passed without enrollment.

Revoking a link does not offboard an enrolled machine

The machine holds a 1-year DevCert and silently re-mints its key from it — and while the machine stays in use, that certificate rolls forward before it expires. Waiting it out is not an offboarding plan. To offboard:

1. Revoke the user — Users page or post /admin/revoked-users. Blocks every re-mint; propagates in ~15 min.
2. Revoke the live key — delete /admin/client-keys/:id for an immediate cutoff.

Under the hood

The machine signs a challenge; the gateway verifies it offline against the pinned vendor key (the entitlement-lease key) and mints the client key. Metadata-only (user, optional team); any failure returns one generic message.

Knob	Default	Controls
post /connect/verify	—	Verify-and-mint endpoint. Public; rate-limited by ANYRAY_RATE_LIMIT_UNAUTH_RPM (default 10/min).
post /v1/cert/renew	—	Rolls a live DevCert forward so a machine in use never has to re-enroll. Authenticated by the same signed challenge; refused for a revoked user or a revoked deployment.
ANYRAY_VERIFIED_DEV_KEY_TTL_DAYS	90	Key lifetime, capped at the cert's expiry. Active keys slide-renew up to 2×; anyray-connect re-mints before expiry.
ANYRAY_REFRESH_DISABLE	unset	true turns auto-refresh off.