Key renewal
Connect gives each configured tool your gateway URL and one personal ark_… key. A standard key
lives for 90 days, so most seats need no background task.
Connect installs a small scheduler that runs about every 30 minutes in two cases: the organization
issues short-lived keys, or the seat has no tool that triggers renewal on its own (shell-env is the
only such integration). Each tick proves the machine's identity and extends the same key in place.
The request carries credentials only, never prompts or responses, and Connect never sits between the
tool and the gateway.
Connect retires a scheduler it no longer needs on the next background tick, with no action from you. A seat still depending on one keeps it.
Check it
anyray-connect status
anyray-connect doctor
doctor reports the scheduler under refreshScheduler. An enabled scheduler is healthy when its
platform artifact is installed, or when the signed Connect tray owns the schedule.
Turn it off
anyray-connect --no-key-refresh
This removes the scheduler. Routing, optimization, metering, and spend attribution are unchanged, and
the tools keep their current key until it expires. Run anyray-connect again when a new key is
needed. anyray-connect --revert removes routing and enrollment too, including the scheduler.
Where the scheduler lives
| Platform | Scheduler |
|---|---|
| macOS | ~/Library/LaunchAgents/ai.anyray.connect.refresh.plist |
| Linux | ~/.config/systemd/user/anyray-refresh.timer and anyray-refresh.service |
| Windows | Task Scheduler task \\AnyrayConnectKeyRefresh |
The task runs the same Connect binary as the CLI, as anyray-connect __anyray-refresh. MCP clients,
the Anyray VS Code extension, and remote development sessions can trigger the same tick. Renewal is
throttled and serialized, so overlapping triggers do not duplicate work.
On macOS and Linux, a successfully enrolled endpoint agent drives renewal centrally, so Connect installs no per-user scheduler. If endpoint enrollment is not confirmed, Connect keeps the local scheduler rather than leave the key without a renewal owner. Windows always uses Task Scheduler.
Endpoint security
The scheduler runs as the signed-in user, without privilege, and makes outbound HTTPS requests to
your gateway. The same tick keeps the binary current, so it also reaches github.com and the
release-assets.githubusercontent.com host its downloads redirect to. Every asset is SHA-256
verified against the release's published SHA256SUMS before activation.
The scheduler does not bind a port, install a certificate authority, change DNS, or change the machine's network settings.
Run anyray-connect doctor --security-review for the exact paths, service names, release URLs, and
update-written files on the current platform. Add --json for the same facts as a manifest, so a
security team can push one exclusion to every machine instead of approving seat by seat. For managed
fleets, deliver Anyray through your MDM.
If endpoint security removes the scheduler
anyray-connect doctor. A seat that no longer needs a scheduler reports Retired and needs no repair.anyray-connect --no-key-refresh and stop here.anyray-connect doctor --security-review to the endpoint-security owner, then run anyray-connect --yes.Approving a detection by file or hash does not carry across updates, because Connect's binary changes
with each release. Where a security product supports it, approve the scheduler by path and service
name from doctor --security-review instead.