Skip to main content
The Agents view is where you register the automated callers that consume credentials. Each agent has a kind (local_cli, local_mcp, remote), authenticates with an Ed25519 keypair session, and has an active/revoked state.

​
Listing agents

The agents table shows:
  • Name (links to the agent detail page)
  • Kind (CLI, MCP, Remote)
  • Status (Active or Revoked)
  • Last used (most recent successful authentication)
  • Created timestamp
Search by name, and filter by kind or status.

​
Registering an agent

Click Register agent to open the panel.
1

Name and describe

Provide a name (kebab-case recommended) and an optional description, stored in the agent’s metadata.
2

Pick an agent type

Local CLI, Local MCP, or Remote. This sets the agent’s kind and locality.
3

Choose how it enrolls its keypair

Agents authenticate only with an Ed25519 keypair. Leave Issue bootstrap token checked to mint a one-time abe_… enrollment token (10-minute TTL); the agent runtime redeems it, generates a keypair locally, and uploads the public key. Uncheck it to register the agent now and enroll its public key later via the SDK.
4

Save the token

If a bootstrap token was issued, the success panel shows it once, with a warning and the expiry. There is no way to retrieve it later.
Bootstrap tokens are shown exactly once. If you lose the value before enrolling, revoke the agent and register a new one.

​
Viewing an agent

The agent detail page shows:
  • Status, kind, locality, and auth method
  • Metadata cards: Agent ID, kind, last used, registered date, permission count
  • Granted permissions — every grant for this agent (item or profile target, capability, expiry), each revocable
  • Recent access events — audit entries scoped to this agent

​
Replacing an agent keypair

Agents have no rotatable long-lived secret. To replace a keypair, register a new agent (or issue a fresh bootstrap token through the API) and re-enroll. The dashboard registration panel handles new agents; there is no in-dashboard re-enroll button on the detail page.

​
Revoking an agent

On the agent detail page, Revoke agent disables the agent and cascade-removes its permissions and sessions. This is irreversible. In-flight requests are denied with result: cascade audit entries.