Setup keys
A setup key lets a machine join without anyone signing in. Create it in the console, use it once or many times, revoke it when done.
Create a key
Settings → Setup Keys → Create. Choose:
| Option | Meaning |
|---|---|
| One-off | valid for a single device; the safest choice for one server |
| Reusable | many devices; set a usage limit and an expiry for fleets and CI |
| Expires in | the key stops working after this; devices already enrolled stay |
| Auto-assigned groups | devices enrolled with this key land in these groups, so policies apply immediately |
| Ephemeral | devices are removed automatically after they have been offline for a while; for containers that come and go |
| Skip device approval | devices enrolled with this key join immediately instead of waiting in Warden; for servers you provision yourself. Off by default |
The key value is shown once. Store it where you keep secrets.
Use it
sudo tzxmesh up --management-url https://mesh.example.com --setup-key <key>In Docker:
docker run -d --name mesh-peer --cap-add NET_ADMIN --device /dev/net/tun \
-e NB_SETUP_KEY=<key> -e NB_MANAGEMENT_URL=https://mesh.example.com \
tzxmesh/client (coming)Approvals still apply
A key proves the machine was enrolled by someone holding the key. With Peer Approval on, the device still waits in Warden until an administrator admits it. That is deliberate: a leaked key enrols nothing you did not look at.
The exception is a key created with Skip device approval. Devices enrolled with it join at once, and the activity log records peer auto-approved by setup key for each one, so the bypass is visible. Treat such a key like a root credential: one-off where you can, short expiry, revoke when the fleet is up. The flag is set at creation and cannot be added to an existing key.
curl -X POST https://mesh.example.com/api/setup-keys \
-H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
-d '{"name":"rack-42","type":"reusable","expires_in":86400,"auto_groups":[],"usage_limit":12,"auto_approve":true}'Revoke
Revoking a key stops new enrolments with it. Devices already enrolled keep working; remove them from Peers if the key leaked.
Join links
A join link turns a setup key into one URL you can send: https://tzxmesh.com/join#<key>. The key sits after the #, which browsers never send to any server — tzxmesh.com does not see it. The page reads it locally and shows the person exactly one action for their device: a button that opens the TZX Mesh phone app with the code filled in, or the one-line installer with the key embedded for a Mac, Linux machine or server.
Create the key with auto-approve on and the device is on the network the moment it enrols — the link itself was your approval. Leave auto-approve off and it waits in Warden like any other device. Copy the join link from the key's creation dialog; keys are shown once.