Skip to main content
Your Nerdit account owns its linked machines. The App checks ownership before providing remote access, and the Engine applies its own permissions. There is no team invitation or role editor in the current App. See Engine security for local token roles and security boundaries.

​
Create an install key

Install keys let an already installed Engine join your account without browser approval. For an interactive machine, prefer the device approval flow.
1

Choose a limit

Open Security → Install keys and create a new key. Give it a descriptive name, choose the permitted number of Machines, and set Expires. A key’s use limit does not increase your account’s machine limit.
2

Store the key safely

Choose Create key. The plaintext is shown once. Store it in your provisioning system’s protected secret storage. If delivering it as a file, restrict that file to the Engine’s service user.
3

Provision the machine

First follow the Engine’s installation instructions. After installation, run the released CLI’s stdin-based linking command as the service user, using the path to your protected key file:
Follow the command’s restart instruction, then confirm that the machine appears online in Machines. Treat the key as an account-enrollment credential.
Nerdit 0.5.5 supports nerdit link --key-stdin. The installer currently served at get.nerdit.ai does not support the App’s installer --key-file snippet. Install first, then use the linking command above; nerdit link --key-file is not a supported CLI option.
Do not paste live install keys into documentation, screenshots, command arguments, shell history, or logs. Revoking a key prevents future enrollment; it does not unlink machines already enrolled with that key.

​
Review activity

Open Security → Activity to review recorded account, machine, connection, and service actions. Dashboard sessions appear separately as current sessions; use End to end a specific session. Activity is an audit trail, not an application’s runtime log. Use Engine diagnostics for application output and build failures.

​
Revoke the access you intend

Revoke all access does not revoke install keys. If a key may be exposed, revoke it separately under Install keys. Review recently linked machines and unlink anything unexpected.
For a suspected compromise, review Activity, revoke affected connections and keys, sign out other browser sessions, and secure the sign-in provider account. Local Engine credentials and application credentials have separate recovery procedures in the Engine security guide.