> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nerdit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Control access

> Create install keys, review activity, and revoke the right kind of access.

Your Nerdit account owns its linked machines. The App checks ownership before providing remote access, and the Engine applies its own permissions. There is no team invitation or role editor in the current App. See [Engine security](/engine/security) for local token roles and security boundaries.

## Create an install key

Install keys let an already installed Engine join your account without browser approval. For an interactive machine, prefer the [device approval flow](/app/connect-engine).

<Steps>
  <Step title="Choose a limit">
    Open **Security → Install keys** and create a new key. Give it a descriptive name, choose the permitted number of **Machines**, and set **Expires**. A key's use limit does not increase your account's machine limit.
  </Step>

  <Step title="Store the key safely">
    Choose **Create key**. The plaintext is shown once. Store it in your provisioning system's protected secret storage. If delivering it as a file, restrict that file to the Engine's service user.
  </Step>

  <Step title="Provision the machine">
    First follow the Engine's [installation instructions](/engine/installation). After installation, run the released CLI's stdin-based linking command as the service user, using the path to your protected key file:

    ```bash theme={null}
    nerdit link --key-stdin < /path/to/protected-install-key
    ```

    Follow the command's restart instruction, then confirm that the machine appears online in **Machines**. Treat the key as an account-enrollment credential.
  </Step>
</Steps>

<Note>
  Nerdit 0.5.5 supports `nerdit link --key-stdin`. The installer currently served at `get.nerdit.ai` does not support the App's installer `--key-file` snippet. Install first, then use the linking command above; `nerdit link --key-file` is not a supported CLI option.
</Note>

<Warning>
  Do not paste live install keys into documentation, screenshots, command arguments, shell history, or logs. Revoking a key prevents future enrollment; it does not unlink machines already enrolled with that key.
</Warning>

## Review activity

Open **Security → Activity** to review recorded account, machine, connection, and service actions. Dashboard sessions appear separately as current sessions; use **End** to end a specific session.

Activity is an audit trail, not an application's runtime log. Use [Engine diagnostics](/engine/troubleshooting) for application output and build failures.

## Revoke the access you intend

| Action                                        | Effect                                                                          |
| --------------------------------------------- | ------------------------------------------------------------------------------- |
| Revoke an install key                         | Prevents future uses of that key. Existing machines stay linked.                |
| End a dashboard session                       | Ends that dashboard session.                                                    |
| Disconnect Claude                             | Revokes its account connection approval.                                        |
| Security → Revoke access → Revoke all access… | Ends connected-app and dashboard access. Machines stay linked and keep running. |
| Account → Settings → Sign out everywhere      | Ends Nerdit browser sign-in sessions.                                           |
| Unlink a machine                              | Removes that machine from this account's remote access; local workloads remain. |

<Warning>
  **Revoke all access does not revoke install keys.** If a key may be exposed, revoke it separately under Install keys. Review recently linked machines and unlink anything unexpected.
</Warning>

For a suspected compromise, review Activity, revoke affected connections and keys, sign out other browser sessions, and secure the sign-in provider account. Local Engine credentials and application credentials have separate recovery procedures in the [Engine security guide](/engine/security).