Trusted key

Every box must trust this Keystone public key. It is safe to share — it only lets a box verify licenses, never issue them.

How a box comes online

1. The box reports its device id (sel_…) — from its Settings.
2. Register it here under a customer & site (Fleet → the site → Register device).
3. Give the box this Keystone URL and the device's enroll code. It generates its own Ed25519 key, enrolls the public half, and the code is burned.
4. From then on it signs every request — no shared secret to leak. It pulls its licenses and heartbeats on a timer, outbound only.
5. Issue a license and it takes effect on the next sync; revoke one and the next heartbeat carries the revocation.

Recent activity