Enrolment tokens

An agent joins your organisation by exchanging an enrolment token for its own permanent credential. The token is bound to your organisation, expires, and can be used a set number of times. Your organisation is fixed inside it, so an agent cannot join the wrong organisation by mistake.

Create a token

1. As an administrator of your organisation (a company admin), go to Settings → Integrations, and find Agent enrolment tokens. Staff and print operators cannot make tokens.
2. Choose Create token, and set:
   • Label: who or what it is for (“Main campus print room”). It is the only way to tell tokens apart in the list.
   • Agent type: print, encoder, or either. Choose one if you know which is being installed.
   • Valid for (days): long enough for the installation, no longer. The default is 7 and the maximum is 30.
   • Number of machines: how many agents may enrol with it. The default is 1: one token, one printer. Raise it for a site setting up several at once.
3. The token is shown once. Copy it and give it to the installer over a channel you trust, with the same care as a password. CardOffice keeps only a one-way fingerprint of it; if it is lost, revoke it and make another.

What the installer does

At the agent’s enrolment prompt (print agent or encoder agent), the installer enters the CardOffice address and the token. The print agent also asks for your organisation code (shown at the top of Settings → General, and beside every new token); it must match the organisation the token was made in, so a code copied from the wrong place is caught rather than obeyed.

When enrolment succeeds, the token’s use count goes up and the machine gets its own permanent credential. When the uses run out or the token expires, it stops working. Agents already installed are not affected, because they now hold their own credentials.

Managing tokens over time

• The list on Settings → Integrations shows each token’s prefix, label, agent type, uses so far against its limit, and expiry. An expired token is marked and stops working.
• Revoke a token as soon as an installation is done, or if it might have leaked. Revoking never affects agents already enrolled.
• To take a whole machine out of service, deactivate its agent. Its credential stops working at once, and any print jobs it had claimed go back to the queue for other agents.

Rule of thumb

One token per installation, the shortest expiry that fits, revoked when done. A token should be a boarding pass, not a house key.