Connector

Install and enroll the connector

Generate a one-time enrollment token, start the connector inside the private network, and let it exchange the token for a long-lived connector credential stored locally.

Token contains no permanent secret
Credential fingerprint shown in UI
Revocation blocks reconnect
Health diagnostics stay local