Credentials: Bootstrap vs Manual
Every deployment path supports two ways of giving the agent its first credential.
| Mode | What you give the agent | When it fits |
|---|---|---|
| Bootstrap (enrollment token) | A reusable enrollment token. The agent calls POST /api/v1/agents/bootstrap on first start, exchanges the token for a per-container API key, and persists that key for restart-safe auth. |
The default for any cloud deployment. One enrollment token can register many agents (Fargate autoscale, multi-host fleets, ephemeral tasks). |
| Manual (permanent API key) | A long-lived agent API key minted from the Argus dashboard. The agent uses it directly with no bootstrap call. | Single-host deployments where you want the simplest possible setup, or where you cannot tolerate a /bootstrap round trip on every restart. |
The dashboard’s Deploy Agent drawer shows you which mode is being used and warns you (yellow banner) if you pick a mode that does not fit the deployment shape well (for example, Manual mode on a cloud autoscale target).
Which to use
Section titled “Which to use”| Deployment | Recommended mode |
|---|---|
| Cloud (managed) Fargate / EC2 | Bootstrap |
| Cloud (DIY) Terraform / ECS | Bootstrap |
| Local (Compose, docker run, offline) | Either |
Minting the credential
Section titled “Minting the credential”See Pre-flight, step 3 for the exact dashboard steps.
- Bootstrap: enrollment tokens look like
argus_et_..., are reusable, and default to no expiry. Every container that runs with one exchanges it for its own per-container API key. - Manual: API keys look like
argus_ak_...and are shown exactly once at mint time. Treat the key like a password; if it leaks, rotate from the agent’s detail page.