Setup Tokens

A setup token is a one-time credential that lets the CLI register as a Station without an interactive browser login. The dashboard issues the token, the install script redeems it, and the CLI saves the station-scoped API key and starts the daemon. You reach for setup tokens when you need headless installs and provisioning scripts.

Lifecycle

Setup tokens are deliberately short-lived and narrowly scoped, so a leaked token has limited blast radius.

The token is a 64-character opaque string scoped to a single station. Once redeemed, it is marked consumed and rejected on any further use.

Issue a token

You issue a token from the station's detail page in the dashboard, and the dashboard hands you a ready-to-paste install command.

1. In the dashboard, open Stations and either pick an existing station or create a new one with New Station.
2. Click Install command on the station detail page.
3. The dashboard generates a fresh token on the fly and copies the full install command to your clipboard:

curl -fsSL tofupilot.sh/install | sh -s -- --token <SETUP_TOKEN>

The payload includes --url automatically for self-hosted, while the SaaS domain (tofupilot.app) leaves it out.

Redeem on the test machine

You run the install command on the station hardware, and the install script downloads the CLI before invoking the redeem flow.

tofupilot login --token <SETUP_TOKEN>

The CLI sends the token along with a local hardware fingerprint (hostname, OS, platform, MAC, CLI version). The server validates the token, consumes it, mints an API key scoped to the station, and returns credentials the CLI saves at ~/.tofupilot/credentials.json.

What the token grants

The redeemed key is a station API key, not a user key, so its permissions are narrowly scoped. It can:

• Upload Runs for procedures linked to this station.
• Pull Deployments targeted at this station.
• Read its own station record via stations.get_current.
• Create procedure versions for linked procedures.

It cannot manage users, mutate other stations, or read organization-wide data. For the full station permission matrix, see access roles.

Rotation

To rotate, you delete the station's installation from the dashboard and re-run the install command on the test machine. That issues a new token, redeems it, and overwrites local credentials, so the old API key stops working immediately.