We're introducing expiry timestamps for agent registration tokens in response to customer feedback around security compliance and token lifecycle management.

You can now set an expiry time when creating tokens via both GraphQL (expiresAt) and REST (expires_at) APIs. The timestamp must be in ISO8601 format (2025-01-01T00:00:00Z).

This change enables automated token rotation through API integration, replacing the previous manual rotation process for long-lived tokens.

Important details:

• Existing tokens will continue to work without expiry
• Expired tokens will prevent new agent registrations but won't affect currently connected agents
• The UI will display tokens as "expired" after their expiry date
• Expiry dates cannot be modified after token creation
• There is no maximum expiry duration but a minimum of 10 minutes in the future is required

Below is a GraphQL example showing the creation of a token with an expiry.

1
2
3
4
5
6
7
8
9
10
mutation createToken {
  clusterAgentTokenCreate(input: {
    organizationId: "",
    description: "a token with an expiration",
    clusterId:"",
    expiresAt: "2026-01-01T00:00:00Z"
  }) {
    tokenValue
  }
}