Concepts

Credentials

When you install Sentinel, you configure two credentials generated by the panel wizard. Each serves a distinct security purpose.

AGENT_TOKEN starts with sts1.

Proves the identity of the node. Every API request from Sentinel includes this token in the Authorization header. The panel looks up the token in the database to find which tenant and node the request belongs to.

Think of it as a username for the node.

AGENT_SECRET 64-character hex string

Used to sign the commands the panel queues for Sentinel (HMAC-SHA256). When Sentinel polls and picks up a pending command, it verifies the HMAC signature before executing anything. This prevents a stolen token from being used to issue commands.

Think of it as a signing key for panel-to-Sentinel commands.

Where they live

The installer writes both credentials to Sentinel's config file:

C:\Program Files\Spare Time Gaming\Sentinel\.env PANEL_URL=https://panel.spare-time-gaming.us AGENT_TOKEN=sts1.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx AGENT_SECRET=aabbccdd...

Rotating credentials

If your credentials are lost, compromised, or you need to re-enroll a node:

1.In the panel, click Sentinel Setup (top-right) → Rotate credentials

2.Copy the new token and secret

3.Re-run the installer and enter the new credentials, or edit .env manually and restart the service

Rotating generates a completely new pair. The old token and secret stop working immediately. If you have multiple nodes sharing a secret (not recommended), rotate each one separately.

← Architecture Server control →