Account security
Cmdop keeps five credentials in separate planes: your account sign-in, organization API keys, the relay admin password, the fleet join key, and a machine’s connection PIN. Each protects a different thing and rotates on its own. Most people come here during an incident, to work out which one to rotate.
Cmdop deliberately keeps its credentials in separate planes, so a compromise in one does not become a compromise of everything.
Credential map
| Credential | Protects | Rotate with |
|---|---|---|
| Your Cmdop account sign-in | Plan, organization, and organization API keys | Account console |
| Organization API key | Programmatic account access | API keys |
| Relay admin password | The relay’s web console | cmdop server admin-password --reset on the relay host |
| Fleet join key | New machines joining that relay | Server → Security, or cmdop server join-key |
| Machine connection PIN | Attaching to one specific machine remotely | Machines in the web console |
Rotating one does not rotate the others. That is intentional, and it is the thing to remember during an incident: work through the planes the exposure actually touched, and rotate each one deliberately.
Rotating the fleet join key invalidates the old one for machines that have not joined yet; machines already in the fleet stay connected. Clearing it stops any new machine from joining until you generate a new key.
Keep every one of these in approved secret storage, and follow your organization’s incident process if you suspect exposure.
Common questions
Which Cmdop credential should I rotate after a leak?
Rotate the credential plane that was exposed: account sign-in, organization API key, relay admin password, fleet join key, or a machine connection PIN.
Does rotating the fleet join key disconnect existing machines?
No. Rotating the fleet join key blocks use of the old key for future joins. Machines already joined to the fleet stay connected.
Is an organization API key the same as a machine credential?
No. Organization API keys are for programmatic account access. Machine access uses relay and machine-specific credentials plus permission policy.
Cmdop