Credentials for Connect
Every Cmdop connect operation asks for exactly one credential, and which one
depends on what you are doing. Bringing a machine online needs a fleet join key.
Opening a terminal on another machine needs that machine’s own relay door access
plus its connection PIN when armed. Running cmdop connect exec needs only the
local operator session on this host.
Use this page when an operation was refused and you need to know which credential it wanted. Each row is a different question, asked by a different owner.
Which credential each operation needs
| What you are doing | What it needs | Who owns that |
|---|---|---|
| Bring this machine online | Fleet join key for the relay | The relay’s fleet owner |
| Point this machine at another relay | A join key for that relay | The relay’s fleet owner |
| List machines | The active relay’s session — nothing extra | You, once joined |
| Open a terminal on another machine | That machine’s relay door access, plus its connection PIN when armed | The relay hosting that machine |
| Ask another machine’s agent for work | Having joined that fleet, plus the target’s connection PIN when armed | The relay hosting that machine |
Run cmdop connect exec | The local operator session on this host | You, on this host |
Reading a refusal
- Refused at join. The join key is wrong, rotated, or meant
for a different relay. Ask the fleet owner for the current one and join
again with
--serverif the relay is not the active one. - The machine is listed but the terminal is refused. Being on the roster means the relay can reach it, not that you can attach to it. Remote attach is authenticated at that machine’s own door — see Authentication and PINs.
- The machine is listed but has no reachable door. A machine on a LAN-only or loopback-only relay is not remotely attachable at all. Reach it through the console, or ask its agent for the work instead.
- A PIN is requested and you do not have it. Connection PINs are armed on the relay that owns the target machine. They are never revealed after being set, so a lost PIN is rotated, not recovered.
Two things this page is not about
Joining a fleet is not authorization to act. It admits a machine to a relay. What the resulting work may do on a host is decided by permissions, which is a separate boundary.
The local password store is not the source of truth. cmdop connect password remembers attach passwords on this machine so you are not prompted
repeatedly. Arming and clearing happen on the target relay; a stale local copy
just fails.
Common questions
Which credential does cmdop connect need?
An interactive attach authenticates at the target machine’s relay door and may also require that machine’s connection PIN when armed.
Is the fleet join key enough to run work?
No. A fleet join key brings a machine online under a relay. It does not grant authorization for every action on that machine.
Why was a listed machine refused?
The roster proves the relay can see the machine. Remote attach can still be refused by the target machine’s door credential, connection PIN, or reachability mode.
Cmdop