Joining and access issues
When cmdop status reports Auth rejected, the credential this machine saved
when it joined has gone stale or been revoked. Get a current fleet join key and
run cmdop join again. Cmdop keeps four credentials deliberately separate — the
join key, the relay admin password, the per-machine connection PIN, and your
inference key — and none of them substitutes for another.
Join again with a current fleet join key:
cmdop join <join-key>
cmdop start
cmdop statuscmdop join is the only way a machine comes online. cmdop login is retired;
some installed versions still name it in an old hint string. Ignore that hint
and use cmdop join.
Get a current join key from Server → Security in the relay’s
web console, which also prepares the complete
cmdop join command ready to paste. Or, on the relay host:
cmdop server join-keyCredentials are per relay
The credential joining stores is scoped to the relay you joined. If
you switch the active relay with cmdop remotes use and authentication starts
failing, that is the reason — join against the new relay.
Four separate credentials
Cmdop keeps these apart on purpose. Rotating one never silently rotates another, and none of them substitutes for another:
| Credential | What it opens |
|---|---|
| Fleet join key | Lets a machine join the relay. Used once per machine, at join. |
| Relay admin password | Signs you in to the relay’s web console from the LAN or the internet. |
| Connection PIN | A per-machine gate on attaching to that machine. Requested when it is armed. |
| Inference credential | The AI provider key you configure on the relay. Nothing to do with access. |
That is why a remote terminal through a public relay asks for that relay’s admin password and, when armed, the target machine’s connection PIN — and will not accept the caller’s join key instead.
If you lose the relay admin password, reset it on the relay host:
cmdop server admin-password --resetCommon questions
Why does Cmdop say Auth rejected?
The machine’s stored join credential is stale or revoked. Get a current fleet
join key from the relay and run cmdop join <join-key> again, then start the
agent and check cmdop status.
Is the join key the same as the relay admin password?
No. The join key lets a machine join the relay. The relay admin password signs a person into the relay console and remote terminal door. A connection PIN is a third credential that gates one specific machine when it is armed.
Should I use cmdop login to fix access?
No. cmdop login is retired. If a machine cannot authenticate to its relay,
use cmdop join with a current fleet join key.
Cmdop