Device approval and enrolment keys: step by step
To onboard a technician's laptop in prialo, an administrator issues a single-use enrolment key with an expiry, the laptop joins with prialo install, and the device waits for manual approval. The day the technician leaves, the administrator removes that device, revokes any key still valid, and the audit log records each step.
How prialo enrolment keys and device approval work together
Every prialo device holds its own WireGuard key pair, and there is no username or password on the data path. An enrolment key only introduces a new device to the coordination server; from then on the device is identified by its own key, and that device is what an administrator removes when access ends.
prialo enrolment keys are single-use or reusable, they expire, and they can be revoked before expiry. Device approval adds a second gate: a laptop that presented a valid key still waits until an administrator approves it. Every administrative event is written to the audit log.
On the hosted service, manual device approval is part of the Teams plan, at 5 EUR per person per month excluding VAT, as listed under prialo plans and prices. On the self-hosted package the same controls run on your own server.
Single-use vs reusable enrolment keys for a technician's laptop
A single-use key enrols one device and is then spent; a reusable key enrols any number of devices until it expires or is revoked. The table compares them for the case in this article.
| Enrolment key type | Typical use | If the key leaks | When to revoke it |
|---|---|---|---|
| Single-use, expiring | One technician's laptop, enrolled once | At most one device can join, and only before expiry | If the laptop never enrolled, or on the technician's last day |
| Reusable, expiring | Several servers deployed in the same session | Any number of devices can join until expiry or revocation | As soon as the deployment is finished |
| Either type with device approval | Teams or self-hosted meshes that want a second check | New devices stay pending until an administrator approves them | Same rules; approval does not replace revocation |
For one technician and one laptop, the rule is a single-use key with a short expiry, long enough to install the client that day. A key that is never used simply stops working, so nothing is left behind to clean up.
Onboarding a technician's laptop with prialo install
The prialo command-line client works today on Linux and macOS; on Windows it is an early build without installer or signature, the Mac and iPhone apps are still in Apple's review queue, and Android is in preparation. On a self-hosted server, the dashboard is reached through an SSH tunnel, because the admin API on port 8080 is never published to the Internet.
- Create the key: issue a single-use enrolment key with a short expiry and note who it is for.
- Hand it over privately: send the key through a channel only the technician reads, never a shared ticket or chat.
- Install as root: the technician runs the command below with the server address and the pinned SPKI fingerprint.
- Check the control channel: prialo status must show 'Control: tls, pinned' and an IP inside 100.64.0.0/10.
- Approve the device: the administrator approves the pending laptop in the dashboard, and the approval is recorded in the audit log.
- Test reachability: prialo peers lists the other nodes and prialo ping <host-or-ip> confirms a path to a specific server.
sudo PRIALO_AUTH_KEY='<enrolment key>' prialo install --server=control.example.com:50051 --relay=control.example.com:4430 --tls-pin=sha256:<fingerprint>The fixed address inside 100.64.0.0/10, the shared address space of RFC 6598, never collides with the technician's 192.168.x.x home network or a customer's 10.x.x.x LAN. Nothing is opened on any router: when the direct path fails, a relay on TCP 4430 forwards packets it cannot decrypt.
Removing a technician's laptop from prialo on their last day
Access in prialo belongs to the device's WireGuard key, so offboarding means removing the device, not changing a password. It is done on the control plane and does not depend on getting the laptop back.
- Remove the device: delete the laptop from the mesh in the dashboard so the other nodes stop accepting it as a peer.
- Revoke open keys: revoke any enrolment key, single-use or reusable, that the technician created or received and that is still valid.
- Review subnet routes: only Linux can be a router, so if the laptop ran Linux and advertised a LAN, withdraw that approved route.
- Clean the laptop if returned: run prialo down and prialo logout before the machine is reassigned.
- Read the audit log: confirm that the removal and each revocation appear as events.
Where prialo keeps enrolment keys, approvals and the audit log
The self-hosted prialo package is three Docker Compose containers (coordination server, relay and PostgreSQL), and the customer keeps the keys and the database on their own server. Sinergia does not host or access that instance; the article on the self-hosted control plane ports covers ports and backups.
NIS2 (Directive (EU) 2022/2555), the GDPR (Regulation (EU) 2016/679) and Spain's Esquema Nacional de Seguridad (Real Decreto 311/2022) are context only: prialo holds no certification under any of them. What it offers is that device names, keys, addresses, policies and audit records stay on the customer's own server, as covered in NIS2 and GDPR for MSPs.
Frequently asked questions
Does a prialo enrolment key give access to the network by itself?
No. A prialo enrolment key only introduces a new device to the coordination server. With device approval enabled, the device stays pending until an administrator approves it, and from then on it is identified by its own WireGuard key pair.
What happens if a technician's enrolment key expires before they use it?
An expired prialo enrolment key can no longer enrol any device. The administrator issues a new single-use key and hands it over through a private channel; the expired key needs no clean-up, although the event remains in the audit log.
Can a technician enrol a Windows laptop in prialo today?
The prialo client for Windows exists as an early build without installer or signature. The command-line client works today on Linux and macOS, the Mac and iPhone apps are in Apple's review queue, and Android is in preparation.
Do you need the laptop back to offboard a technician from prialo?
No. Offboarding a technician from prialo happens on the control plane: the device is removed and its still-valid enrolment keys are revoked. If the laptop is returned, prialo down and prialo logout leave it clean before it is reassigned.
Would you rather run your own server? Guide to the self-hosted prialo package