Enroll a robot

A Roboflare robot belongs to a fleet inside a site. Before a robot can connect, you provision that hierarchy and mint an enrollment key the agent uses to exchange for its long-lived robot token.

1. Create a site

A site is a physical location — a warehouse, a lab, a customer deployment. Every robot belongs to exactly one site.

rf sites create "Warehouse A"

Take note of the returned id — you will need it for the fleet.

2. Create a fleet inside the site

A fleet groups robots that get the same releases and configs. Common patterns: one fleet per robot model, or one fleet per generation.

rf fleets create "pick-and-place v1" --site <site-id>

3. Mint an enrollment key

Enrollment keys are scoped to a single site and fleet. Robots that present the key are automatically attached to that fleet on first connect.

rf keys new \
  --site  <site-id> \
  --fleet <fleet-id> \
  --label "warehouse-a-batch-1"

The response includes the raw key value (rf_enroll_<hex>). This value is shown once and never returned again — only the hash is stored. Copy it into your provisioning script or a sealed secret store now.

Optional flags:

--max-uses <n> (default 100) — caps how many robots can claim the key.
--expires-in-hours <h> (default 24, use 0 for no expiry) — auto-disables the key after this window.

Revoke an active key:

rf keys revoke <key-id>

4. Run the agent on the robot

The Rust agent reads ~/.roboflare/config.toml for its tunnel endpoint and enrollment key. The simplest config:

backend_url    = "wss://api.roboflare.com/agent/ws"
enrollment_key = "rf_enroll_<paste-here>"
robot_name     = "warehouse-bot-01"

Start the agent (systemd unit recommended in production; Restart=always is mandatory so the agent survives crashes):

roboflare-agent

On first connect the agent exchanges the enrollment key for a robot token that it persists alongside the config. Subsequent connects use the token directly; the enrollment key is no longer needed.

5. Verify it's online

rf robots list

The robot's last_seen_at updates server-side from heartbeat receipt every five seconds. If it shows - after a minute, check the agent's logs and confirm backend_url is reachable from the robot.

Your robot is online. Ship it a release in Deploy an update.