Device security
Every enrolled device talks to Harriet with its own credentials, each scoped as narrowly and short-lived as its job allows. This page explains what those credentials are and the controls around them.
Credential types at a glance
| Credential | Lifetime | Purpose |
|---|---|---|
| Enrollment token | Single use, expires after 24 hours | Lets a new device bootstrap itself and exchange the token for a permanent device API key. Included in the install package; treat it like a password. |
| Device API key | Until revoked (wipe, removal, or re-enrollment rotates it) | Authenticates every request the device makes to Harriet. |
| Link code | 15 minutes | Connects a device to a person's Harriet account. A short code in the format ABCD-1234, entered in the browser while signed in. |
| MCP proxy token | 7 days, renewed on use; 72-hour grace window | Authenticates the desktop's MCP tool traffic through Harriet's gateway. Scoped per person, per connector, per device. |
| LLM proxy token | Device-scoped; revoked automatically when the device should no longer use the proxy | Authenticates LLM proxy requests from Harriet Desktop. |
Enrollment and identity
A device joins your organization by presenting a single-use enrollment token, valid for 24 hours. The endpoints a not-yet-enrolled device must reach are the only ones open without credentials, and they are rate-limited for that reason. On success, the device receives its API key.
Harriet stores device API keys as SHA-256 hashes. Only a short prefix is kept in plaintext for lookup; the raw key is never stored, so it cannot be read back out of Harriet by anyone — including Harriet.
Who is using the device is established by an explicit linking step: the device shows a code, the person enters it in their signed-in browser session, and the two are connected. The 15-minute code follows the same standard used for signing in to TVs and consoles (RFC 8628). Harriet never infers identity from the computer's username.
Gateway tokens rotate themselves
The tokens that carry day-to-day tool traffic are deliberately short-lived. An MCP proxy token lasts 7 days and is renewed each time it is used within a 72-hour grace window after expiry, so an active device never notices rotation. A token that goes unused past the grace window is deleted by an hourly cleanup job, and a token an admin has revoked is rejected even if its expiry date has not passed.
The LLM proxy token is checked on every request: the device must be Active, the proxy must still be enabled for it, and the linked person must match. When any of that stops being true, the token is deleted server-side, so stale configurations stop working immediately rather than at the next sync.
Update integrity and isolation
- Signed self-update. The endpoint agent keeps itself current by fetching its own latest version from Harriet. That response is HMAC-signed, and the installed agent verifies the signature before replacing itself — a device will not run an update Harriet did not sign.
- Per-customer isolation. Every record is scoped to one organization, and the gateway independently verifies that the person behind a proxy token belongs to the same organization as the skill being called. On re-enrollment, the agent strips Harriet-managed configuration from any previous organization before applying yours.
- No proxying to private networks. The gateway revalidates each connector's upstream address before every call and only allows public HTTPS hosts, so it cannot be used as a hop into internal services.
- Clean exit. Wiping a device (from the console, or via Harriet Desktop's Sign out (this device)) removes the Harriet-managed configuration and revokes the device API key. See Removing a device.
All of the tool traffic these credentials carry lands in the audit log, so you can see what any device did and when.