Enrolling a device

Enroll a colleague's computer with an emailed invite, or enroll the computer you are sitting at with Connect desktop app. Either way, the machine ends up with a device record in Harriet and its own credentials.

Send an enrollment invite

The invite is the standard path for enrolling someone else's machine. From Devices (or People), select Send invite. Harriet creates an enrollment token and sends one branded email that walks the recipient through the whole setup.

Select Send invite. Choose an existing person, or enter an email address. If no Harriet account exists for that address yet, Harriet creates one using the same defaults as a Manage users invite, so the recipient may receive both the standard Harriet invite and the enrollment email. Domain allowlists on your account are enforced for new addresses.
The recipient opens the secret enrollment link. The link lands on the enrollment page (/provisioner/enroll-invite/) without requiring a Harriet sign-in first. The page shows the one-time token and, where your organization publishes builds, the download for Harriet Desktop. An Advanced section holds the terminal one-liners for Mac (curl … | bash) and Windows PowerShell.
They connect on that computer. The recommended choice is Harriet Desktop, signed in with their Harriet account. Claude Desktop users install the background agent instead.
They link the device. After the agent runs, the device link page asks for the 9-character code shown on the machine. See Linking with a code.

Enrollment tokens are single-use and expire after 24 hours. If an invite goes stale, send a new one; re-enrolling is safe when someone needs a fresh install.

Connect desktop app on this computer

To enroll the machine you are using right now, select Connect desktop app on the Devices screen. Harriet generates an install package with a one-time enrollment token and shows platform one-liners: curl … | bash for Mac and irm … | iex for Windows.

⚠️

The connect command contains a one-time secret. Run it only on the computer you want to enroll, and do not email or chat it to anyone. To set up another person's computer, use Send invite instead.

On macOS the default flow installs the agent and a LaunchAgent that syncs in the background; on Windows it registers the HarrietProvisionerAgent scheduled task on a 5-minute interval. After the first run, the installer asks you to link the device. A device's detail page also offers Reconnect on this computer, which reopens the same install flow for that machine.

What enrollment creates

Enrollment exchanges the one-time token for a permanent device record in Harriet:

A device record, identified by a UUID generated on the machine's first run. It appears in the Devices list with its hostname, OS, and status.
Device credentials. The device receives its own API key, which it uses to authenticate every sync. Harriet stores device keys as SHA-256 hashes; raw keys are never stored.
A stable machine identity. The agent writes a machine ID on first enroll. If the same machine enrolls again with a new token, Harriet reuses the existing device record and rotates its key instead of creating a duplicate entry.

Once enrolled, the device starts polling for its configuration; what happens next is covered in How sync works. To take a machine out of service later, see Removing and wiping devices.