Renewing Registration Tokens

Registration tokens used by JFrog Runtime Security instances have an expiration period. Renew the token before it expires so the controller and sensors continue to operate without interruption.

Prerequisites

• An identity token with Admin privileges. Get Registration Token and Revoke and Create Registration Token require it. Get registration token status requires Resource Manager permissions and does not return the token value.
• Your JFrog Platform Deployment (JPD) base URL, for example https://mycompany.jfrog.io.

Registration Token APIs

Step 1: Check When the Token Expires

Use Get registration token status to confirm whether the token exists and when it expires:

curl -H "Authorization: Bearer <identity-token>" \
  "https://mycompany.jfrog.io/runtime/api/v1/registration_token/status"

The response reports token_exists, expires_at, days_until_expiry, warning_threshold, and is_expired. When warning_threshold is true, the token is approaching expiry and you should renew it.

This API never returns the token value. Use Step 2 to retrieve the token itself.

Step 2: Retrieve the Current Registration Token

Retrieve the current token with Get Registration Token:

curl -X POST -H "Authorization: Bearer <identity-token>" \
  "https://mycompany.jfrog.io/runtime/api/v1/registration_token"

The token value is returned in the access_token field.

Alternatively, retrieve it from the UI:

1. Navigate to Administration > Runtime > Cluster Management and select Install Runtime.

2. Select the Provider.

3. Enter the Cluster name.

4. Select Next.

5. In the Deploy the sensor window, locate the code block.

6. Copy the value of:

   ini

   registrationToken=<token>

Step 3: Rotate the Token

Pass the current token in the path to Revoke and Create Registration Token. The API revokes that token and creates a replacement:

curl -X DELETE -H "Authorization: Bearer <identity-token>" \
  "https://mycompany.jfrog.io/runtime/api/v1/registration_token/<current-token>"

The new token is returned in the access_token field. If the response body is empty, call Get Registration Token to read the new value.

Step 4: Update All Runtime Clusters

Update the registrationToken value in every Runtime cluster with the new token. Clusters that still use the revoked token cannot connect.

For sensor installation and reinstallation details, see Sensor.

Step 5: Verify the Renewal

1. Under Administration, go to Runtime > Cluster Management and confirm that each cluster reconnects and reports a healthy status in the Cluster Inventory.
2. Call Get registration token status again and confirm that is_expired is false and days_until_expiry reflects the new token.