---
updatedAt: 2026-08-19T14:56:23.000Z
agentTools:
  siteIndex: https://docs.jfrog.com/llms.txt
  projectIndex: https://docs.jfrog.com/security/llms.txt
---

# Renewing Registration Tokens

Registration tokens used by JFrog Runtime Security instances have an expiration period. Renew the token before it expires so the controller and sensors continue to operate without interruption.

<Callout icon="❗️" theme="error">
  The registration token is a secret. Rotating the token immediately invalidates the previous one. Update **every** Runtime cluster with the new token, otherwise the controller and sensors lose connectivity to the JFrog Platform.
</Callout>

## Prerequisites

* An identity token with **Admin** privileges. Get Registration Token and Revoke and Create Registration Token require it. [Get registration token status](/security/reference/get_registration-token-status) requires Resource Manager permissions and does not return the token value.
* Your JFrog Platform Deployment (JPD) base URL, for example `https://mycompany.jfrog.io`.

## Registration Token APIs

| API                                                                                              | Request                                                          | Purpose                                                  |
| ------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------- | -------------------------------------------------------- |
| [Get registration token status](/security/reference/get_registration-token-status)               | `GET /runtime/api/v1/registration_token/status`                  | Checks expiry only. Does **not** return the token value. |
| [Get Registration Token](/security/reference/get-registration-token)                             | `POST /runtime/api/v1/registration_token`                        | Returns the current token value in `access_token`.       |
| [Revoke and Create Registration Token](/security/reference/revoke-and-create-registration-token) | `DELETE /runtime/api/v1/registration_token/{registration_token}` | Revokes the current token and issues a replacement.      |

## Step 1: Check When the Token Expires

Use [Get registration token status](/security/reference/get_registration-token-status) to confirm whether the token exists and when it expires:

```bash
curl -H "Authorization: Bearer <identity-token>" \
  "https://mycompany.jfrog.io/runtime/api/v1/registration_token/status"
```

The response reports `token_exists`, `expires_at`, `days_until_expiry`, `warning_threshold`, and `is_expired`. When `warning_threshold` is `true`, the token is approaching expiry and you should renew it.

This API never returns the token value. Use Step 2 to retrieve the token itself.

## Step 2: Retrieve the Current Registration Token

Retrieve the current token with [Get Registration Token](/security/reference/get-registration-token):

```bash
curl -X POST -H "Authorization: Bearer <identity-token>" \
  "https://mycompany.jfrog.io/runtime/api/v1/registration_token"
```

The token value is returned in the `access_token` field.

Alternatively, retrieve it from the UI:

1. Navigate to **Administration** > **Runtime** > **Cluster Management** and select **Install Runtime**.
2. Select the **Provider**.
3. Enter the **Cluster name**.
4. Select **Next**.
5. In the **Deploy the sensor** window, locate the code block.
6. Copy the value of:

   ```ini
   registrationToken=<token>
   ```

## Step 3: Rotate the Token

Pass the current token in the path to [Revoke and Create Registration Token](/security/reference/revoke-and-create-registration-token). The API revokes that token and creates a replacement:

```bash
curl -X DELETE -H "Authorization: Bearer <identity-token>" \
  "https://mycompany.jfrog.io/runtime/api/v1/registration_token/<current-token>"
```

The new token is returned in the `access_token` field. If the response body is empty, call [Get Registration Token](/security/reference/get-registration-token) to read the new value.

## Step 4: Update All Runtime Clusters

Update the `registrationToken` value in every Runtime cluster with the new token. Clusters that still use the revoked token cannot connect.

For sensor installation and reinstallation details, see [Sensor](/docs/sensor).

## Step 5: Verify the Renewal

1. Under **Administration**, go to **Runtime** > **Cluster Management** and confirm that each cluster reconnects and reports a healthy status in the **Cluster Inventory**.
2. Call [Get registration token status](/security/reference/get_registration-token-status) again and confirm that `is_expired` is `false` and `days_until_expiry` reflects the new token.