Connect to the platform

The agent calls the SaaS over HTTPS with a tenant API token, not a user password and not the browser JWT.

1. Create a token

In WaveGrid (role owner):

1. Management → API tokens
2. Create token, e.g. prod-agent
3. Copy wgf_… immediately — it is shown only once

One token can serve several agents. Revoking it stops every sync that uses it.

2. Copy Tenant ID and API URL

On the same page («Agent connection») or on an empty Inventory → Agents list:

Field	Example	YAML key
Tenant ID	workspace UUID	tenant_id
API URL	https://dash.wavegrid.tech/api/v1	api_url
Token	wgf_…	tenant_token

api_url is the app origin + /api/v1. Local stack: http://localhost/api/v1 (or http://traefik/api/v1 from an agent container on wgflow-net).

3. Fill the YAML

Minimum:

tenant_id: "11111111-1111-1111-1111-111111111111"
api_url: "https://dash.wavegrid.tech/api/v1"
tenant_token: "wgf_…"

agent:
  name: "agent-01"
  host: "inventory-node"

agent.id is generated on first run and stored in YAML — the platform keys the instance by this id, not by name / host.

Default interval is 300 seconds (5 minutes). Lower values are clamped up.

4. Start and verify

docker compose up -d
# or
wg-flow-agent run

Within a minute Inventory → Agents should show online. No plugins yet is fine: an empty heartbeat is enough.

In the local UI: Configuration → Test now. Expect connected (HTTP 202). unauthorized means a bad token; unreachable means a wrong api_url or network.

Security

• Keep the token only in YAML on the agent host (or a secret store that mounts that file).
• Do not commit config.yaml with a live wgf_….
• The agent UI is unauthenticated — localhost / private network only.