---
title: "Machine Client Credentials"
description: "How machine clients authenticate with an ID and secret, and how to rotate or regenerate those credentials"
---
## Understanding Credentials

Machine client credentials are only for [machine clients](/manage/clients/understanding-clients#machines): servers and automated systems that connect without a person present. Each machine client is provisioned with a unique identifier (ID), secret, and endpoint. The client uses those three values to establish a secure, encrypted connection to the server.

User devices do not use machine client credentials. A person logs in with their Pangolin user credentials, or with an external identity provider, through the web login flow in the client. That login creates a session tied to their account. The session is not shown in the dashboard and cannot be regenerated. To disconnect a user device, have the user log out in the client.

### ID

Example: `ln8yqs6w85la5zg`

The ID represents the client connection in the system. Every machine client has an ID. 

This value is not a secret and it is okay if made publically available.

### Secret

Example: `tfpwoc580jf1l1glfagix0o97p8kirjogdflqg604n0tr3to`

The secret represents the "password" of the client. This secret must match the secret hashed in the system for the relevant ID. 

<Note>
This is a _secret_! Only share it with trusted people and be sure to store it safely and securely.
</Note>

When the client connects, it uses this secret as a first handshake with the server. The server then passes temporary session credentials back to the site before it can initiate a websocket connection. Once the websocket connection is established, ephemeral keys are used to establish tunnels using WireGuard.

### Endpoint

Example: `https://app.pangolin.net` or `https://pangolin.my-server.com`

The endpoint is how the client knows which server to connect to. This is the fully qualified hostname of the Pangolin server (the URL you use to access the dashboard). For Pangolin cloud, the endpoint is `https://app.pangolin.net`. The client uses this endpoint ot establish a websocket connection and receive control messages from the server.

## Rotating and Regenerating Credentials

<Note>
This is an [Enterprise Edition](/self-host/enterprise-edition)-only feature.
</Note>

Machine client credentials can be regenerated. Regenerating credentials will completely invalidate the previous ID and secret. Use this feature if you have lost the secret and need to reset the credentials, or if you wish to rotate credentials on a regular basis for extra security.

To regenerate credentials, visit Clients > Machines > Your Client > Credentials in the Pangolin admin dashboard.

### Regenerate vs. Regenerate and Disconnect

Regenerate simply recreates the credentials and invalidates the old ones. The client will remain connected until you restart it with the new credentials.

Regenerate and Disconnect recreates the credentials and invalides the old ones. The client will instantly disconnect and will require you to restart it with the new credentials.