---
title: Enrollment tokens
description: Create, copy, and revoke the token that lets laptops join your organization without a sign-in.
---

_[console.superalign.ai/downloads](https://console.superalign.ai/downloads)_

An **enrollment token** is a long secret code, starting with `sae_`, that lets a laptop join your organization on its own. You create it once, give it to your MDM, and every new laptop uses it. Each laptop then gets its own permanent credential, so revoking the token later does not affect laptops that already joined.

## Before you begin

- You have the **Owner** or **Admin** role. The tokens section is hidden from other roles.
- You know which MDM will carry the token, so you can pick a sensible name and expiry.

## Create a token

1. **Click New token**

    Give it a name, for example "Jamf fleet".

2. **Choose an expiry**

    Never, 7 days, 30 days, 90 days, or 1 year.

3. **Copy it**

    Click **Copy full token**. The token stays copyable from this page while it is active.

Then follow [MDM deployment](/surface/deploy/mdm/overview) to hand it to your MDM.

## Check it is being used

**Last used** on the token card shows when a laptop last enrolled with it. If it says "Never used" after your rollout, the token did not reach the laptops. See [Troubleshooting](/surface/scanner/troubleshooting).

## Revoke a token

Click the trash icon and confirm. New laptops can no longer enroll with it. Laptops that already joined are unaffected. Create a new token first if the rollout is still running, and update your MDM before revoking the old one.

Token creation and revocation are written to the [audit log](/surface/admin/audit-log).

## What happens next

Paste the token into your MDM and deploy the package. Laptops appear on **Endpoints** within one scan interval, and **Last used** on the token card updates the first time one enrolls.

## Next steps

- [MDM deployment](/surface/deploy/mdm/overview) for the per-platform keys
- [Troubleshooting](/surface/scanner/troubleshooting) if laptops do not appear