Skip to main content
Deploy keys let an Ultra device authenticate with Ultra Hub without the person signing in through a browser. A key works the same way wherever the device is: a teammate’s laptop, an MDM fleet deployment, a CI/CD pipeline, or a server. They are the fastest way to bring a team onto Ultra. A deploy key removes the sign-in step for any teammate, whatever role they hold, so it pairs equally well with beacons, invited members, and users provisioned from your directory. See Rolling Out to Your Team.

​
How Deploy Keys Work

A deploy key is a long-lived API token (prefixed with dk_) scoped to a specific workspace. When a device uses a deploy key, it:
  1. Authenticates with Ultra Hub using the key instead of a browser login
  2. Automatically links to the workspace the key is scoped to — this happens during ultra install --all (for MDM deployments) or at ultra start time
  3. Begins syncing policies, reporting telemetry, and enforcing guardrails
Deploy keys are created by Owners or Admins in the Ultra Hub dashboard and can be distributed via MDM configuration profiles, environment variables, or other secure configuration management tools.

​
Creating a Deploy Key

Navigate to Settings > Security in the Ultra Hub dashboard. In the Deploy Keys section:
  1. Enter a key name (e.g., “CI/CD pipeline”, “Engineering fleet”)
  2. Select the workspace the key should be scoped to
  3. Choose an expiry option (or select “No expiry” for permanent keys)
  4. Click Create Deploy Key
The key is displayed once after creation. Copy it immediately — it cannot be retrieved later. The key starts with dk_ and looks like:

​
Using a Deploy Key

​
Environment Variable

Set the ULTRA_DEPLOY_KEY environment variable before starting Ultra:

​
Config File

Add the key to your Ultra config file (~/.config/ultra/config.yaml):
The environment variable takes priority over the config file value.

​
Managed Preferences (MDM)

For fleet deployments, set the DeployKey managed preference via your MDM solution: See the MDM Deployment Guide for the full setup.

​
Pre-attaching connectors

A deploy key can carry a set of connectors, so devices show up ready to work instead of each person adding connectors by hand. In the deploy keys table, the Connectors column shows + Attach Connectors, or a count once some are attached. Either one opens the picker, where you choose the connectors the key should set up and fill in any values they need. Every device that enrolls with the key then arrives with those connectors already configured.

​
Managing Deploy Keys

The deploy keys table in Settings > Security shows all keys with their name, workspace, creation date, last used date, and expiry. Click Revoke to immediately invalidate a key.
Revoking a deploy key disconnects all devices that rely on it for authentication. Those devices will need to re-authenticate using a new key or browser login.

​
Identity Resolution

A deploy key authenticates the device, not the person using it. Pair it with the device owner’s work email and SCIM directory sync to put a name on the activity:
  1. Supply the device owner’s email. The macOS and Windows installers ask for it as Work email, the terminal installer reads ULTRA_DEVICE_EMAIL, and MDM sets UserEmail in managed preferences
  2. Ultra matches that email against the users provisioned from your directory
  3. The device is attributed to that person for audit, policy, and RBAC
See Identity Resolution in the MDM Deployment Guide for details.

​
Security Considerations

  • Treat deploy keys like passwords — store them in secure configuration management, not in source code
  • Scope keys narrowly — create separate keys per workspace or deployment group, rather than one key for everything. A single key is meant to be shared across the people reporting into that workspace, so you do not need one key per person
  • Set expiry dates — for time-limited deployments, use expiring keys to limit exposure
  • Revoke unused keys — regularly audit and revoke keys that are no longer needed
  • Rotate keys — periodically create new keys and phase out old ones

​
Permissions

Deploy key management requires the org:update permission. Only Owners and Admins can create, view, or revoke deploy keys. See RBAC for the full permissions matrix.