1. Home
  2. Guides
  3. Next-Gen WAF
  4. Setup and configuration
  5. Agent management

Managing agent keys

For each site (also known as workspace), the Next-Gen WAF agent has a set of keys or credentials that authorize it for the site (workspace).

  • The Agent Access Key (accesskeyid) identifies the site (workspace) that the agent is configured for.
  • The Agent Secret Key (secretaccesskey) authenticates and authorizes the agent.

You'll need these keys to start and update the agent.

Viewing agent keys

To view the agent keys for a site (workspace), complete the following steps:

  1. Next-Gen WAF control panel
  2. Fastly control panel
  1. Log in to the Next-Gen WAF control panel.
  2. From the Sites menu, select a site if you have more than one site.
  3. Click Agents in the site navigation bar.
  4. Click View agent keys.
  5. (Optional) Click Copy to copy the Agent Access Key (accesskeyid) and Agent Secret Key (secretaccesskey).

Rotating the agent keys

To rotate the agent keys for a site (workspace), use HashiCorp Vault or make the following Next-Gen WAF API calls in a terminal application:

IMPORTANT: For each API endpoint step, you'll need to replace ${SIGSCI_EMAIL} and ${SIGSCI_TOKEN} with your email and Next-Gen WAF API token and ${corpName} and ${siteName} with those of your corp (account) and site (workspace). You can find these values in the address of the Next-Gen WAF control panel, such as https://dashboard.signalsciences.net/corps/${corpName}/sites/${siteName}.

  1. Call the create agent keys API endpoint.

    $ curl -X POST "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/agentKeys?pretty=true" \
    -H "x-api-user:${SIGSCI_EMAIL}" \
    -H "x-api-token:${SIGSCI_TOKEN}" \
    -H "Content-Type: application/json"

  2. Call the list agent keys API endpoint and make a note of the accessKey value for the set that you're retiring and for the set that you just created.

    $ curl -X GET "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/agentKeys?pretty=true" \
    -H "x-api-user:${SIGSCI_EMAIL}" \
    -H "x-api-token:${SIGSCI_TOKEN}" \
    -H "Content-Type: application/json"

  3. Call the make agent keys primary API endpoint in a terminal application. Be sure to replace ${newAccessKey} with the accessKey value from your new agent key set.

    $ curl -X POST "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/agentKeys/${newAccessKey}/makePrimary" \
    -H "x-api-user:${SIGSCI_EMAIL}" \
    -H "x-api-token:${SIGSCI_TOKEN}" \
    -H "Content-Type: application/json"

  4. Replace the old agent keys with the new agent keys in your agent configuration file.

  5. Call the delete agent keys API endpoint in a terminal application to delete the old set of agent keys. Be sure to replace ${oldAccessKey} with the accessKey value from the agent key set that you're retiring.

    $ curl -X DELETE "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/agentKeys/${oldAccessKey}" \
    -H "x-api-user:${SIGSCI_EMAIL}" \
    -H "x-api-token:${SIGSCI_TOKEN}" \
    -H "Content-Type: application/json"

Related content

Fastly
© Fastly 2026