1. Home
  2. Guides
  3. Next-Gen WAF
  4. Setup and configuration
  5. Agent management

Managing agent keys

For each workspace (also known as site), the Next-Gen WAF agent has a set of keys or credentials that authorize it for the workspace (site).

  • The Agent Access Key (accesskeyid) identifies the workspace (site) that the agent is configured for.
  • The Agent Secret Key (secretaccesskey) authenticates and authorizes the agent.

You'll need these keys to start and update the agent.

Viewing agent keys

To view the agent keys for a workspace (site), complete the following steps:

  1. Fastly control panel
  2. Next-Gen WAF control panel
  1. Log in to the Fastly control panel.
  2. Go to Security > Next-Gen WAF > Deployment.
  3. From the workspaces bar, click the menu Menu icon to the right of the workspace name and select a workspace.
  4. Click View agent keys.
  5. (Optional) Click Copy to copy the Agent Access Key (accesskeyid) and Agent Secret Key (secretaccesskey).

Rotating the agent keys

To rotate the agent keys for a workspace (site), use HashiCorp Vault or make the following Next-Gen WAF API calls in a terminal application:

IMPORTANT: For each API endpoint step, you'll need to replace ${SIGSCI_EMAIL} and ${SIGSCI_TOKEN} with your email and Next-Gen WAF API token and ${corpName} and ${siteName} with those of your account (corp) and workspace (site). You can find these values in the address of the Next-Gen WAF control panel, such as https://dashboard.signalsciences.net/corps/${corpName}/sites/${siteName}.

  1. Call the create agent keys API endpoint.

    $ curl -X POST "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/agentKeys?pretty=true" \
    -H "x-api-user:${SIGSCI_EMAIL}" \
    -H "x-api-token:${SIGSCI_TOKEN}" \
    -H "Content-Type: application/json"

  2. Call the list agent keys API endpoint and make a note of the accessKey value for the set that you're retiring and for the set that you just created.

    $ curl -X GET "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/agentKeys?pretty=true" \
    -H "x-api-user:${SIGSCI_EMAIL}" \
    -H "x-api-token:${SIGSCI_TOKEN}" \
    -H "Content-Type: application/json"

  3. Call the make agent keys primary API endpoint in a terminal application. Be sure to replace ${newAccessKey} with the accessKey value from your new agent key set.

    $ curl -X POST "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/agentKeys/${newAccessKey}/makePrimary" \
    -H "x-api-user:${SIGSCI_EMAIL}" \
    -H "x-api-token:${SIGSCI_TOKEN}" \
    -H "Content-Type: application/json"

  4. Replace the old agent keys with the new agent keys in your agent configuration file.

  5. Call the delete agent keys API endpoint in a terminal application to delete the old set of agent keys. Be sure to replace ${oldAccessKey} with the accessKey value from the agent key set that you're retiring.

    $ curl -X DELETE "https://dashboard.signalsciences.net/api/v0/corps/${corpName}/sites/${siteName}/agentKeys/${oldAccessKey}" \
    -H "x-api-user:${SIGSCI_EMAIL}" \
    -H "x-api-token:${SIGSCI_TOKEN}" \
    -H "Content-Type: application/json"

Related content

Fastly
© Fastly 2026