One-time secrets, and what to do when you lose one
API tokens, enrolment tokens, ingest tokens and vault secrets are shown once, at creation, and never again. What that means in practice, and the one fix that always works.
You created an API token, or an enrolment code, or pasted a secret into the credential vault, closed the dialog a moment too soon, and now nothing in the console will show it to you again. That is not a bug and there is no support request that recovers it: several categories of secret in Qorionix are deliberately shown to you exactly once, at the moment they are created, and never stored anywhere in a form that can be displayed again.
Which secrets this applies to
| Secret | Where you get it | What to do if you lose it |
|---|---|---|
| API token | Shown once in the creation dialog. See API tokens. | Revoke it and create a new one — a lost token cannot be recovered, only replaced. |
| Enrolment token / install command | Shown once when you generate the sensor install command. See Enrolment tokens. | Generate a new install command; the old one expires on its own regardless. |
| Ingest token | Shown once when you create a log-source credential. See Ingest tokens. | Issue a new token for the source and update the shipper's configuration. |
| A secret entered into the credential vault | You typed it in; the vault seals it and does not display it back. See The credential vault. | If you no longer know the value, rotate the credential on its target and re-enter the new value — the vault cannot recover what it never kept in reversible form. |
The fix is always the same shape
Every row in that table resolves the same way: you cannot get the old value back, so you replace it. Revoke or invalidate the one you lost, issue a new one, and update whatever was going to use the old value. This is a feature, not a limitation to work around — a secret that can be redisplayed on demand is a secret that anyone who can reach that screen later can also read, which defeats the point of it being a secret at all.
What to do next
- Identify which of the four rows above matches what you lost, and follow its specific article for the exact revoke-and-reissue steps.
- If the secret you lost was already in use somewhere — a script, a log shipper, an install — plan the swap so the old one keeps working until the new one is confirmed, rather than revoking first and finding out what breaks.
- Read The credential vault if what you actually need is a place that never requires you to see a secret again after the first entry.