Tunnel credentials
Replace a connector credential or stop its connections.
Activation commands
An activation command contains a single-use code that expires after ten minutes. Generating a command leaves the running connector unchanged. Running it replaces the permanent token.
Keep unused commands private. Generate a new command if a code expires or is exposed. The permanent token is delivered to your server during activation.
Token replacement and replicas
Replacing a token disconnects replicas using the old token, usually within ten seconds. Active requests and WebSockets can be interrupted. Give every replica the new token before expecting it to reconnect.
For multiple replicas, use the token API and store the shared token in a private file or systemd credential. A connector supports up to four replicas per edge. Every replica must provide equivalent local services.
Installed services store credentials under /etc/loclix-connector/ACCOUNT-ID.TUNNEL-ID/ with mode 0600. Keep those files out of source control and support messages.
Revocation
Open the connector's setup and select Pause connector to stop its connections. Its published routes remain configured and return an error until the connector is enabled again.
Before removing a connector, remove the website routes and virtual origins that reference it. Removing a path route allows that path to use the website's remaining origin routing.
Connection expiry
Tunnels need continued access to your dashboard host to refresh their authorization. If authorization cannot be refreshed for 60 seconds, active requests and WebSocket connections close. See Tunnel troubleshooting if connections repeatedly drop.