Configure OrthalonSensors and Keys
Sensors and Keys
Provision, distribute, monitor, rotate, and revoke Orthalon sensor credentials safely.
Plan requirement: Available on all plans. Organization administrators can provision and rotate keys.
Sensor keys authenticate telemetry and policy synchronization across your Orthalon deployment (Browser Extension, Desktop Agent, MCP Security Agent, and AI Gateway). Keys are cryptographically hashed on generation and scoped to a single environment.
1. Sensor Key Types and Scopes
| Key Scope | Target Environment | Usage Context |
|---|---|---|
| Browser Extension | Chrome / Edge / Brave | Injected via Chrome Managed Storage JSON or enterprise MDM |
| Desktop Agent | macOS / Windows / Linux daemon | Stored in desktop-agent.env (ORTHALON_SENSOR_KEY) |
| MCP Agent | Claude Desktop / Cursor MCP proxy | Configured via environment variable (ORTHALON_SENSOR_KEY) |
| AI Gateway | Docker / Backend Microservices | Passed via x-orthalon-sensor-key HTTP header or .env |
2. Provisioning a Sensor Key
- Open Operations → Sensors & Keys in the Orthalon dashboard.
- Click Create Key.
- Select the target environment scope (Browser Extension, Desktop Agent, MCP Agent, or AI Gateway).
- Set an expiration period (30, 90, or 365 days; 90 days recommended).
- Assign a descriptive label (e.g.
Engineering-MacBook-FleetorProduction-Backend-Gateway). - Copy the displayed key (
sk_orthalon_...). The raw key is shown only once and cannot be retrieved later.
3. Key Rotation and Revocation
- Rotation: Generate a new replacement key, deploy it to your endpoints or service configs, and revoke the previous key once traffic migrates.
- Revocation: Under Sensors & Keys, click Revoke on any compromised or decommissioned key. The key is immediately invalidated across all Orthalon ingest nodes.
- Member Deprovisioning: Removing an employee or revoking SCIM access automatically revokes all associated user-level sensor keys.