Hawcx · Customer Admin Agent
Stage
Bootstrap

Customer Admin Agent

Checking activation status…

✓
Already active

This Customer Admin Agent is bootstrapped

This CAA has completed Tier-1 enrollment and is serving its tenant. Bootstrap is at-most-once per CAA — there is nothing more to do on this page.

Tenant
org_id
Bootstrap

Activate the Customer Admin Agent

Paste the bootstrap token from your Hawcx invitation. It carries your organization identifier and a one-time registration credential. The CAA learns its tenant from the token, performs an X3DH handshake with the Auth Service, and derives K_admin_session locally. This page only needs to be visited once per organization.

Paste the token exactly as issued — it is case-sensitive and must not be altered. Leading/trailing whitespace is ignored.
Advanced — Auth Service URL
The Hawcx Auth Service this CAA performs its X3DH handshake against (not the admin console). Leave blank to use the CAA's configured default (HAAP_ADMIN_AUTH_AS_URL) — override only if you were directed to point at a specific AS endpoint.
✓
Bootstrap complete

The Customer Admin Agent is active

The X3DH handshake with the Auth Service succeeded. K_admin_session is derived and pinned in local Postgres. The Authenticator can now sign org_tokens for agent enrollments. The OTRC has been consumed and cannot be reused.

Recovery credential
Save this exactly once
This is the only time you'll see this value. Store it as HAAP_ADMIN_AUTH_RECOVERY_CREDENTIAL in the Authenticator's Secret Manager entry. Without it, restarting the CAA forces a fresh OTRC bootstrap and disconnects all enrolled agents. Hawcx does not log this value and cannot recover it. After saving, close this tab — the page intentionally does not retain the credential.
Channel state
Next steps
  1. Persist the recovery credential in your secret manager. On Kubernetes, update the hx-stage-client-haap-caa secret's HAAP_ADMIN_AUTH_RECOVERY_CREDENTIAL key and let ExternalSecrets reconcile.
  2. Stand up a supervisor in your agent runtime. Supervisor connects to the CAA's SupervisorControl gRPC on port 7443 and handles PrepareAgentRegistration to produce per-agent pk_i.
  3. Trigger an agent enrollment. Call AdminControlPlane.ProvisionSessionMaterial on the CAA. The org_token will be minted with the agent's pk_i bound into its Schnorr ZKP per CS v7.1.1.
This CAA is now enrolled. Bootstrap is at-most-once per CAA per spec — there is nothing more to do on this page. Close the tab after you have safely stored the recovery credential.
✗
Bootstrap failed

The handshake did not complete

The Customer Admin Agent rejected the request. The token may be malformed, its OTRC may have expired or been consumed, the token's org_id may not match the tenant the OTRC was minted under, or the Auth Service may be unreachable from this Pod.

What to try
  1. Re-copy the token exactly as issued. The token is case-sensitive base64url. A truncated paste, an added line break, or an autocorrect substitution will fail to decode. Paste the whole string, unaltered.
  2. Confirm the OTRC inside the token hasn't been used. Each OTRC is single-use. If this token was already redeemed, generate a fresh bootstrap token from the Admin Console.
  3. Check the token's org_id matches the OTRC's tenant. The Admin Console must mint the OTRC against the same customer tenant the token's org_id names. A mismatch surfaces as a generic "OTRC not found" from the Auth Service.
  4. Check the CAA Authenticator logs for the precise upstream error. kubectl -n hx-agent-client-admin-service logs -c authenticator will show the AS response status and any Schnorr / X3DH verification failure detail.