wendy device enroll

Enrolls the connected device with Wendy Cloud (or a local pki-core) and provisions it with mTLS certificates.

Note: wendy device enroll is an advanced command and is not listed in wendy device --help. It remains fully functional. For most setups, use wendy device setup instead.

Usage

wendy device enroll [--name <name>] [--cloud-grpc <endpoint>] [flags]

Description

wendy device enroll creates an enrollment token using your stored auth session, then has the connected agent fetch its certificate. Run wendy cloud login first.

› Certificate identity: The CSR submitted during provisioning includes the › device's authoritative Wendy identity as a URI Subject Alternative Name › (urn:wendy:org:‹org›:asset:‹assetID›). The cloud certificate service › validates this SAN against the enrollment token at issuance time.

The enrolled device is registered in Wendy Cloud under a human-readable name. The name can be changed later with wendy device rename, so the command resolves it as follows:

1. --name <name> — always wins when provided.

2. Hostname default — when --name is omitted and the device is reachable by hostname (e.g. playful-reed.local), the name defaults to that hostname with any .local suffix stripped (so playful-reed.local → playful-reed).

3. Interactive prompt — in a terminal, when no --name is given the command prompts for a name. When a hostname default is available it is shown in brackets and used if you press Enter without typing anything:

   Device name [playful-reed]:

4. Bare IP / no hostname — when the device is addressed by a bare IP (no resolvable hostname) and --name is omitted, there is no default. In a non-interactive environment this fails with:

   device name is required; pass --name when not running interactively

   In an interactive terminal it prompts for a name with no default and errors if you leave it blank.

Naming an unnamed device: A device enrolled without a usable name shows up with an empty name in wendy cloud discover. You can still address it by its numeric asset ID — see wendy cloud tunnel --device <id>.

Flags

Examples

Enroll, defaulting the name to the device hostname:

wendy device enroll --device playful-reed.local

Enroll with an explicit name:

wendy device enroll --device 192.168.1.11 --name lab-pi-01

Related

• wendy install → Linux Desktop — mint a short-lived enrollment token and embed it in the agent.sh one-liner so the device self-enrolls on first startup, without needing a USB connection or a running agent.
• wendy device setup — interactive wizard that provisions, configures WiFi, and enrolls in one flow.
• wendy cloud enroll-device — alias for this command, reachable through the cloud tunnel.
• wendy device provision — enroll against a self-hosted pki-core instead of Wendy Cloud.
• wendy device unenroll — reverse enrollment and delete the device from Wendy Cloud.