# Create an enrollment key

An enrollment key lets the Access agent register a computer into one organization. You create keys in the console under **Enrollment**, inside the organization the computers belong to. You need the **Enroll devices** permission there, and your plan must include **Unattended Access**: without it, **Enrollment** does not appear in the console.

:::note
You do not need a key when you [install Access from a support session](/install/access-agent-windows/#install-from-a-support-session): Blink creates a one-time key for that install itself.
:::

## Create a key

1. In the console, switch to the organization the computers belong to and open **Enrollment**.
2. Select **New key**.
3. Fill in the form:
   - **Label**: a name you will recognise later, for example `Acme HQ rollout, Oct`.
   - **Seed group**: computers enrolled with this key join this device group. Choose **No group** to leave them ungrouped.
   - **Max uses**: how many computers may enroll with the key. `0` means unlimited.
   - **Expires in days**: from 1 to 365. The default is 90.
   - **Allow re-enrollment** (shown only if you have the **Remove devices** permission for that group): lets a computer that is already enrolled in this key's group register a new device key with this key.
4. Select **Create key**.

The new key appears at the top of the page, marked **New key · shown once**.

5. Select **Copy key**, or download an installer straight away (see [Install the Access agent on Windows](/install/access-agent-windows/)).
6. Select **Done** when you are finished.

:::caution[The key is shown only once]
Blink keeps only a hash of the key, so it cannot show it again. If you lose it, create a new one. The signed installer for a key can also only be downloaded while the key is on screen.
:::

## Access devices in your plan

Each computer that enrolls takes one Access device in your plan. If you can see the license (the **View license** permission), the top of the **Enrollment** page shows how many are in use, for example `12 of 25 Access devices`.

When every Access device is in use, the page warns: **All Access devices in your plan are in use: new computers cannot enroll until a device is removed or devices are added to your plan. Devices already enrolled keep working.** You can still create keys, because a key is not a device, but enrolling with it is refused until a device is free. To free one, revoke or delete a device you no longer manage (see [Manage Access devices](/use/manage-devices/)), or ask for more devices in your plan. See [Access devices](/configure/plans-and-limits/#access-devices).

## Keep keys under control

A key built into an installer can be recovered from that file. Treat installers like passwords:

- Use one key per rollout.
- Set a small **Max uses** and a short expiry.
- Revoke the key when the rollout is done.

Every key expires. The key table shows each key's **Label**, **Group**, **Uses**, **Expires** and **Status** (**active**, **used up**, **expired** or **revoked**). Tick **Show revoked and expired** to see old keys too.

### Change a key

Select **Edit** on a key that is not revoked to change its **Label**, **Max uses**, or set a **New expiry in days from now** (1 to 365). Leave the expiry empty to keep the current one.

### Revoke a key

Select **Revoke** on the key and confirm with **Revoke key**. Installers carrying it stop enrolling immediately. Computers already enrolled with it are not affected. You need the **Revoke enrollment keys** permission.

## Rules worth knowing

- A computer that is already enrolled cannot enroll again with a new device key unless the key allows re-enrollment, or you delete the device in the console first.
- A computer whose agent was uninstalled can be enrolled again with a key for its device group, or with a key that has no group. It then takes an Access device in your plan again, so this is refused at the device limit.
- A revoked device never comes back through an enrollment key. Only **Un-revoke** on the device brings it back.