Sandbox Access-Token Seed

AgentENV derives both trafficAccessToken and envdAccessToken from the sandbox identity and a random access-token seed. This seed is independent of the AgentENV API key.

In a clustered deployment, configure the same seed on every runtime node that may create, host, resume, or recover a sandbox. The gateway does not derive sandbox access tokens and does not need this seed.

Use the Seed Generated by Default

By default, no manual configuration is required. When a seed is not configured, AgentENV generates one on first startup and persists it at $AENV_HOME/secrets/sandbox-access-token-hash-seed. Later startups reuse the same value.

Provide Your Own Seed

To provide your own seed, generate one value:

ACCESS_TOKEN_SEED="$(openssl rand -hex 32)"

Then configure it using one of the following methods.

1. Environment Variable

Set the environment variable before starting AgentENV:

export AENV_SANDBOX_ACCESS_TOKEN_HASH_SEED="$ACCESS_TOKEN_SEED"

2. AgentENV Config File

Set the value in config/default.toml, or in the configuration file selected by AENV_CONFIG_PATH:

[sandbox]
access_token_hash_seed = "<generated-seed>"

3. Kubernetes Secret

Kubernetes deployments store the shared value under the sandbox-access-token-hash-seed key in Secret/agentenv-runtime-secrets.

Preserve the seed across upgrades. Changing it rotates both sandbox token types and requires all runtime nodes to be updated together.