How to Use Twingate Provisioning Keys for Secure, Automated Connector Deployments

Twingate uses Provisioning Keys to create secure, automated deployments of its Connector services. A Provisioning Key is a short‑lived credential that authenticates new Connectors with your Twingate network. It’s the first handshake between your infrastructure and Twingate’s secure mesh. Without it, there’s no trust, no network path, no access.

To generate a Provisioning Key in Twingate, sign in to the Admin Console. Navigate to the Network or Connectors section. Select Add Connector. You will see an option to create a new Provisioning Key. Keys are valid for a limited time — often 90 minutes — so plan to deploy within that window. Once generated, copy the key securely. It cannot be retrieved again. If you lose it, you’ll need to create a new one.

Provisioning a Connector with the key can be done through Docker, a VM, or a native image. Pass the Provisioning Key as an environment variable or configuration flag depending on your deployment method. Once the Connector authenticates using the valid key, it registers with Twingate and immediately starts routing traffic according to your access controls.

Discard the key after use. Never commit it to source control. Never paste it in chat without encryption. Store it briefly, deploy, and delete. Treat it with the same security posture as any credential that could grant network access.

If you are automating server deployments or refreshing infrastructure, integrate the Provisioning Key workflow into your CI/CD pipeline. Create keys on demand via the Twingate Admin Console or API, inject them into the build process, and remove them after provisioning. This eliminates manual steps and reduces the attack window.

A Provisioning Key is a small object but critical in building fast, secure, repeatable Twingate deployments at scale. It is ephemeral by design. Handle it cleanly. Deploy quickly. Keep your secure network fabric in motion.

Want to see all of this live without wrestling with setup for hours? Try it now with hoop.dev and go from zero to a working Twingate-connected Connector in minutes.