Telemetry keys

Every Flowstate Agent authenticates to the cloud proxy at proxy.flowstate.inc using two values: the device user's email and a single org token, issued by your administrator in Settings → AI → Cloud Proxy on your tenant. One token serves the whole fleet.

The org token

The org token is an organisation-scoped credential. The agent authenticates each device as its own user, from the email + token pair, so the proxy can attribute and route the traffic to the right person. The org token itself is never sent to the proxy on the wire, and on a managed Mac it is promoted into the system Keychain rather than left in plaintext config.

The separate Cloud Proxy network-route product is a different surface and is documented on its own pages.

Provision one

1. Go to Settings → AI → Cloud Proxy on your tenant.
2. Click Generate MDM profile. Flowstate resolves your org token, embeds it in a ready-to-install macOS .mobileconfig, and reveals the raw token once for hand configuration.
3. Copy the token if you need it directly. It is shown in full once on creation and is not retrievable afterwards — lose it and you re-provision.
4. Put it in your MDM secret (the UserToken value in the configuration profile), or paste it during a direct install.

The same token embeds in every machine in the fleet. Each device additionally supplies its own user email, so the proxy attributes sessions to people without a separate token per engineer.

Rotate one

In the same UI, re-provision to rotate. The new token is shown once and the previous one is revoked by the same operation. Update your MDM secret, then force a device sync.

There is no enforced rotation cadence. Rotate when:

• Your compliance posture calls for a periodic rotation.
• A device is lost or wiped and you want to invalidate any cached credential.
• A token is leaked (committed to a repo, posted in Slack, screenshotted in a ticket).

How the agent reads the token

On macOS the agent reads its config from managed preferences (domain inc.flowstate.agent), resolving the token in this precedence order (highest wins):

1. Managed preference — the UserToken key pushed by MDM (promoted into the Keychain on first read).
2. Stored credential — written by the menubar app after an interactive sign-in (direct installs).
3. No built-in default — the agent waits for a token rather than starting unconfigured.

For every key the agent reads, see environment variables.

Programmatic management

The same surface is available via the API for organisations that manage tokens from their identity-provisioning pipeline — issue, rotate, revoke, and list. See the API reference.