Device Enrollment via Signed QR Tokens
How administrators issue single-use or multi-use Ed25519-signed enrollment tokens and bind employee devices.
Cryptographic QR Enrollment Flow
Self-registration is disabled on Workspace servers. Administrators issue signed JWS enrollment tokens via POST /api/v1/admin/enrollment-tokens, encoded as madar://enroll?server=...&token=...&workspace=...&name=...
When the employee scans the QR code, the client generates a fresh Ed25519 device keypair and submits its public key to POST /api/v1/enroll. Single-use tokens are atomically consumed, and multi-use organization tokens require valid employee credentials before binding the device.