# Enrollment code

An enrollment code is a single-use token that enrolls one machine as a [host](/docs/glossary/host/) you've already created in Managed Nebula. You run it on the machine with [DNClient](/docs/glossary/dnclient/), for example `sudo dnclient enroll -code XXXX`, enter it in [DNClient Desktop](/docs/glossary/dnclient-desktop/), or use it in [Mobile Nebula](/docs/glossary/mobile-nebula/) through a QR code or enrollment link.

When a machine enrolls, DNClient generates the host's key pair on the machine and sends Defined Networking only the public key. Defined Networking signs a [Nebula certificate](/docs/glossary/nebula-certificate/) for the host and returns it with the host's configuration. The private key never leaves the machine.

- **Single use**: a code is used up as soon as a machine tries to enroll with it, even if that enrollment fails.
- **Expires after 24 hours**: codes from the admin panel always last 24 hours. Through the API you can set a lifetime from 60 seconds to 7 days.
- **A new code each time**: each time you open a host's setup screen you get a new code. Earlier codes keep working until they're used or expire.
- **Not for every host**: a blocked host must be unblocked first, and hosts enrolled by an [endpoint user](/docs/glossary/endpoint-user/) through SSO can't use codes at all.

In the [admin panel](/docs/glossary/admin-panel/), you get a code when you click **Add host** on the [Hosts](https://admin.defined.net/hosts) page and save. To get a new code for an existing host, for example to move it to a rebuilt machine, choose **Enroll** from the host's **More** menu. Creating a code and enrolling with it are both recorded in the [audit log](/docs/glossary/audit-log/).

An enrollment code enrolls one machine as one host you named ahead of time. To let any number of machines enroll with the same token, each as a new host, use a [join key](/docs/glossary/join-key/) instead. See [Managing hosts and enrollment codes](/docs/guides/managing-hosts/#how-enrollment-codes-work) for the full lifecycle, and [Automating host creation](/docs/guides/automating-host-creation/) for creating hosts and codes with an [API key](/docs/glossary/api-key/).