--- title: How We Built Machine ID | daily.dev description: Teleport explains the architecture behind Machine ID, a feature in Teleport 9 that automates short-lived certificate issuance and renewal for... canonical: https://daily.dev/posts/how-we-built-machine-id-cdk1g65bq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How We Built Machine ID | daily.dev og:description: Teleport explains the architecture behind Machine ID, a feature in Teleport 9 that automates short-lived certificate issuance and renewal for... og:url: https://daily.dev/posts/how-we-built-machine-id-cdk1g65bq og:image: https://api.daily.dev/og/posts/Cdk1G65Bq.png og:image:alt: How We Built Machine ID og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How We Built Machine ID **[Teleport](https://daily.dev/sources/teleport)** · 6 min read · 0 upvotes · 0 comments ## Summary Teleport explains the architecture behind Machine ID, a feature in Teleport 9 that automates short-lived certificate issuance and renewal for machine-to-machine access. The tbot agent authenticates via AWS IAM join or one-time tokens, renews certificates on a schedule, and separates renewable from access certificates to limit blast radius from theft. Security mechanisms include tbot locking, certificate generation counters to detect compromised renewals, and detailed audit logging for bot creation, renewal, and removal events. The feature targets service accounts used in CI/CD, database access, and configuration management tools like Ansible and Puppet. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Teleport Machine ID authenticate the tbot agent with a Teleport cluster? Teleport Machine ID authenticates tbot using either AWS IAM join, which verifies identity via AWS IAM without provisioning security tokens and performs continuous re-authentication, or one-time join tokens, where an administrator manually authenticates tbot once and it then receives a short-lived renewable certificate used to generate secondary access certificates. _Teams automating service-account access can track how tools like Teleport handle bot authentication on daily.dev._ ### How does Teleport prevent a stolen renewable certificate from being used to renew access indefinitely? Teleport's tbot separates renewable certificates from access certificates so a compromised application only ever holds a non-renewable access certificate, restricted via Linux file access control. Additionally, a certificate generation counter increments on every renewal and is stored in Teleport's backend; if a stolen certificate is renewed, the counter mismatches and Teleport locks out the bot. _Engineers hardening machine-to-machine credential flows can follow security design patterns like this on daily.dev._ ### What audit events does Teleport Machine ID log for certificate lifecycle actions? Teleport Machine ID's tbot emits audit events for user and role creation and deletion (via tctl bots add and tctl bots rm), cert.create and user.update on each new or renewed certificate, and lock.created when a bot is locked due to a suspected compromise or generation counter mismatch, since tbot operates under an assigned user and role. _Developers designing audit trails for automated credential renewal can compare implementations like this on daily.dev._ ## Similar posts on daily.dev - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments - [Teleport Launches Agentic Identity Framework to Secure AI Agents Across Enterprise Infrastructure](https://daily.dev/posts/teleport-launches-agentic-identity-framework-to-secure-ai-agents-across-enterprise-infrastructure-vosijavmu) · InfoQ · 0 upvotes · 0 comments --- Tags: [#devops](https://daily.dev/tags/devops) [View this post on daily.dev](https://daily.dev/posts/how-we-built-machine-id-cdk1g65bq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How We Built Machine ID","url":"https://daily.dev/posts/how-we-built-machine-id-cdk1g65bq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-we-built-machine-id-cdk1g65bq"},"datePublished":"2026-08-23T12:22:48.699Z","dateModified":"2026-08-23T12:50:50.459Z","description":"Teleport explains the architecture behind Machine ID, a feature in Teleport 9 that automates short-lived certificate issuance and renewal for...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-we-built-machine-id-cdk1g65bq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devops","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How We Built Machine ID"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-we-built-machine-id-cdk1g65bq#faq","mainEntity":[{"@type":"Question","name":"How does Teleport Machine ID authenticate the tbot agent with a Teleport cluster?","acceptedAnswer":{"@type":"Answer","text":"Teleport Machine ID authenticates tbot using either AWS IAM join, which verifies identity via AWS IAM without provisioning security tokens and performs continuous re-authentication, or one-time join tokens, where an administrator manually authenticates tbot once and it then receives a short-lived renewable certificate used to generate secondary access certificates. Teams automating service-account access can track how tools like Teleport handle bot authentication on daily.dev."}},{"@type":"Question","name":"How does Teleport prevent a stolen renewable certificate from being used to renew access indefinitely?","acceptedAnswer":{"@type":"Answer","text":"Teleport's tbot separates renewable certificates from access certificates so a compromised application only ever holds a non-renewable access certificate, restricted via Linux file access control. Additionally, a certificate generation counter increments on every renewal and is stored in Teleport's backend; if a stolen certificate is renewed, the counter mismatches and Teleport locks out the bot. Engineers hardening machine-to-machine credential flows can follow security design patterns like this on daily.dev."}},{"@type":"Question","name":"What audit events does Teleport Machine ID log for certificate lifecycle actions?","acceptedAnswer":{"@type":"Answer","text":"Teleport Machine ID's tbot emits audit events for user and role creation and deletion (via tctl bots add and tctl bots rm), cert.create and user.update on each new or renewed certificate, and lock.created when a bot is locked due to a suspected compromise or generation counter mismatch, since tbot operates under an assigned user and role. Developers designing audit trails for automated credential renewal can compare implementations like this on daily.dev."}}]} ```