{#if selectedTab === 'create'} Agent workers can be used to run jobs with remote workers with unreliable connectivity, workers behind firewalls (HTTP-only), untrusted environments (no database access), or large deployments (thousands of workers). They have more latency than normal workers. Follow the steps below to create an agent worker.

{#if !$enterpriseLicense}

Agent workers are only available in the enterprise edition. For evaluation purposes, you can only use the `agent_test` tag and it is limited to 100 jobs.

{/if}

{#if !token}

{#if selectedTags.length === 0}

Please select at least one tag to generate a token.

{:else if !$superadmin}

Only superadmins can generate JWT tokens.

{/if}

{:else} { token = '' }} /> {/if}

Set these environment variables for your agent worker.

BASE_INTERNAL_URL= `} language={shell} />

BASE_INTERNAL_URL: Base URL without trailing slash (e.g., http://windmill.example.com). Can be same as BASE_URL or private network URL. INIT_SCRIPT can be passed as env variable if needed.

Ensure at least one normal worker is running and listening to the tags flow and dependency (or flow-<workspace> and dependency-<workspace> if using workspace-specific default tags), because agent workers cannot run dependency jobs nor execute the flow state machine. They can, however, run subjobs within flows.

Generate tokens programmatically using this endpoint with superadmin bearer token:

POST /api/agent_workers/create_agent_token

Request body:

exp is Unix timestamp. Response contains the JWT token.

{:else if selectedTab === 'blacklist'}

{#if !$enterpriseLicense}

Token blacklist management is only available in the enterprise edition.

{:else}

Revoke tokens to prevent agent workers from authenticating. Blacklisted tokens may take up to 5 minutes to be effective because of caching.

validateBlacklistToken((e.target as HTMLInputElement)?.value ?? '') }} bind:value={blacklistToken} error={blacklistTokenError} />

{#if blacklistTokenError !== ''}

{blacklistTokenError}

{/if} {#if !$superadmin}

Only superadmins can manage the token blacklist.

{/if}

Blacklisted tokens

{#if isLoadingBlacklist}

Loading blacklisted tokens...

{:else if blacklistedTokens?.length === 0}

No tokens are currently blacklisted.

{:else}

{#each blacklistedTokens ?? [] as blacklistedToken (blacklistedToken.token)}

{blacklistedToken.token}

{#if blacklistedToken.expires_at}

Expires: {new Date(blacklistedToken.expires_at).toLocaleString()}

{/if}

{#if $superadmin}

{/each}

{/if}