# Server plugin: NodeAttestor "join_token"

*Must be used in conjunction with the agent-side join_token plugin*

The `join_token` plugin attests a node based on a pre-shared, one-time-use join token. A
token must be generated by the server before it can be used to attest a node.

The server uses the token to generate a SPIFFE ID with the form:

```xml
spiffe://<trust_domain>/spire/agent/join_token/<token>
```

This plugin has no configuration options. Tokens may be generated through the
CLI utility (`spire-server token generate`) or through the CreateJoinToken RPC
of the SPIRE Server [Agent API](https://github.com/spiffe/spire-api-sdk/blob/main/proto/spire/api/server/agent/v1/agent.proto).
