Skip to content



Requires at least Android 8.1 (Oreo).

  1. Install the Enclave Agent app from the Google Play Store.

    Get it on Google Play

    Need an APK?

    Need an APK file for loading onto a device that does not have Google Play support? Contact us on our support email,

  2. Once installed, enrol the device with your Enclave Organisation.

    You will be asked for a valid Enrolment Key from your Portal account.


    Enclave protects the private key material for the device using the Android KeyStore, to make it difficult to extract the generated identity from the device.

  3. Depending on the type of enrolment key you used to enrol your new system, it might be held waiting for an Administrator to provide enrolment approval in your account Portal. Log in to authorise the enrolment of your new system if you need to, and configure additional options like DNS.

You're all set! You've successfully enrolled your Android device to your Enclave account.

On Android, an administrator can craft a specific link with an enrolment key as a parameter. If a user clicks this link on a mobile device, with the app installed they will be taken directly to the enrolment screen of the application, with the enrolment key already filled in.

This link takes the form:

Replace XXXXX-XXXXX-XXXXX-XXXXX-XXXXX in the link with your enrolment key.


Visiting the provided link without the Enclave App installed with show a page prompting the user to install the app.

Reporting Problems

If you're having a problem with the app, you can open the 'Settings' page from the left-hand menu of the application, and from there submit logs to us directly.

If we're supporting you with a problem, we may ask you to temporarily "Enable Debug Logging" to capture more information before submitting logs, but this should be turned off to improve the performance and battery efficiency once the information is captured.


Uninstalling the Android application will delete all identity information stored on the device; if the app is reinstalled later, the device will need to be re-enrolled.