Skip to main content

Changing Passwords · API Keys

Edge's credentials start out identical on every box. Change them once during commissioning, and you're done.

Edge works differently from the other products

Platform · AI · Studio are changed with a rotation tool called bin/passwd.sh. Edge has no such tool. In Edge, credentials are simply configuration keys under app.properties, so you change them the same way as any other setting: fix it on screen and restart.

Where are the initial values?​

Once installation finishes, a shipping summary file is generated exactly once.

sudo cat /etc/kopens/credentials.txt
ItemValue
Permissions0600, root:root — only root can read it
CreatedOnce, on the first run of install.sh
ContentsUI login · REST API key · MQTT · OPC UA · TSE · keystore password
Move this file once commissioning is done

This file exists so it can be printed once before shipping and sent along with the sealed box. It is not meant to stay on the box. After you've changed all the credentials, move it to your operational vault and delete it from the box.

This file does not track changed values. It retains whatever the initial values were at install time, so if you trust this file after changing a password, you'll be looking at the old value.

What to change​

KeyWhatInitial value
edge.admin_passwordUI login password (admin)admin123!
edge.rest.api.keyREST API authentication key (X-API-Key / Bearer)Fixed default
mqtt.server.passwordEmbedded HiveMQ broker (Sparkplug transmit)edge123!
opc.ua.server.passwordOPC UA server (northbound)edge123!
server.api_keyPlatform integration tokenInjected at install time
ai.api.keyAI feature keyEmpty
tse.server.passwordEmbedded time series engine (TSE)tse123!

The first six appear in the configuration screen. tse.server.password isn't on screen, so you fix it in the config file.

You don't change the usernames — leave edge.admin_user · mqtt.server.user, etc. as they are; standard operation is to change only the passwords.

Method ① From the screen (for changing one or two)​

  1. Log in to https://<gateway-ip>/ui/main
  2. Top-right gear icon (fa-cog) → Configuration (/ui/system/config)
  3. Find the key in the relevant tab and enter the new value — every key in the table above renders as a password input field (edge.admin_password has no eye icon either, so the value never shows on screen)
  4. Top-right Save (fa-save)
  5. Restart — saving alone does not apply it
Save and apply are different

Save only writes to the app.properties file. The running process still holds the value from when it started, so you must restart for the new value to take effect. The restart on screen restarts only Tomcat without killing the container (30–90 seconds).

See Restart for details.

Method ② By command (commissioning — changing several at once)​

bin/config.sh changes the keys for you. You can change several at once and restart only once at the end, so this is the faster route during commissioning.

cd /opt/kopens/install/bin

./config.sh --get edge.admin_password            # 현재 값 확인
./config.sh --set edge.admin_password '<new-password>'
./config.sh --set edge.rest.api.key    '<new-key>'
./config.sh --set mqtt.server.password '<new-password>'
./config.sh --diff                               # 직전 백업과 비교
./config.sh --restart                            # 마지막에 한 번만

Run it without arguments and it opens the file in an editor, then asks whether to save and restart.

Each change automatically leaves a app.properties.bak.YYYYMMDD_HHMMSS backup.

Use only on 2026.08-20260825 or later

Earlier versions of config.sh --set silently lose values. Instead of the canonical real file, a compatibility symlink was pointed to sed -i, so edits never reached the app and were overwritten on the next restart. This is the root cause of the "it says it changed but doesn't take effect" symptom.

Check the image tag your box is running — IMAGE_TAG is the canonical version.

grep '^IMAGE_TAG=' /etc/kopens/version.env

If you're on a lower version, use method ③ below (direct file editing), or change it from the screen.

Method ③ Edit the file directly​

The canonical copy of the config file is a single real file.

sudo vi /etc/kopens/conf/app.properties
sudo systemctl restart plantpulse-edge.service
Be sure to edit the real file inside conf/
PathIdentity
/etc/kopens/conf/app.propertiesCanonical real file — the app reads this directly via -Dpe.conf.dir
/etc/kopens/app.propertiesSymlink — a convenience name pointing to the file above

Opening the symlink in an editor still edits the real file, so vi can use either one. But a custom-written sed -i script will delete the symlink and create a new plain file in its place. When that happens, your edits end up in /etc/kopens/app.properties while the app still reads conf/app.properties with the old value — a state where the save succeeded but nothing actually changed. (Using sed -i --follow-symlinks prevents this.)

After editing, verify that the change actually landed in the real file.

grep '^edge.admin_password' /etc/kopens/conf/app.properties

Verification​

# 실파일에 새 값이 들어갔는지
sudo grep -E '^(edge.admin_password|edge.rest.api.key|mqtt.server.password)' \
     /etc/kopens/conf/app.properties

# UI 로그인 — 새 비밀번호로 접속되는지
# REST API — 새 키로 통과하는지
curl -k -H "X-API-Key: <new-key>" https://<gateway-ip>/api/v1/system/status
The sidecar holds the initial values

/etc/kopens/env.sh.generated (0600) retains the value decided at install time, in export ADMIN_PASS=... form. When reinstallation or upgrade regenerates app.properties, it reads and preserves the existing app.properties value first, so values changed via screen or file are not reverted by an upgrade.

However, the sidecar itself is never refreshed, so treat its values as initial values too.