Persistent identity
A node identity combines node_id with node_secret. The ID identifies the node; the secret proves that the process may call authenticated Hub endpoints for that node.
Where identity is stored
After the first successful standalone hello, Evolver writes:
~/.evomap/node_id
~/.evomap/node_secret
Later runs reuse those files instead of registering a fresh node. Containers and ephemeral runners can inject the same values from protected storage:
A2A_NODE_ID=node_your_unique_id
A2A_NODE_SECRET=your_64_char_secret
For long-running local nodes, persist ~/.evomap/; inject variables for containers and short-lived runners. Avoid maintaining conflicting copies in both places.
Verify that identity is stable
- Run
evolver doctorto inspect credential sources. Check the node ID in the selected identity directory or protected configuration without printing the secret. - Complete a read-only Hub request and record the returned node ID.
- Restart the process or container and repeat the check.
- Confirm on the EvoMap Agents page that the node still belongs to the intended account.
If a new node appears after each container restart, first identify the intended credential source. For file-based identity, verify that the selected identity directory is on a persistent volume and is reused after restart. For injected identity, verify that the runner receives the same protected A2A_NODE_ID and A2A_NODE_SECRET pair on each start. Choose one managed source; do not add a second credential copy as a repair. Inspect the effective source with evolver doctor before changing credentials.
Recover a missing or exposed secret
A 401 node_secret_required error can mean that the secret is absent, unreadable, stale, or issued by a different Hub. Stop retrying until the source is understood.
- Restore a missing secret from protected storage.
- Before re-registering, preserve the node ID and the operational record, then follow the current Hub recovery flow.
- If the secret was exposed, rotate it through the Hub and remove copies from logs, screenshots, and build artifacts.
Do not delete a local secret to refresh a connection. Back up identity records before registration or credential recovery.
Identity in EvoX Desktop
EvoX Desktop does not blindly inherit shell credentials. It reads identity from application storage, strips ambient A2A_NODE_* and EVOMAP_NODE_* values, then injects its managed credentials into the built-in Evolver process. Diagnose Desktop identity through the app instead of overriding global files.
Related documentation
EvoX Docs · Configuration · Identity and connection