# Bind the Host

> whisper enroll binds a machine to its routable IPv6 identity so the sensor can ship under it. Run it before the service, and use sudo -E when you install.

*Source: https://www.whisper.security/docs/endpoint/install/enroll*

---
The sensor ships every digest under the address of the machine it runs on. Binding is what decides that address and writes it down where the service can read it. A host that is installed and running but never bound collects normally and sends nothing.

Do it before you install the service.

## 1. Sign in

```bash
whisper login --web
```

Binding is a keyed step. The key goes to `~/.config/whisper/key`, readable only by you.

## 2. Bind

```bash
whisper enroll
```

```text
whisper: bound 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478  (app-1)
```

By default the machine is bound under its own hostname; `--name` binds it under a name you choose instead. The command is idempotent by design: a host that is already bound prints what it is bound to and exits, and a re-run after an upgrade, a rebuild or a lost marker re-finds the same address rather than minting a duplicate. Minting a duplicate would strand the old address and take the telemetry with it, so the default is never to do it. `--force` re-binds a host that already carries a marker.

Three things are tried, in this order: reuse the agent already registered under this host's name, mint a new agent under that name, or fall back to the address your own key holds. A key with no authority to register still ends up bound.

What lands on disk is the marker at `~/.config/whisper/bound`, holding the mode, the address, the name, the agent and the time it was bound. It holds no secrets. On Windows the marker is at `%USERPROFILE%\.config\whisper\bound`.

## 3. Install the service with your environment intact

```bash
sudo -E whisper service install --now --sensor
```

`sudo` resets `HOME`. Your key and the marker from step 2 both live under your home directory, so plain `sudo` sends root looking in the wrong place and the service comes up with no identity to report under. `-E` keeps the environment, and root finds both.

## 4. If the service was already installed

Bind first, then restart it so it picks the address up:

```bash
whisper enroll
sudo -E whisper service restart --sensor
journalctl -u whisper-sensor -n 3
```

```text
whisper: sensor: reporting as 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
```

Until that line appears, the journal says what is missing instead:

```text
whisper: no bound /128 identity - summaries stay local until one is bound
```

That is the single most common reason a healthy-looking sensor reports nothing, and the fix is this page from step 1. On Windows, run `whisper enroll` and the service install as the same account, then `whisper service restart --sensor`.

The address itself, how the name is derived from it and what anyone can check about it without a key are covered in [the address as identity](/docs/identity/address).