User is unable to migrate agent due to "ErrInvalidToken" error.

[amolnater-qasource]

Kibana version:
VERSION: 9.2.0-SNAPSHOT
BUILD: 90821
COMMIT: 579ec67503caf5cd5d146d92c12543ada6ceba84
Artifact Link: https://snapshots.elastic.co/9.2.0-6c62938e/downloads/beats/elastic-agent/elastic-agent-9.2.0-SNAPSHOT-linux-x86_64.tar.gz

Preconditions:

1. An agent should be installed.
2. There are clusters available for migration testing.

Steps to reproduce:

1. Navigate to the Agents tab in Kibana.
2. Select an agent for migration.
3. Attempt to trigger the "Migrate Agent" action by providing the Fleet Server URL and enrollment token for an agent policy.
4. Observe that the migration process fails with an "ErrInvalidToken" error.

Expected behavior:
Agent migration should succeed if a valid enrollment token and Fleet Server URL are provided.

Agent Logs:

elastic-agent-diagnostics-2025-09-21T17-08-00Z-00.zip

Agent JSON:
ip-172-31-30-101-agent-details (1).json

Screen Capture:

Related Feature:
elastic/kibana#217619

Note:
We have cross checked that we are using correct enrollment token and Fleet server URL.

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[amolnater-qasource]

@muskangulati-qasource Please review.

[muskangulati-qasource]

Secondary review is Done for this ticket!

[michalpristas]

if you use values using elastic-agent enroll command does it work?

[amolnater-qasource]

Hi @michalpristas

Thank you for looking into this issue.
Yes, we are successfully able to install the Agent on new Kibana with same values.

Screenshot:

The same values fail if we use it for Migration action.

Please let us know if anything else is required from our end.
Thanks!!

[michalpristas]

note; what changed is use of secrets for tokens. looking into it

[michalpristas]

for reference: elastic/kibana#235752