diff --git a/coordinator/internal/transport/http/server.go b/coordinator/internal/transport/http/server.go
index 98fb9af..79c9b88 100644
--- a/coordinator/internal/transport/http/server.go
+++ b/coordinator/internal/transport/http/server.go
@@ -132,6 +132,11 @@ func (s *Server) Handler(token string, uiToken ...string) http.Handler {
 	mux.HandleFunc("GET /health", s.handleHealth)
 	// Unauthenticated like /health, so a Prometheus scraper needs no credential.
 	mux.Handle("GET /metrics", s.metrics.Handler())
+	// Worker-key exchange is fronted by the coordinator when the userservice
+	// is embedded (serve mode): the key itself is the credential.
+	if s.userserviceURL != "" {
+		mux.HandleFunc("POST /worker-tokens/exchange", s.handleWorkerTokenExchangeProxy)
+	}
 
 	hasBasicAuth := len(uiToken) > 0 && uiToken[0] != ""
 	if s.uc.Dashboard != nil && (s.uiSessionMode() || hasBasicAuth) {
diff --git a/coordinator/internal/transport/http/templates/add-worker.html b/coordinator/internal/transport/http/templates/add-worker.html
index 036813d..09475c0 100644
--- a/coordinator/internal/transport/http/templates/add-worker.html
+++ b/coordinator/internal/transport/http/templates/add-worker.html
@@ -41,12 +41,12 @@
   </main>
   <script>
     const coord=(document.body.dataset.coordinator||location.origin).replace(/\/+$/,'');
-    const users=(document.body.dataset.userservice||'').replace(/\/+$/,'');
+    const users=(document.body.dataset.userservice||coord).replace(/\/+$/,'');
     const keysBox=document.querySelector('#keys'),cmdBox=document.querySelector('#command'),form=document.querySelector('#create'),nameInput=document.querySelector('#key-name'),createBtn=document.querySelector('#create-btn'),error=document.querySelector('#error');
     const node=(tag,text,cls)=>{const n=document.createElement(tag);if(text!==undefined)n.textContent=text;if(cls)n.className=cls;return n};
     const shq=s=>"'"+String(s).replace(/'/g,"'\\''")+"'";
     const buildCommand=(key,name)=>['# install the worker binary (or download worker-agent from the release page)','curl -fsSL https://raw.githubusercontent.com/emil28092005/SciMesh/main/install.sh | bash -s worker','','export COORDINATOR_URL='+coord,'export USERSERVICE_URL='+(users||'<your userservice URL>')+' \\','export WORKER_KEY='+key,'export WORKER_NAME='+shq(name||'my-machine'),'export WORK_DIR=~/scimesh-worker','worker-agent'].join('\n');
-    const showCommand=(key,name)=>{cmdBox.replaceChildren();cmdBox.append(node('strong','Key created — copy it now, it is shown only once.'));const pre=node('pre',buildCommand(key,name));cmdBox.append(pre);const copy=node('button','Copy command','button secondary');copy.type='button';copy.addEventListener('click',()=>{navigator.clipboard&&navigator.clipboard.writeText(buildCommand(key,name)).then(()=>{copy.textContent='Copied ✓'},()=>{copy.textContent='Press Ctrl+C to copy'})});cmdBox.append(document.createElement('br'),copy);if(!users){cmdBox.append(node('p','Set USERSERVICE_URL to a userservice URL your machine can reach, or skip it and run the worker with WORKER_AUTH_TOKEN instead of a key.','warn'))}cmdBox.classList.remove('hidden')};
+    const showCommand=(key,name)=>{cmdBox.replaceChildren();cmdBox.append(node('strong','Key created — copy it now, it is shown only once.'));const pre=node('pre',buildCommand(key,name));cmdBox.append(pre);const copy=node('button','Copy command','button secondary');copy.type='button';copy.addEventListener('click',()=>{navigator.clipboard&&navigator.clipboard.writeText(buildCommand(key,name)).then(()=>{copy.textContent='Copied ✓'},()=>{copy.textContent='Press Ctrl+C to copy'})});cmdBox.append(document.createElement('br'),copy);cmdBox.classList.remove('hidden')};
     const revoke=async id=>{const r=await fetch('/ui/api/worker-keys/'+encodeURIComponent(id)+'/revoke',{method:'POST'});if(r.status===204||r.ok){loadKeys()}else{error.textContent='Could not revoke the key.'}};
     const renderKeys=keys=>{keysBox.replaceChildren();if(!keys.length){keysBox.append(node('div','No keys yet. Create one above to connect a machine.','empty'));return}for(const k of keys){const row=node('div',undefined,'key'),left=node('div');left.append(node('div',k.name||'unnamed','kn'),node('div',k.prefix+'…','kp'),node('div','Created '+new Date(k.created_at).toLocaleString()+(k.last_used_at?' · last used '+new Date(k.last_used_at).toLocaleString():' · never used'),'kd'));const btn=node('button','Revoke','revoke');btn.type='button';btn.addEventListener('click',()=>revoke(k.id));row.append(left,btn);keysBox.append(row)}};
     const loadKeys=async()=>{try{const r=await fetch('/ui/api/worker-keys',{headers:{Accept:'application/json'}});if(!r.ok)throw Error();const data=await r.json();renderKeys(data.worker_keys||[])}catch(_){keysBox.replaceChildren(node('div','Could not load your keys.','empty'))}};
diff --git a/coordinator/internal/transport/http/ui_workers.go b/coordinator/internal/transport/http/ui_workers.go
index 0db4b0f..b72543c 100644
--- a/coordinator/internal/transport/http/ui_workers.go
+++ b/coordinator/internal/transport/http/ui_workers.go
@@ -9,6 +9,7 @@ import (
 	"github.com/google/uuid"
 
 	"github.com/emil28092005/SciMesh/coordinator/internal/authctx"
+	"github.com/emil28092005/SciMesh/coordinator/internal/domain"
 	"github.com/emil28092005/SciMesh/coordinator/internal/usecase"
 )
 
@@ -116,3 +117,38 @@ func (s *Server) callUserserviceAuthedBody(ctx context.Context, method, path, be
 	}
 	return resp.StatusCode, respBody, nil
 }
+
+// handleWorkerTokenExchangeProxy forwards a worker-key exchange to the
+// userservice. The key itself is the credential, so this route is public —
+// exactly like the userservice's own endpoint. In `serve` mode the embedded
+// userservice binds loopback only, so workers need the coordinator to front
+// the exchange for them.
+func (s *Server) handleWorkerTokenExchangeProxy(w http.ResponseWriter, r *http.Request) {
+	if s.userserviceURL == "" {
+		writeJSON(w, http.StatusNotFound, map[string]string{"error": "not found"})
+		return
+	}
+	body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
+	if err != nil {
+		s.writeError(w, r, domain.ErrInvalidInput)
+		return
+	}
+	req, err := http.NewRequestWithContext(r.Context(), http.MethodPost, s.userserviceURL+"/worker-tokens/exchange", bytes.NewReader(body)) //nolint:gosec // G704: path is fixed, host is config
+	if err != nil {
+		s.writeError(w, r, err)
+		return
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := s.httpClient.Do(req) //nolint:gosec // G704: see above
+	if err != nil {
+		s.writeError(w, r, err)
+		return
+	}
+	defer func() { _ = resp.Body.Close() }()
+	respBody, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if err != nil {
+		s.writeError(w, r, err)
+		return
+	}
+	proxyJSON(w, resp.StatusCode, respBody)
+}