Mint your first key

1

Open the form and name the agent

In the Console, click Agents & keys in the left sidebar. Click Mint a key. On a first install the list is empty, and that button sits inside the No keys issued yet card. The form opens.

Give this agent a name no other agent has. One name holds one key. Type a name that already exists and Postern replaces that agent’s key. Its sectors and its deadline become whatever this form now says, and Postern clears a revoke you had made. Every agent still on the old key stops at once. Postern deletes every token derived from the old key too.

In Name, type the name. The field shows my-agent in grey — that is an example, not a value. Mint the key stays greyed out until you type something.Console → The ledger prints this name under Who for every call the key makes. It records what the key does, never what you do to the key. What does not get a row.

2

Tick the sectors it may reach

Under Grant which sectors, tick each sector this agent may reach. The six toggles read Finance, Mail, Calendar, Contacts, Health and Home, in that order. No sector starts ticked, and the form says so: Nothing is granted until you pick it. Tap a sector to toggle it.A sector is the smallest thing you can grant. Tick Mail and you grant every mail source you have connected, and every one you connect later. There is no read-only setting: a grant covers read and act across every provider in the sector. Only Home has anything to act on today.The screen after the button lists the same sectors under Opens, in lower case — finance, mail. Postern prints them that way everywhere it recaps a grant, including the Granted sectors column of the register. The toggle you tick and the word you read back are the same sector.

You can press Mint the key with nothing ticked, and the form says what that costs you: No sectors granted yet — this key would be denied everything until you edit its grants. Such a key connects, and Postern then denies every read.

3

Set when it expires

Under Expires, click one of four chips: Never, 30 days, 60 days or 90 days.

claude.ai and ChatGPT refuse an agent key that never expires. If this key will go to either, click 30 days, 60 days or 90 days. Choose Never and their sign-in stops with This agent key never expires. Keys used with a cloud client must have an expiry… — and only a rotate gets you back in.

Which chip the form starts on follows your remote access. If you have not published a public address, it starts on Never. If you have, it starts on 90 days and adds the line This gate is published. A key you paste into a hosted client should expire.Choose by where the key will live. A key that never leaves this computer may sit at Never. Postern refuses a key at the instant it expires, and refuses to move a lapsed key’s deadline.

4

Create the key, and store it before you leave the screen

Postern shows this key once, on the screen after the button. It keeps a scrambled copy it can check against, never the key itself — no reveal button, nothing to recover. Leave without the key and your only way back is a rotate, which replaces it. Open your password manager first.

Press Mint the key. The reveal screen opens. Do four things on it, in this order.

On the rotate path the same form reads differently, so look for different words. Its heading is Rotate <agent> with your agent’s name in it, the button reads Rotate the key, and Name is locked with the hint The name carries over on rotate — one key per agent. The sectors and the deadline arrive already set to what that key held. Everything after the button is identical.

1. Under Agent key — shown once, press Copy. The Console answers Key copied — store it now; it isn't shown again. Paste the key into your password manager now. Every other Copy button on this screen overwrites your clipboard.
2. Read Opens. It lists the sectors you granted, followed by read and act, across every provider in each. With none it reads no sectors — this key is denied everything.
3. Read MCP endpoint. That is the address on this computer, and it is the only address this screen ever shows. It still reads that way after you publish a public address. claude.ai and ChatGPT cannot reach it.
4. Under Connect config, press Copy config · key included. Paste the whole object into your agent’s MCP config file — Claude Code’s .mcp.json, Cursor’s mcp.json. Then restart that agent. The key is already in it, and there is nothing to fill in.

Where the address should be, the card can print This gateway isn’t serving MCP yet, so it has no address to pair with this key. There is then no Connect config block either. Your key is good. Postern serves no agent port. Set MCP_HTTP_PORT and restart it.

Press Done to return to Agents & keys. The link Connect a hosted client (claude.ai, ChatGPT) → opens the hosted sign-in instead. That path needs a public address first: set up remote access, then connect the agent.

​

Confirm it works

• Console → Agents & keys → The register lists your agent by name.
• Its sub-line counts the days down — expires in 90d for a 90-day key — or reads never expires.
• Its Granted sectors are the ones you ticked, and nothing else.
• The key is in your password manager, not only on your clipboard.

​

If something went wrong

​

What you have now

​

Next