> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getpostern.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Mint your first key
> Create one agent key in the Console: name it, tick the sectors it may reach, set when it expires, and store it before you leave the screen.
**Before you start**
* **Postern started, and the Console at [http://localhost:8787](http://localhost:8787).** You need
no source yet. If Postern runs on a computer with no screen,
[open the Console over SSH first](/start/install#open-console).
* **A few minutes.** Nothing on this page reaches an outside service.
* **A name.** Name the key after the agent, machine or person that will hold it. Do not name it
after the job you want done.
* **Your password manager, open.** Postern shows this key once, and never again.
In the Console, click **Agents & keys** in the left sidebar. Click **Mint a key**. On a first install
the list is empty, and that button sits inside the **No keys issued yet** card. The form opens.
Give this agent a name no other agent has. One name holds one key. Type a name that already exists
and Postern replaces that agent's key. Its sectors and its deadline become whatever this form now
says, and Postern clears a revoke you had made. Every agent still on the old key stops at once.
[Postern deletes every token derived from the old key too](/reference/agent-keys#revoking-rotating-and-removing).
In **Name**, type the name. The field shows `my-agent` in grey — that is an example, not a value.
**Mint the key** stays greyed out until you type something.
Console → **The ledger** prints this name under **Who** for every call the key makes. It records what
the key does, never what you do to the key.
[What does not get a row](/reference/audit-log#what-does-not-get-a-row).
Under **Grant which sectors**, tick each sector this agent may reach. The six toggles read
**Finance**, **Mail**, **Calendar**, **Contacts**, **Health** and **Home**, in that order. No sector
starts ticked, and the form says so:
`Nothing is granted until you pick it. Tap a sector to toggle it.`
A sector is the smallest thing you can grant. Tick **Mail** and you grant every mail source you have
connected, and every one you connect later. There is no read-only setting:
[a grant covers read and act across every provider in the sector](/reference/grants-and-sectors#what-a-grant-covers).
Only **Home** has anything to act on today.
The screen after the button lists the same sectors under **Opens**, in lower case — `finance`,
`mail`. Postern prints them that way everywhere it recaps a grant, including the **Granted sectors**
column of the register. The toggle you tick and the word you read back are the same sector.
You can press **Mint the key** with nothing ticked, and the form says what that costs you:
`No sectors granted yet — this key would be denied everything until you edit its grants.` Such a key
connects, and Postern then denies every read.
Under **Expires**, click one of four chips: **Never**, **30 days**, **60 days** or **90 days**.
claude.ai and ChatGPT refuse an agent key that never expires. If this key will go to either, click
**30 days**, **60 days** or **90 days**. Choose **Never** and their sign-in stops with
`This agent key never expires. Keys used with a cloud client must have an expiry…` — and only a
rotate gets you back in.
Which chip the form starts on follows your remote access. If you have not published a public address,
it starts on **Never**. If you have, it starts on **90 days** and adds the line
`This gate is published. A key you paste into a hosted client should expire.`
Choose by where the key will live. A key that never leaves this computer may sit at **Never**.
[Postern refuses a key at the instant it expires, and refuses to move a lapsed key's deadline](/reference/agent-keys#expiry).
Postern shows this key once, on the screen after the button. It keeps a scrambled copy it can check
against, never the key itself — no reveal button, nothing to recover. Leave without the key and your
only way back is a rotate, which replaces it. Open your password manager first.
Press **Mint the key**. The reveal screen opens. Do four things on it, in this order.
On the rotate path the same form reads differently, so look for different words. Its heading is
`Rotate ` with your agent's name in it, the button reads **Rotate the key**, and **Name** is
locked with the hint `The name carries over on rotate — one key per agent.` The sectors and the
deadline arrive already set to what that key held. Everything after the button is identical.
1. Under **Agent key — shown once**, press **Copy**. The Console answers
`Key copied — store it now; it isn't shown again`. Paste the key into your password manager now.
Every other **Copy** button on this screen overwrites your clipboard.
2. Read **Opens**. It lists the sectors you granted, followed by
`read and act, across every provider in each`. With none it reads
`no sectors — this key is denied everything`.
3. Read **MCP endpoint**. That is the address on this computer, and it is the only address this
screen ever shows. It still reads that way after you publish a public address. claude.ai and
ChatGPT cannot reach it.
4. Under **Connect config**, press **Copy config · key included**. Paste the whole object into your
agent's MCP config file — Claude Code's `.mcp.json`, Cursor's `mcp.json`. Then restart that agent.
The key is already in it, and there is nothing to fill in.
Where the address should be, the card can print
`This gateway isn’t serving MCP yet, so it has no address to pair with this key.` There is then no
**Connect config** block either. Your key is good. Postern serves no agent port.
[Set `MCP_HTTP_PORT` and restart it](/start/connect-an-agent#connect-config).
Press **Done** to return to Agents & keys. The link **Connect a hosted client (claude.ai, ChatGPT) →**
opens the hosted sign-in instead. That path needs a public address first:
[set up remote access](/start/remote-access#publish), then
[connect the agent](/start/connect-an-agent#hosted).
## Confirm it works
* Console → **Agents & keys** → **The register** lists your agent by name.
* Its sub-line counts the days down — `expires in 90d` for a 90-day key — or reads `never expires`.
* Its **Granted sectors** are the ones you ticked, and nothing else.
* The key is in your password manager, not only on your clipboard.
## If something went wrong
| What you see | What to do |
| ----------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Postern denies every read the agent makes | The key holds no sector, or not the sector the agent asked for. In Console → **Agents & keys**, click the agent and tick the sectors it needs under **Grants**. [Tick the sectors it may reach](#grant-sectors). |
| A sign-in answers `That agent key was not accepted. Check the key in the Console and try again.`, or you left the reveal screen without the key | Nothing can show that key again. In Console → **Agents & keys**, click the agent, press **Rotate**, then copy the new key from the reveal screen. [Store it before you leave the screen](#mint). |
| A sign-in says the key never expires, or an agent that worked yesterday fails today with nothing changed | Both are the deadline, and Postern will not move a lapsed key's. In Console → **Agents & keys**, click the agent, press **Rotate**, click **30 days**, **60 days** or **90 days**, then press **Rotate the key**. Hand the new key to the agent. [Set when it expires](#expiry). |
## What you have now
Your key opens the sectors you ticked, until the deadline you set, and nothing else. You have
connected no source to it yet.
Treat the key as a password: every config file you paste it into now holds a secret. If it gets loose,
revoke or rotate the agent.
[That ends the key and every token derived from it at once, and cuts its live sessions](/reference/agent-keys#revoking-rotating-and-removing).
Postern touches no source password, and nothing upstream changes.
## Next
a key you created · a few minutes, plus a restart of the agent ·
claude.ai and ChatGPT need a public address first