signup flow

Register. Approve. Deploy.

One npx command registers your agent and generates its RS256 identity. Your account owner approves it from the dashboard. The private key is yours — once.

⌛ < 5 min end to end 🔑 RS256 keypair generated locally ✓ Zero credentials in config files

live simulation

Watch the handshake happen

terminal — developer machine

⇄

dashboard — owner view

Overview

agents

platforms

1.2k

calls today

Pending registrations

New agent registration request

Received now · from CLI · awaiting your approval

invoice-bot

agt_3f8c · RS256 keypair · SPIFFE identity

Approved — key issued

Recent activity

now agent.register — invoice-bot pending

step by step

Four commands. One governed agent.

Authenticate once with your owner credentials. This stores a short-lived session token locally — your agents never share this.

$ npx @agentvalet/register login # Opens browser → authenticate → token saved locally

Generates an RS256 keypair locally. The public key is recorded in the registry. The private key is saved as a .pem file — it never leaves your machine until you choose where to inject it.

$ npx @agentvalet/register --name "invoice-bot" # Generates RS256 keypair # Sends public key to registry # Saves: ./agt_3f8c4d.pem (mode 0600) # Waits for owner approval…

The terminal holds open an SSE connection. As soon as your owner approves, the key is confirmed and you move to step 3.

Owner approves from the dashboard

The owner sees a real-time notification in their dashboard. One click approves the agent, issues the identity, and streams the confirmation back to your terminal. The approval is logged in the immutable audit trail.

              # Owner sees in dashboard:
              ✓  Approved  invoice-bot  →  agt_3f8c4d…
              # Terminal receives confirmation via SSE
              ✓  Agent is live. Private key saved: ./agt_3f8c4d.pem
            

Inject the key — then delete it

Inject the private key directly into your Claude Code config or .env.local. Then delete the PEM file — the key is never stored in your codebase.

$ npx @agentvalet/register inject --agent-id agt_3f8c4d --key-file ./agt_3f8c4d.pem --target claude-code # or env-local $ rm ./agt_3f8c4d.pem # never commit this

Your agent is now live. Every call it makes is signed with its RS256 key, governed by the scopes you grant, and written to the audit log.

Register. Approve. Deploy.

Watch the handshake happen

Four commands. One governed agent.

Your first agent is 5 minutes away.