Skip to content

Site search

Type to search Pages

Docs

Getting started

Quickstart

View as .md

Register an agent, issue a scoped credential, make a governed call, and revoke it — in about ten minutes.

Before you start

You need a Mandavo workspace, an admin API key from Settings, and one system you want an agent to reach. The whole flow takes about ten minutes and leaves nothing standing behind it.

Set your key as MANDAVO_API_KEY in your environment. Every example below reads from it.

Terminal
npm install @mandavo/sdkexport MANDAVO_API_KEY="sk_live_..."

Keep workspace keys server-side

Never ship a workspace key to an agent or the browser. Agents act only with the short-lived credentials you mint for them.

1. Register the agent

Create an identity in the directory and bind it to a human sponsor. The sponsor is the accountable person on your team; every action the agent takes is attributed to both.

POST /v1/identities with a name, a sponsor email, and the scopes the agent may ever request. The response returns an identity id you will use everywhere else.

Register an agent
curl https://api.mandavo.com/v1/identities \
  -H "Authorization: Bearer $MANDAVO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "invoice-reconciler",
    "sponsor": "layla@acme.com",
    "scopes": ["ledger:read", "ledger:write"]
  }'

2. Issue a scoped credential

Ask the Issuance Engine for a credential scoped to the exact task. Grant only what this task requires — an agent reaches nothing beyond its current scope.

POST /v1/credentials with the identity id, the scope, and a time-to-live. Default TTL is five minutes; the credential expires before it can leak.

Issue a 5-minute credential
import { Mandavo } from '@mandavo/sdk';

const mandavo = new Mandavo(process.env.MANDAVO_API_KEY!);

const credential = await mandavo.credentials.issue({
  identity: 'id_9f3c2a',
  scope: 'ledger:read',
  ttlSeconds: 300,
});

3. Make a governed call

Use the credential as a bearer token against the connector for the target system. The Policy Graph checks the action as it happens: low-risk grants run autonomously, high-risk ones gate on an approval.

Every call lands in the audit log with the identity, the sponsor, the scope, and the policy decision.

4. Revoke it

POST /v1/identities/{id}/revoke to invalidate the agent's credentials and scopes everywhere at once. Containment completes in seconds and is written to the record.

That is the full loop: named identity, scoped issuance, execution-time policy, one-action revocation — no standing keys left over.

Terminal
curl -X POST https://api.mandavo.com/v1/identities/id_9f3c2a/revoke -H "Authorization: Bearer $MANDAVO_API_KEY"

Containment in seconds

Revocation invalidates every credential and scope for the identity across all connected systems at once — no per-system rotation to chase.