# Quickstart

Register an agent, issue a scoped credential, make a governed call, and revoke it — in about ten minutes.

## Before you start <!-- #before-you-start -->

You need a Mandavo workspace, an admin API key from Settings, and one system you want an agent to reach. The whole flow takes about ten minutes and leaves nothing standing behind it.

Set your key as MANDAVO_API_KEY in your environment. Every example below reads from it.

```bash
$ npm install @mandavo/sdk
$ export MANDAVO_API_KEY="sk_live_..."
```

> **WARNING: Keep workspace keys server-side**
>
> Never ship a workspace key to an agent or the browser. Agents act only with the short-lived credentials you mint for them.

## 1. Register the agent <!-- #1-register-the-agent -->

Create an identity in the directory and bind it to a human sponsor. The sponsor is the accountable person on your team; every action the agent takes is attributed to both.

POST /v1/identities with a name, a sponsor email, and the scopes the agent may ever request. The response returns an identity id you will use everywhere else.

```bash
curl https://api.mandavo.com/v1/identities \
  -H "Authorization: Bearer $MANDAVO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "invoice-reconciler",
    "sponsor": "layla@acme.com",
    "scopes": ["ledger:read", "ledger:write"]
  }'
```

## 2. Issue a scoped credential <!-- #2-issue-a-scoped-credential -->

Ask the Issuance Engine for a credential scoped to the exact task. Grant only what this task requires — an agent reaches nothing beyond its current scope.

POST /v1/credentials with the identity id, the scope, and a time-to-live. Default TTL is five minutes; the credential expires before it can leak.

```typescript
import { Mandavo } from '@mandavo/sdk';

const mandavo = new Mandavo(process.env.MANDAVO_API_KEY!);

const credential = await mandavo.credentials.issue({
  identity: 'id_9f3c2a',
  scope: 'ledger:read',
  ttlSeconds: 300,
});
```

## 3. Make a governed call <!-- #3-make-a-governed-call -->

Use the credential as a bearer token against the connector for the target system. The Policy Graph checks the action as it happens: low-risk grants run autonomously, high-risk ones gate on an approval.

Every call lands in the audit log with the identity, the sponsor, the scope, and the policy decision.

## 4. Revoke it <!-- #4-revoke-it -->

POST /v1/identities/{id}/revoke to invalidate the agent's credentials and scopes everywhere at once. Containment completes in seconds and is written to the record.

That is the full loop: named identity, scoped issuance, execution-time policy, one-action revocation — no standing keys left over.

```bash
$ curl -X POST https://api.mandavo.com/v1/identities/id_9f3c2a/revoke -H "Authorization: Bearer $MANDAVO_API_KEY"
```

> **TIP: Containment in seconds**
>
> Revocation invalidates every credential and scope for the identity across all connected systems at once — no per-system rotation to chase.