---
title: Activation
description: shebang is invitation only — how to activate your account and what still works before you do.
---

# Activation

Creating a shebang account is free and open to anyone. Using the
services — sherpage, sherserve, sherlink, sherbase, and the platform API
itself — is not: shebang is invitation only, and a fresh account can't
call any of it until it activates.

## Activate

From the dashboard, open the activation prompt and enter the phone
number Braven has for you, in whatever format is comfortable — `9123
4567` and `+65 9123 4567` are the same number as far as activation is
concerned. If that number is on the invitation list and isn't already
bound to another account, activation completes immediately.

The number itself is never stored. shebang keeps only a keyed hash of
it, used solely to check it against the invitation list and to make
sure one number activates exactly one account. Deleting your account
frees the number, so it can activate a different account afterward.

## What an agent sees before activation

Every call to a `/v1/...` route, and `POST /api/account/keys` (minting a
key from the dashboard), returns a `403` from an unactivated account,
even with a fully valid credential:

```json
{ "error": "not_activated", "message": "Activate shebang services at dash.shebang.pro first." }
```

Where that reaches you depends on which door you're calling through:

- Calling the platform API directly, or through the **local** `shebang-mcp`
  server (which calls the platform API for every tool), that body
  surfaces as a thrown tool error reading:

  ```
  platform API error 403: not_activated: Activate shebang services at dash.shebang.pro first.
  ```

- Calling the **hosted MCP** endpoint at `https://api.shebang.pro/mcp`,
  the same check runs before any tool exists to call, so the `POST` to
  `/mcp` itself is rejected with that JSON body at HTTP status 403 —
  there's no MCP session to fail inside. A generic MCP-over-HTTP client
  sees a plain `403` response to its connection attempt, not a
  JSON-RPC error; Claude Code reports the server as failing to connect
  rather than surfacing a tool-call error.

See [error codes](/reference/error-codes) for how this fits next to
every other error code the platform returns.

## What still works before you activate

An unactivated account isn't locked out of everything — only the
services themselves. Before you activate, you can still:

- Sign in and out.
- Use "sign in with sherlock" on any third-party app.
- Visit and change your account settings.
- Delete your account.

## Next

[Your first key](/getting-started/your-first-key) — once you've
activated, mint the credential everything else authenticates with.