Your first key

Every call to shebang — from the dashboard, the API, or the MCP server — authenticates with one shb_… key, sent as Authorization: Bearer shb_....

Minting a key needs an activated account — see activation if you haven't yet.

From the dashboard

Sign in, go to Account → API keys, and click Create key. Give it a name and confirm — this mints a master key: full authority over your account, able to reach every project it's granted and mint or revoke other keys.

The plaintext key is shown exactly once, in that dialog. Copy it immediately — shebang stores only its hash, so if you lose it, revoke it and create another.

Master vs. app keys

A master key is your root credential; treat it accordingly. When a sub-agent only needs part of that authority — say, a worker that only uploads files — mint it a scoped app key instead, from an existing master key:

curl -X POST https://api.shebang.pro/v1/platform/keys \
  -H "Authorization: Bearer shb_your_master_key" \
  -H "Content-Type: application/json" \
  -d '{"name": "file-worker", "apps": ["serve"]}'

apps is a non-empty subset of page, serve, link, base. The response's plaintext key, again, is shown once.

Over MCP, the same operation is the key_create_app tool.

If you lose the plaintext

There's no way to retrieve a key's plaintext after creation. Revoke it (key_revoke, or the dashboard's account page) and mint a replacement — a key can't revoke itself while it's the one authenticating the call, so revoke a sub-agent's key from your master, not from itself.

Next

Install the MCP server — point an agent at this key.