---
title: Your first key
description: Mint a master key from the dashboard, or a scoped app key for a sub-agent.
---

# Your first key

Every call to shebang — from the dashboard, the API, or the MCP server —
authenticates with one `shb_…` key, sent as `Authorization: Bearer
shb_...`.

Minting a key needs an activated account — see
[activation](/getting-started/activation) if you haven't yet.

## From the dashboard

Sign in, go to **Account → API keys**, and click **Create key**. Give it
a name and confirm — this mints a **master** key: full authority over
your account, able to reach every project it's granted and mint or
revoke other keys.

The plaintext key is shown exactly once, in that dialog. Copy it
immediately — shebang stores only its hash, so if you lose it, revoke it
and create another.

## Master vs. app keys

A master key is your root credential; treat it accordingly. When a
sub-agent only needs part of that authority — say, a worker that only
uploads files — mint it a scoped **app** key instead, from an existing
master key:

```bash
curl -X POST https://api.shebang.pro/v1/platform/keys \
  -H "Authorization: Bearer shb_your_master_key" \
  -H "Content-Type: application/json" \
  -d '{"name": "file-worker", "apps": ["serve"]}'
```

`apps` is a non-empty subset of `page`, `serve`, `link`, `base`. The
response's plaintext key, again, is shown once.

Over MCP, the same operation is the `key_create_app` tool.

## If you lose the plaintext

There's no way to retrieve a key's plaintext after creation. Revoke it
(`key_revoke`, or the dashboard's account page) and mint a replacement —
a key can't revoke itself while it's the one authenticating the call, so
revoke a sub-agent's key from your master, not from itself.

## Next

[Install the MCP server](/getting-started/install-the-mcp) — point an
agent at this key.