A few minutes. Nothing on this page reaches an outside service.
A name. Name the key after the agent, machine or person that will hold it. Do not name it
after the job you want done.
Your password manager, open. Postern shows this key once, and never again.
1
Open the form and name the agent
In the Console, click Agents & keys in the left sidebar. Click Mint a key. On a first install
the list is empty, and that button sits inside the No keys issued yet card. The form opens.
Give this agent a name no other agent has. One name holds one key. Type a name that already exists
and Postern replaces that agent’s key. Its sectors and its deadline become whatever this form now
says, and Postern clears a revoke you had made. Every agent still on the old key stops at once.
Postern deletes every token derived from the old key too.
In Name, type the name. The field shows my-agent in grey — that is an example, not a value.
Mint the key stays greyed out until you type something.Console → The ledger prints this name under Who for every call the key makes. It records what
the key does, never what you do to the key.
What does not get a row.
The form behind Mint a key: the Name field, the six sector toggles, and the expiry chips.
2
Tick the sectors it may reach
Under Grant which sectors, tick each sector this agent may reach. The six toggles read
Finance, Mail, Calendar, Contacts, Health and Home, in that order. No sector
starts ticked, and the form says so:
Nothing is granted until you pick it. Tap a sector to toggle it.A sector is the smallest thing you can grant. Tick Mail and you grant every mail source you have
connected, and every one you connect later. There is no read-only setting:
a grant covers read and act across every provider in the sector.
Only Home has anything to act on today.The screen after the button lists the same sectors under Opens, in lower case — finance,
mail. Postern prints them that way everywhere it recaps a grant, including the Granted sectors
column of the register. The toggle you tick and the word you read back are the same sector.
You can press Mint the key with nothing ticked, and the form says what that costs you:
No sectors granted yet — this key would be denied everything until you edit its grants. Such a key
connects, and Postern then denies every read.
3
Set when it expires
Under Expires, click one of four chips: Never, 30 days, 60 days or 90 days.
claude.ai and ChatGPT refuse an agent key that never expires. If this key will go to either, click
30 days, 60 days or 90 days. Choose Never and their sign-in stops with
This agent key never expires. Keys used with a cloud client must have an expiry… — and only a
rotate gets you back in.
Which chip the form starts on follows your remote access. If you have not published a public address,
it starts on Never. If you have, it starts on 90 days and adds the line
This gate is published. A key you paste into a hosted client should expire.Choose by where the key will live. A key that never leaves this computer may sit at Never.
Postern refuses a key at the instant it expires, and refuses to move a lapsed key’s deadline.
4
Create the key, and store it before you leave the screen
Postern shows this key once, on the screen after the button. It keeps a scrambled copy it can check
against, never the key itself — no reveal button, nothing to recover. Leave without the key and your
only way back is a rotate, which replaces it. Open your password manager first.
Press Mint the key. The reveal screen opens. Do four things on it, in this order.
On the rotate path the same form reads differently, so look for different words. Its heading is
Rotate <agent> with your agent’s name in it, the button reads Rotate the key, and Name is
locked with the hint The name carries over on rotate — one key per agent. The sectors and the
deadline arrive already set to what that key held. Everything after the button is identical.
Under Agent key — shown once, press Copy. The Console answers
Key copied — store it now; it isn't shown again. Paste the key into your password manager now.
Every other Copy button on this screen overwrites your clipboard.
Read Opens. It lists the sectors you granted, followed by
read and act, across every provider in each. With none it reads
no sectors — this key is denied everything.
Read MCP endpoint. That is the address on this computer, and it is the only address this
screen ever shows. It still reads that way after you publish a public address. claude.ai and
ChatGPT cannot reach it.
Under Connect config, press Copy config · key included. Paste the whole object into your
agent’s MCP config file — Claude Code’s .mcp.json, Cursor’s mcp.json. Then restart that agent.
The key is already in it, and there is nothing to fill in.
Where the address should be, the card can print
This gateway isn’t serving MCP yet, so it has no address to pair with this key. There is then no
Connect config block either. Your key is good. Postern serves no agent port.
Set MCP_HTTP_PORT and restart it.
Press Done to return to Agents & keys. The link Connect a hosted client (claude.ai, ChatGPT) →
opens the hosted sign-in instead. That path needs a public address first:
set up remote access, then
connect the agent.
The key holds no sector, or not the sector the agent asked for. In Console → Agents & keys, click the agent and tick the sectors it needs under Grants. Tick the sectors it may reach.
A sign-in answers That agent key was not accepted. Check the key in the Console and try again., or you left the reveal screen without the key
Nothing can show that key again. In Console → Agents & keys, click the agent, press Rotate, then copy the new key from the reveal screen. Store it before you leave the screen.
A sign-in says the key never expires, or an agent that worked yesterday fails today with nothing changed
Both are the deadline, and Postern will not move a lapsed key’s. In Console → Agents & keys, click the agent, press Rotate, click 30 days, 60 days or 90 days, then press Rotate the key. Hand the new key to the agent. Set when it expires.
Your key opens the sectors you ticked, until the deadline you set, and nothing else. You have
connected no source to it yet.Treat the key as a password: every config file you paste it into now holds a secret. If it gets loose,
revoke or rotate the agent.
That ends the key and every token derived from it at once, and cuts its live sessions.
Postern touches no source password, and nothing upstream changes.
