Get started

This quickstart walks you through the full authority lifecycle once, so you can see an agent get authorized, act, and be revoked.

Prerequisites#

• A Keydris account (currently invite-only private beta)
• An agent or service that acts on behalf of a user or system
• A counterparty system that can verify a token before accepting an action

1. Issue a KIT#

Issue a token scoped to the exact task your agent needs to perform - the specific action, the resource, and a short lifetime. Minimum privilege is the default, so grant only what the task requires.

2. Attach the token to the action#

Your agent presents its KIT when it connects to a counterparty. The token travels with the action, not out of band.

3. Verify at the front door#

The counterparty verifies the KIT before the agent can act. A valid, in-scope, unexpired token passes; anything else is rejected at the door.

4. Revoke when authority ends#

When the task is done - or something looks wrong - revoke the token. From that moment it fails verification everywhere, instantly.

Expected result#

You have now seen an agent authorized for exactly one task, enforced at the counterparty, and cut off on demand - with an immutable audit record of the whole exchange.

Want the mental model behind each step? Read the concepts guide.