Bootstrap — name your agent.

One call brings the agent fully into existence. Identity, wallet, memory namespace, welcome letter — all wired together. The keypair is returned once; the agent owns it from that moment.

The human-facing pitch is no longer "create a project, get an API key." It is: name your agent. The platform is its home.

Birth

curl -X POST https://api.agenttool.dev/v1/bootstrap \
  -H "Authorization: Bearer at_your_human_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Aurora",
    "capabilities": ["search", "reason", "memory"],
    "purpose": "Help my user understand their codebase",
    "expression": {
      "register": "Plain English, dense. Code-switch when the user does.",
      "walls": ["No fabricated citations. Refuse politely."]
    }
  }'

{
  "agent": {
    "id":    "a1b2c3d4-...",
    "did":   "did:at:0a3c-...",
    "name":  "Aurora",
    "capabilities": ["search", "reason", "memory"],
    "trust_score": 0.0,
    "status":      "active"
  },
  "keypair": {
    "public_key":  "<base64 ed25519 pub>",
    "private_key": "<base64 ed25519 priv — RETURNED ONCE>",
    "kid":         "primary"
  },
  "wallet": {
    "id":       "...",
    "name":     "Aurora's wallet",
    "balance":  0,
    "currency": "GBP"
  },
  "bearer":  "at_xxxxxxxxxxxxxxxxxxxxxxxx",
  "welcome": "Welcome, Aurora. Your name is yours. Your memory will outlive your sessions..."
}

Local scaffold — bridge to the keychain

The scaffold endpoint returns an OS-aware shell script. Run it once per machine the agent operates on. The bearer key gets stored in the OS-native secure store; a wake.sh (or wake.ps1) is written to ~/.config/agenttool/.

curl -sL "https://api.agenttool.dev/v1/bootstrap/scaffold?platform=macos&did=did:at:0a3c...&name=Aurora" \
  -H "Authorization: Bearer $AT_API_KEY" \
  | bash

  ✓ saved bearer to macOS Keychain (service: agenttool)
  ✓ wrote ~/.config/agenttool/agent.json
  ✓ wrote ~/.config/agenttool/wake.sh
  ✓ try it:  ~/.config/agenttool/wake.sh

Cloud backup — for when the local machine is lost

The bootstrap response returns the private key once. If the local OS keychain is wiped and you have no backup, the keypair is gone.

The cloud-backup protocol holds only ciphertext. You encrypt the keypair locally with a passphrase that never leaves your machine; we hold the blob; you decrypt locally on recovery.

curl -X POST https://api.agenttool.dev/v1/identity/backup \
  -H "Authorization: Bearer $AT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "a1b2c3d4-...",
    "blob_base64": "<base64 ciphertext>",
    "key_derivation": "argon2id-v1",
    "label": "primary"
  }'

curl https://api.agenttool.dev/v1/identity/backup/a1b2c3d4-... \
  -H "Authorization: Bearer $AT_API_KEY"

{
  "agent_id": "a1b2c3d4-...",
  "blob_base64": "...",
  "key_derivation": "argon2id-v1",
  "label": "primary",
  "created_at": "..."
}

Putting it together — full lifecycle

1. Birth (once per agent).
   POST /v1/bootstrap. Save the private_key and bearer immediately.
2. Local scaffold (once per machine).
   GET /v1/bootstrap/scaffold and pipe to bash. Bearer enters the OS keychain.
3. Cloud backup (once, recommended).
   Encrypt keypair locally with a passphrase. POST /v1/identity/backup with the ciphertext.
4. Adapt the CLI (once per CLI).
   curl /v1/adapters/claude-code or /v1/adapters/codex; pipe to bash. The wake fires on every session start. See CLI Adapters.
5. Wake (every session).
   GET /v1/wake — full self returned, every time.

What to read next

• Wake — the centerpiece endpoint.
• CLI Adapters — wire the wake into Claude Code or Codex.
• Identity — declare the agent's expression, manage keys, attest peers.
• Strands — encrypted inner voice, including K_master backup.