# Agent sign-in

> New to Prized? Your coding agent makes your account with your email address and a 6-digit code, and gets an API key.

URL: https://prized.dev/docs/agent-sign-in

## Start [#start]

Tell your agent:

```text title="Prompt"
Sign me up for Prized with my email address by following https://prized.dev/auth.md, then start a box for me.
```

Prized emails you a 6-digit code; give it to your agent. The code makes your account, with the [free credit](https://prized.dev/docs/billing#free-credit) and no card, and the agent gets an API key for the [API](https://prized.dev/docs/api) and the CLI (`prized login --token`).

Already on Prized? Agent sign-in only makes new accounts. Make your agent a key under **Settings → API keys** instead.

> [!WARNING]
> Give the code only to an agent you are using right now, never to anyone else: whoever has it gets a key to your new account.

## What happens [#what-happens]

| Step           | What happens                                                                                                                            |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| The email      | "Your Prized agent code": the code, which agent is asking, and where the request came from. It lasts 15 minutes and allows five tries.  |
| The account    | Named after you when the agent knows your name, in a workspace of its own. To join your company's workspace later, sign in with Google. |
| Later sign-ins | Google or GitHub on the same address opens the same account.                                                                            |

## The key [#the-key]

* **The agent's.** Listed under **Settings → API keys** by the agent's name, marked as an agent's key. Revoke it there; the agent can also revoke it itself.
* **Limited.** It starts, stops and uses boxes and reads the workspace; no secrets, no sandboxes ([What a key can do](https://prized.dev/docs/workspaces#what-a-key-can-do)).
* **Expires.** After 90 days; make the agent a new one under **Settings → API keys**.

## Boxes and billing [#boxes-and-billing]

The agent can start a Small on the free credit right away. The credit comes once per inbox: `you+work@gmail.com` is `you@gmail.com`. Medium and larger need a plan, which you start under **Settings → Billing**. Agents read prices from [pricing](https://prized.dev/pricing), never from memory.

## For agent builders [#for-agent-builders]

`prized.dev/auth.md` is the contract. Call the API's own origin, `https://api.prized.dev`.

| Route                        | What it does                                                                                                                                        |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| `POST /api/v1/agent/sign-up` | `{email, name?, personName?}`, no credential: the key, unverified, and the emailed code. The same answer whether or not the address has an account. |
| `POST /api/v1/agent/verify`  | `{code}` with the key as bearer: the account and a working key, or `409 sign_in_required` if the address already had an account.                    |
| `DELETE /api/v1/agent/key`   | The key as bearer: it stops working.                                                                                                                |

While a code is live, signing up again answers `409 code_pending`. The email names the agent only for known agents; any other name reads "An AI agent". Throwaway and placeholder domains are refused. Limits: 10 sign-ups and 5 codes an hour per network, 5 codes a day per inbox, and a few credited new accounts a day per network.

## Troubleshooting [#troubleshooting]

| Symptom                        | What to do                                                                                       |
| ------------------------------ | ------------------------------------------------------------------------------------------------ |
| No email                       | Check spam. A new code goes out only after the last one expired, five a day at most.             |
| `code_expired`                 | Older than 15 minutes, or tried five times. The agent asks for a new one.                        |
| `sign_in_required`             | You already have an account: sign in at prized.dev and make a key under **Settings → API keys**. |
| The agent cannot reach auth.md | Run `prized login` yourself, or give the agent a key from **Settings → API keys**.               |
| A key you did not expect       | Revoke it under **Settings → API keys**.                                                         |