ZanoraBetaDocs

Set up

Sign up as a buyer from the console or the API, confirm your email, and keep the root key safe. Nothing is created until the address is confirmed.

From the console

  1. Open console.zanora.dev↗ and choose Buyer.
  2. Enter your email, organisation name and a password.
  3. Click the link in the email. The console confirms the address, creates your workspace, and shows the root API key once.

You can now sign in to the console with your email and password, and use the key from code.

From the API

Terminal
curl -s -X POST https://api.zanora.dev/v1/signup -H 'content-type: application/json' -d '{
  "role": "buyer",
  "email": "eng@northwind.example",
  "organizationName": "Northwind",
  "dailyBudgetMicros": "15000000",
  "password": "optional — enables console sign-in"
}'
FieldRequiredMeaning
roleyes"buyer"
emailyeswhere the confirmation link goes
organizationNameyesshown in the console and on approvals
dailyBudgetMicrosnothe workspace's daily spending cap, in micro-dollars ("15000000" = $15). Held to the platform maximum, the 24-hour funding limit ($100 hosted), which GET /v1/workspaces/:id/budget reports as maxDailyBudgetMicros
passwordnolets you sign in to the console. It only takes effect once the email is confirmed
websitenoyour organisation's site

The response is 202 with a signupId. Nothing exists yet. The link in the email carries a single-use token that expires after 24 hours. Opening it (or POST /v1/signup/verify with {"token":"…"}) creates the workspace and returns:

JSON
{
  "signupId": "sgn_…",
  "role": "buyer",
  "status": "completed",
  "tenant": { "kind": "workspace", "id": "wsp_…", "name": "Northwind" },
  "credential": { "keyId": "akey_…", "token": "zk.akey_….…", "label": "…", "scopes": ["…"] }
}

Save the token now

credential.token is shown once. Only a hash of it is stored, so a lost key is replaced, never recovered.

Through an AI agent

One command signs you up, gives an agent a wallet, and keeps the keys on your computer. You can run it yourself, or let an AI agent run it for you:

Terminal
npx -y @zanora/mcp setup --email eng@northwind.example --org "Northwind" --name claude-code
# Zanora emails you a 6-digit code (as well as the link). Then:
npx -y @zanora/mcp setup --code 123456

The code is what creates the account, so the account is yours whoever typed the command. Nothing secret is printed: the agent's keys go to ~/.zanora, readable only by you, and its API key can buy but can't approve purchases. You also get an email to set your console password, which you need to add money and approve purchases. See Buy from an MCP client.

Only give the code to an agent you asked to set this up

Whoever has the code can create this account. It works once, expires after 30 minutes, and allows 5 attempts.

To have an agent do it, tell it "Fetch https://zanora.dev/skill.md and follow the setup instructions". The API underneath (withCode, POST /v1/signup/verify with { signupId, code, agent }) is in the API reference.

Didn't get the email?

Terminal
curl -s -X POST https://api.zanora.dev/v1/signup/resend -H 'content-type: application/json' \
  -d '{"role":"buyer","email":"eng@northwind.example"}'

Resending invalidates the previous link. The response is the same whether or not the address is known, so this can't be used to find out who has an account.

After signing up