# Create a workspace

> Sign up as a buyer from the console or the API, confirm your email, and keep the root key safe. Nothing is created until the address is confirmed.

## From the console

1. Open [console.zanora.dev](https://console.zanora.dev/#signup) and choose **Buyer**.
2. Enter your email, organisation name and a password.
3. Click the link in the email. The console confirms the address, creates your workspace, and shows the **root API key once**.

You can now sign in to the console with your email and password, and use the key from code.

## From the API

```bash
curl -s -X POST https://api.zanora.dev/v1/signup -H 'content-type: application/json' -d '{
  "role": "buyer",
  "email": "eng@northwind.example",
  "organizationName": "Northwind",
  "dailyBudgetMinor": "50000",
  "password": "optional — enables console sign-in"
}'
```

| Field | Required | Meaning |
|---|---|---|
| `role` | yes | `"buyer"` |
| `email` | yes | where the confirmation link goes |
| `organizationName` | yes | shown in the console and on approvals |
| `dailyBudgetMinor` | no | the workspace's daily spending cap, in cents (`"50000"` = $500) |
| `password` | no | lets you sign in to the console. It only takes effect once the email is confirmed |
| `website` | no | your organisation's site |

The response is `202` with a `signupId`. **Nothing exists yet.** The link in the email carries a single-use token that expires after 24 hours. Opening it (or `POST /v1/signup/verify` with `{"token":"…"}`) creates the workspace and returns:

```json
{
  "signupId": "sgn_…",
  "role": "buyer",
  "status": "completed",
  "tenant": { "kind": "workspace", "id": "wsp_…", "name": "Northwind" },
  "credential": { "keyId": "akey_…", "token": "zk.akey_….…", "label": "…", "scopes": ["…"] }
}
```

> **Warning — Save the token now:**
>
> `credential.token` is shown once. Only a hash of it is stored, so a lost key is replaced, never recovered.

### Didn't get the email?

```bash
curl -s -X POST https://api.zanora.dev/v1/signup/resend -H 'content-type: application/json' \
  -d '{"role":"buyer","email":"eng@northwind.example"}'
```

Resending invalidates the previous link. The response is the same whether or not the address is known, so this can't be used to find out who has an account.

## After signing up

- Run `GET /v1/whoami` with the key to confirm it works.
- **Mint narrower keys** for each agent or service, and keep the root key for setup. See [Accounts and API keys](https://docs.zanora.dev/concepts/accounts-and-keys.md).
- Next: [create a wallet for your agent](https://docs.zanora.dev/buyers/wallets.md).