Quickstart

The first loop runs entirely in the console, before any client is connected. You link Telegram, put a key in the vault, press the test call, and answer the card that arrives.

1. Link the place you want to be asked

Telegram first, because it takes one message and it works on a phone. The console also shows every waiting card live, and email carries a deep link to the same screen. A decision is only ever taken on an authenticated surface: the notification itself holds no secrets and no bodies.

2. Put a credential in the vault

Paste the key once. The console shows the recipe it matched, the hosts it covers, and which paths that recipe classes as write and destructive. From that moment the value has no read path: not for you, not for us, not over the API.

3. Make the test call

POST demo.sallyport.cloud/echo
{ "hello": "sallyport" }

The demo recipe classes POST /echo as a write, so the gateway asks. The card lands in Telegram with the exact call on it. Approve it and the echo answers, with the record of both already in your journal.

4. Connect the first agent

sp init

It finds the clients on your machine and writes their config. It imports the keys it finds in a local .env if you let it. It adds a short block to CLAUDE.md and AGENTS.md, so the agent knows its services before it tries one.

Revoke the originals when you are done. The point of the exercise is that the only copy of that key is the one in the vault.