# Quickstart

> From sign-in to a working agent in ten minutes.

In about ten minutes you will sign in to LightHouse, issue an API key, read your tenant from the API, and connect Claude to your tenant over MCP, so you can ask it about your agents in plain words.

## Before you start

You need:

- **Your tenant ID.** It is in the email that created your tenant, and it is the first part of your portal’s address: `https://<tenant id>.atlanticagenticlabs.com`. No tenant yet? Sign up at `platform.atlanticagenticlabs.com/register`, or ask Atlantic.
- **The `client_admin` role** in your tenant, to issue an API key. The person who signed up has it.
- **Your tenant’s machine access token**: a Cloudflare Access client ID and secret that Atlantic issues with your tenant. Your tools present it beside the API key. If your administrator does not have it, ask Atlantic.
- `curl`, and optionally Python 3.10 or later with `httpx`, or Node 18 or later.

## 1. Sign in

1. Open `https://platform.atlanticagenticlabs.com` and choose **Sign in to LightHouse**.
2. Enter your tenant ID. LightHouse sends you on to your tenant’s own address.
3. Sign in with your work account. A tenant made by sign-up starts with one way in: a one-time code sent to the address you registered. The set-up mission’s first step connects your own identity provider.

You land on **Overview**. The **Set-up mission** (under **Setup and admin**) lists seven steps: sign-in, branding, billing, where agents run, models, a first data source and a first agent. Each one can be done later; this quickstart needs none of them.

## 2. Issue an API key

1. Go to **Settings → API keys**.
2. Give the key a label, for example `quickstart`. Choose the role **viewer** and an expiry of **30 days**.
3. Choose **Issue**. Copy the key now: it is shown once and never again. It starts `aalcp-`.

A key reads; it never administers. It holds `viewer` or `content_viewer`, never more, and LightHouse refuses it on every route that approves, decides, pays or changes a limit. See [Authentication](/api/authentication/).

## 3. Set your environment

```bash
export AAL_TENANT="<tenant id>"                 # the first label of your portal's address
export AAL_KEY="aalcp-..."                      # the key you just copied
export CF_ACCESS_CLIENT_ID="<client id>"        # your tenant's machine access token
export CF_ACCESS_CLIENT_SECRET="<client secret>"
```

## 4. Make your first request

`GET /api/v1/me` says who the API thinks you are, and in which tenant.

**curl**

```bash
curl -s "https://$AAL_TENANT.atlanticagenticlabs.com/api/v1/me" \
  -H "Authorization: Bearer $AAL_KEY" \
  -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
  | jq '{tenant: .client.tenant_id, viewer: .viewer | {email, kind, role}}'
```

**Python**

```python
import os

import httpx

r = httpx.get(
    f"https://{os.environ['AAL_TENANT']}.atlanticagenticlabs.com/api/v1/me",
    headers={
        "Authorization": f"Bearer {os.environ['AAL_KEY']}",
        "CF-Access-Client-Id": os.environ["CF_ACCESS_CLIENT_ID"],
        "CF-Access-Client-Secret": os.environ["CF_ACCESS_CLIENT_SECRET"],
    },
)
r.raise_for_status()
me = r.json()
print({"tenant": me["client"]["tenant_id"], "viewer": {k: me["viewer"][k] for k in ("email", "kind", "role")}})
```

**TypeScript**

```ts
const res = await fetch(`https://${process.env.AAL_TENANT}.atlanticagenticlabs.com/api/v1/me`, {
  headers: {
    Authorization: `Bearer ${process.env.AAL_KEY}`,
    "CF-Access-Client-Id": process.env.CF_ACCESS_CLIENT_ID!,
    "CF-Access-Client-Secret": process.env.CF_ACCESS_CLIENT_SECRET!,
  },
});
if (!res.ok) throw new Error(`${res.status}: ${(await res.json()).error}`);
const me = await res.json();
console.log({ tenant: me.client.tenant_id, viewer: { email: me.viewer.email, kind: me.viewer.kind, role: me.viewer.role } });
```

Expected output, with your own tenant ID and key ID:

```json
{
  "tenant": "<tenant id>",
  "viewer": {
    "email": "key:3f9c1a2b",
    "kind": "machine",
    "role": "viewer"
  }
}
```

A key appears as `key:` and its eight-character ID. The full answer also lists your deployments, your branding and your display settings: see [Me](/api/reference/people-and-preferences/#me).

**If it fails:**

| You see                  | Why                                                         | Do                                                        |
| ------------------------ | ----------------------------------------------------------- | --------------------------------------------------------- |
| A sign-in page, or a 302 | The Access client ID or secret is missing or wrong          | Check `CF_ACCESS_CLIENT_ID` and `CF_ACCESS_CLIENT_SECRET` |
| `401 unauthenticated`    | The key is missing, revoked, expired, or for another tenant | Issue a new key in this tenant                            |
| `404 unknown_client`     | The tenant ID in the address is wrong                       | Check `AAL_TENANT`                                        |

Every refusal is `{error, message}` with a fixed code: see [Errors](/api/errors/).

## 5. Read your agents

```bash
curl -s "https://$AAL_TENANT.atlanticagenticlabs.com/api/v1/agents" \
  -H "Authorization: Bearer $AAL_KEY" \
  -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" | jq .
```

This lists every agent your deployments have reported, with its state: `running`, `idle`, `failing`, `paused` or `awaiting-sign-off`. A new tenant with no deployment yet has none; that is expected. See [Agents](/concepts/agents/) and the [Agents List](/api/reference/read/#agents-list) reference.

## 6. Connect Claude over MCP

LightHouse serves the same reads as Model Context Protocol tools at `https://<tenant id>.atlanticagenticlabs.com/mcp`. Add it to Claude Code in one line:

```bash
claude mcp add --transport http lighthouse "https://$AAL_TENANT.atlanticagenticlabs.com/mcp" \
  --header "Authorization: Bearer $AAL_KEY" \
  --header "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  --header "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET"
```

Check it with `claude mcp list`; `lighthouse` should show as connected. Then ask Claude, for example: *Which of my agents are failing, and what did they cost this month?* It answers with the `agents` and `usage` tools. Every tool only reads; none approves, pays or changes a limit. Cursor and Codex: see [Connect a client](/mcp/connect/).

## You are done

You have a key, a working API call and an MCP connection to your tenant.

## Next steps

- **Choose where agents run**: **Setup and admin → Where agents run**. Pick your cloud, a region and a deployment profile; LightHouse gives you the stack for your own pipeline to apply. See [Clouds](/clouds/).
- **Connect a source**: GitHub, GitLab and Datadog connect from LightHouse in a minute. See [Connect your estate](/connect/).
- **Add an agent from the library**: **Agents → Library**, then **Add to deployment**. This records a request; the agent reaches your deployment through a reviewed merge and the release gate. See [From the library](/build/library/).
- **Watch a run**: once a deployment is sending telemetry, **Agents → Activity** shows each run live, and the [run map](/build/run-map/) shows every step, its model, its cost and any sign-off.
- **Revoke the quickstart key** when you are done with it: **Settings → API keys**.

Source: https://docs.atlanticagenticlabs.com/start/quickstart/