Quickstart

View as Markdown

In about ten minutes you will sign in to LightHouse, issue an API key, read your tenant from the API, and connect Claude to your tenant over MCP, so you can ask it about your agents in plain words.

Before you start

You need:

Your tenant ID. It is in the email that created your tenant, and it is the first part of your portal’s address: https://<tenant id>.atlanticagenticlabs.com. No tenant yet? Sign up at platform.atlanticagenticlabs.com/register, or ask Atlantic.
The client_admin role in your tenant, to issue an API key. The person who signed up has it.
Your tenant’s machine access token: a Cloudflare Access client ID and secret that Atlantic issues with your tenant. Your tools present it beside the API key. If your administrator does not have it, ask Atlantic.
curl, and optionally Python 3.10 or later with httpx, or Node 18 or later.

Open https://platform.atlanticagenticlabs.com and choose Sign in to LightHouse.
Enter your tenant ID. LightHouse sends you on to your tenant’s own address.
Sign in with your work account. A tenant made by sign-up starts with one way in: a one-time code sent to the address you registered. The set-up mission’s first step connects your own identity provider.

You land on Overview. The Set-up mission (under Setup and admin) lists seven steps: sign-in, branding, billing, where agents run, models, a first data source and a first agent. Each one can be done later; this quickstart needs none of them.

2. Issue an API key

Go to Settings → API keys.
Give the key a label, for example quickstart. Choose the role viewer and an expiry of 30 days.
Choose Issue. Copy the key now: it is shown once and never again. It starts aalcp-.

A key reads; it never administers. It holds viewer or content_viewer, never more, and LightHouse refuses it on every route that approves, decides, pays or changes a limit. See Authentication.

3. Set your environment

export AAL_TENANT="<tenant id>"                 # the first label of your portal's address
export AAL_KEY="aalcp-..."                      # the key you just copied
export CF_ACCESS_CLIENT_ID="<client id>"        # your tenant's machine access token
export CF_ACCESS_CLIENT_SECRET="<client secret>"

4. Make your first request

GET /api/v1/me says who the API thinks you are, and in which tenant.

curl -s "https://$AAL_TENANT.atlanticagenticlabs.com/api/v1/me" \
  -H "Authorization: Bearer $AAL_KEY" \
  -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
  | jq '{tenant: .client.tenant_id, viewer: .viewer | {email, kind, role}}'

import os

import httpx

r = httpx.get(
    f"https://{os.environ['AAL_TENANT']}.atlanticagenticlabs.com/api/v1/me",
    headers={
        "Authorization": f"Bearer {os.environ['AAL_KEY']}",
        "CF-Access-Client-Id": os.environ["CF_ACCESS_CLIENT_ID"],
        "CF-Access-Client-Secret": os.environ["CF_ACCESS_CLIENT_SECRET"],
    },
)
r.raise_for_status()
me = r.json()
print({"tenant": me["client"]["tenant_id"], "viewer": {k: me["viewer"][k] for k in ("email", "kind", "role")}})

const res = await fetch(`https://${process.env.AAL_TENANT}.atlanticagenticlabs.com/api/v1/me`, {
  headers: {
    Authorization: `Bearer ${process.env.AAL_KEY}`,
    "CF-Access-Client-Id": process.env.CF_ACCESS_CLIENT_ID!,
    "CF-Access-Client-Secret": process.env.CF_ACCESS_CLIENT_SECRET!,
  },
});
if (!res.ok) throw new Error(`${res.status}: ${(await res.json()).error}`);
const me = await res.json();
console.log({ tenant: me.client.tenant_id, viewer: { email: me.viewer.email, kind: me.viewer.kind, role: me.viewer.role } });

Expected output, with your own tenant ID and key ID:

{
  "tenant": "<tenant id>",
  "viewer": {
    "email": "key:3f9c1a2b",
    "kind": "machine",
    "role": "viewer"
  }
}

A key appears as key: and its eight-character ID. The full answer also lists your deployments, your branding and your display settings: see Me.

If it fails:

You see	Why	Do
A sign-in page, or a 302	The Access client ID or secret is missing or wrong	Check `CF_ACCESS_CLIENT_ID` and `CF_ACCESS_CLIENT_SECRET`
`401 unauthenticated`	The key is missing, revoked, expired, or for another tenant	Issue a new key in this tenant
`404 unknown_client`	The tenant ID in the address is wrong	Check `AAL_TENANT`

Every refusal is {error, message} with a fixed code: see Errors.

5. Read your agents

curl -s "https://$AAL_TENANT.atlanticagenticlabs.com/api/v1/agents" \
  -H "Authorization: Bearer $AAL_KEY" \
  -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" | jq .

This lists every agent your deployments have reported, with its state: running, idle, failing, paused or awaiting-sign-off. A new tenant with no deployment yet has none; that is expected. See Agents and the Agents List reference.

6. Connect Claude over MCP

LightHouse serves the same reads as Model Context Protocol tools at https://<tenant id>.atlanticagenticlabs.com/mcp. Add it to Claude Code in one line:

claude mcp add --transport http lighthouse "https://$AAL_TENANT.atlanticagenticlabs.com/mcp" \
  --header "Authorization: Bearer $AAL_KEY" \
  --header "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  --header "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET"

Check it with claude mcp list; lighthouse should show as connected. Then ask Claude, for example: Which of my agents are failing, and what did they cost this month? It answers with the agents and usage tools. Every tool only reads; none approves, pays or changes a limit. Cursor and Codex: see Connect a client.

You are done

You have a key, a working API call and an MCP connection to your tenant.

Next steps

Choose where agents run: Setup and admin → Where agents run. Pick your cloud, a region and a deployment profile; LightHouse gives you the stack for your own pipeline to apply. See Clouds.
Connect a source: GitHub, GitLab and Datadog connect from LightHouse in a minute. See Connect your estate.
Add an agent from the library: Agents → Library, then Add to deployment. This records a request; the agent reaches your deployment through a reviewed merge and the release gate. See From the library.
Watch a run: once a deployment is sending telemetry, Agents → Activity shows each run live, and the run map shows every step, its model, its cost and any sign-off.
Revoke the quickstart key when you are done with it: Settings → API keys.