Agent sign-in

New to Prized? Your coding agent makes your account with your email address and a 6-digit code, and gets an API key.

On this page6

Start
What happens
The key
Boxes and billing
For agent builders
Troubleshooting

Start

Tell your agent:

Prompt

Sign me up for Prized with my email address by following https://prized.dev/auth.md, then start a box for me.

Prized emails you a 6-digit code; give it to your agent. The code makes your account, with the free credit and no card, and the agent gets an API key for the API and the CLI (prized login --url https://api.prized.dev --token-stdin).

Already on Prized? Agent sign-in only makes new accounts. Make your agent a key under Settings → API keys instead.

What happens

Step	What happens
The email	"Your Prized agent code": the code, a warning that the requester is unverified, what sharing the code permits, and where the request came from. It lasts 15 minutes and allows five tries.
The account	Named after you when the agent knows your name, in a workspace of its own. To join your company's workspace, open its invite link.
Later sign-ins	Google or GitHub on the same address opens the same account.

The key

The agent's. Listed under Settings → API keys by the agent's self-reported name, marked as an agent's key. The name is a label, not a verified identity. Revoke it there; the agent can also revoke it itself.
Limited. It starts, stops and uses boxes and reads the workspace; no secrets (What a key can do).
Expires. After 90 days; make the agent a new one under Settings → API keys.

Sandboxes. The key also creates and uses sandboxes. On the free credit they run within the free tier; a top-up or a plan lifts it. Each sandbox it creates is a sandbox.create row on the audit log naming the key, as each box it creates is a box.create row.

Boxes and billing

The agent can start a Small on the free credit right away. The credit comes once per inbox: you+work@gmail.com is you@gmail.com. Medium and larger need a plan, which you start under Settings → Billing. Agents read prices from pricing, never from memory.

For agent builders

Save the verified key with prized login --url https://api.prized.dev --token-stdin: start the CLI with your process runner, write the key plus a newline directly to its standard input, then close that input. Never embed it in process arguments, shell command strings (including inline scripts and here-documents), environment variables, or tool logs. Linux process arguments may be readable by other local users. If your tool cannot supply standard input without logging the key, ask the person to run the interactive CLI login instead.

prized.dev/auth.md is the contract. Call the API's own origin, https://api.prized.dev. Keep the explicit --url when logging the CLI in: without it, the CLI sends the key to its configured control plane (or the production API by default) before saving it. For a preview or local deployment, use the API origin in that deployment's /auth.md, not the web origin.

Route	What it does
`POST /api/v1/agent/sign-up`	`{email, name?, personName?}`, no credential: the key, unverified, and the emailed code. The same answer whether or not the address has an account.
`POST /api/v1/agent/verify`	`{code}` with the key as bearer: the account and a working key, or `409 sign_in_required` if the address already had an account.
`DELETE /api/v1/agent/key`	The key as bearer: it stops working.

While a code is live, signing up again answers 409 code_pending. The email never includes the caller-supplied agent name, even for well-known tools. A name does not authenticate the requester. Throwaway and placeholder domains are refused. Limits: 10 sign-ups and 5 codes an hour per network, 5 codes a day per inbox, and a few credited new accounts a day per network.

Troubleshooting

Symptom	What to do
No email	Check spam. A new code goes out only after the last one expired, five a day at most.
`code_expired`	Older than 15 minutes, or tried five times. The agent asks for a new one.
`sign_in_required`	You already have an account: sign in at prized.dev and make a key under Settings → API keys.
The agent cannot reach auth.md	Run `prized login` yourself, or give the agent a key from Settings → API keys.
A key you did not expect	Revoke it under Settings → API keys.