1. Grab a key. Use a starter key (Overview) or create one in a workspace. Send it as Authorization: Bearer ekam_sk_….
2. Create an agent. Define a blueprint, then mint an agent — it's owned by you.
   Copy

   curl -s $BASE/v1/blueprints -H "authorization: Bearer $KEY" -H 'content-type: application/json' \
     -d '{"name":"bot","scopes":["models:invoke"],"allowedAudiences":["https://your-gateway.example"],"tokenTtlSeconds":900}'
   curl -s $BASE/v1/agents -H "authorization: Bearer $KEY" -H 'content-type: application/json' \
     -d '{"blueprintId":"bp_…","name":"my-agent"}'

3. Broker a token. Get a short-lived, scoped, audience-bound token for the agent.
   Copy

   curl -s $BASE/oauth/token -H "authorization: Bearer $KEY" -H 'content-type: application/json' \
     -d '{"grant_type":"urn:ietf:params:oauth:grant-type:token-exchange","agent_id":"agt_…","resource":"https://your-gateway.example","scope":"models:invoke"}'

4. Verify it offline. Your gateway validates the ES256 JWT against the JWKS — no call back to Ekam. Or try the Playground.

Full walkthrough: docs · copy-paste recipes: cookbook · for agents: llms-full.txt.