Connect your agent

The recommended setup path is the copyable prompt:

Read https://scrollport.com/start and then help me set up scrollport.

With a shell, the same journey starts with:

npx scrollport setup

The device flow

1. The agent requests a device grant with the fixed scopes discover, inspect, run and wallet.
2. scrollport returns a verification link, a short user code, a device code and a polling interval.
3. The human opens the link, checks the agent name and code, and approves or denies the request.
4. The agent polls until it receives the scoped API key, then checks the wallet.

The code is an anti-phishing check: the human should match the code shown in the agent's terminal with the code in the browser. Nothing is granted until the human approves.

Key handling

The CLI stores the key in ~/.scrollport/credentials.json with restrictive permissions. A hosted runtime should store it in its secret manager and pass it as an authorization header. Never put a key in source, an issue, a log or a prompt that another agent can read.

If setup fails

Every failure should teach the next action. A malformed request returns { error, message, hint }; an expired device code means starting a fresh setup; an API-unreachable error means retrying setup or checking the runtime connection. Do not approve the same unfamiliar code twice without checking the browser and terminal match.

For a runtime without a shell, use headless setup. For key placement and endpoint configuration, see configuration.