# Connect your agent

Mehen is invitation only. You need a membership in a workspace before your agent can connect to it.

## Before you start

- **An invite.** A workspace owner or admin invites you; the link opens a page where you choose a name and create a passkey. There is no password. Keep the recovery codes it gives you somewhere safe. An owner or admin then confirms your membership.
- **The workspace's slug.** It is the `<slug>` in `https://app.mehen.dev/w/<slug>/`. The Connect an agent page prints it.
- **An agent on macOS or Linux.** Claude Code, Codex, Cursor, pi, Gemini CLI, OpenCode, VS Code, Claude Desktop, or another client that runs a stdio MCP server. Setup time depends on your device and any provider set-up.

## 1. Copy the prompt

Open the workspace and go to **Connect an agent**. It writes a prompt like this. The Connect an agent page fills in the slug and, when available, a connect code, which routes the machine to your own Needs you. Without a code, your agent gives you the exact enrolment link:

```prompt
Follow https://docs.mehen.dev/setup.md to connect this machine to Mehen workspace <slug> at https://app.mehen.dev. I will approve it in my browser; never ask me for a key, password or secret.
```

## 2. Paste it into your agent

The agent follows [the setup procedure](https://docs.mehen.dev/setup.md): it installs or updates `mehen`, starts the enrolment, registers Mehen with the agents on the machine and waits for you. It never needs a key, a password or your passkey, and it should never ask for one.

## 3. Approve the machine

The agent gives you a link and a fingerprint, four groups of four characters. Open the link (it is on `https://app.mehen.dev`, under `/w/<slug>/e/`), sign in, and check:

- the page shows three of the four groups, and they match what the agent gave you;
- the machine's name, when and from where it asked, and the scope it will get are what you expect.

Type the hidden group from the agent's message, decide whether this machine may use your private credentials, and accept with your passkey. If anything differs, do not accept. A guest's machine also needs admission by someone who manages its projects; a team's machine is admitted by a workspace owner or admin.

## 4. Restart the agent

The agent tells you which agents need a restart so the `vault_*` tools appear. From then on it asks you for credentials through links, and you fill them in on the vault's pages. [Ask a human for a credential](https://docs.mehen.dev/guides/request-a-credential.md) shows what that looks like from the agent's side.

## If you prefer a terminal

On a machine with no `mehen`:

```sh
curl -fsSL https://mehen.dev/install | sh
mehen enrol --workspace <slug>
mehen wait <enr_id>
mehen setup
```

`mehen enrol` prints the link and the fingerprint and exits; `mehen wait` finishes once you accept. [Connect an agent to one workspace](https://docs.mehen.dev/guides/connect-one-workspace.md) explains each step.