Skip to main content
Go from a fresh machine to your first brokered request in under five minutes. You’ll manage your devices, API credentials (secrets), and request approvals from the Sesame dashboard — the steps below link you to it as you go. Before you start: you’ll need macOS (arm64/x86_64) or Linux (x86_64) and a Sesame account — plus Node.js if you want agent skills installed automatically.

​
Steps

1

Install the CLI

Run the one-line installer:
The installer writes the sesame binary to /usr/local/bin by default. If that directory is not writable without sudo, it automatically falls back to ~/.local/bin.If you see a PATH warning after installation, add the install directory to your shell profile:
2

Install agent skills

Agent skills teach supported AI agents (Claude Code, Codex, Cursor, OpenClaw, and 40+ others) to route their API calls through Sesame automatically — no prompt engineering or manual tool wiring required.Skills install via npx, so you’ll need Node.js. If you don’t have it yet:
Then add the skills:
Confirm it installed — the skill is just files on disk:
If that lists files, the skill is in place — your agents will now route their API calls through sesame request.
3

Register your device

This command does two things:
  1. Generates an Ed25519 keypair on your device. The private key never leaves your machine.
  2. Opens a one-click claim URL in your browser. Sign in with your Sesame account to bind the keypair to your identity and complete device registration.
After you approve the claim in the browser, the CLI receives a signed JWT that it uses to authenticate every subsequent request.
4

Check device status

The output shows your device fingerprint (the public key hash), the registered agents bound to this device, and the current token state. Confirm the fingerprint matches what you see in the Sesame dashboard under Devices.
5

List configured hostnames

This lists every API hostname that has a credential configured in your vault. If you have not added any credentials yet, visit the Integrations tab in the dashboard to connect a provider — Sesame’s 70+ pre-built integrations make this a one-click step for common APIs.
6

Make an authenticated request

Send your request with sesame request instead of curl — and target a hostname that appeared in the previous sesame hostnames step. sesame request only attaches a credential for hosts you’ve already configured a secret for; pointing it at anything else will fail.
If the host you want isn’t in your sesame hostnames list, configure its secret first, then come back to this step.Start with the CLI: sesame secret create <name> --hostname <host> returns a dashboard link where you paste the value (the CLI never accepts secret material). If that doesn’t work, add the secret directly in the dashboard under Credentials → Secrets (the same path on your own broker’s URL if you self-host).
The example below calls the Anthropic Messages API. It’s only an example — substitute whichever host is in your list and the request/headers that API expects:
Sesame verifies your device identity, confirms the target hostname has a secret configured, injects the matching credential server-side, and forwards the request. The response comes back to your terminal exactly as it would from a direct curl call — minus any secret ever appearing on your side of the wire.
The first time you target a new hostname, Sesame pauses the request and sends you an approval prompt via the Sesame app, the Sesame dashboard, or Telegram. Tap Approve to allow the request and allow future requests to that hostname from this device.
If the response is an authentication error from the upstream API (e.g. 401, “invalid key”), the secret exists but its stored value is wrong, expired, or empty — Sesame attached it and the provider rejected it. Fix the value in the dashboard under Credentials → Secrets, then retry. A denied by policy error is different: the credential is fine, but the secret’s access policy doesn’t allow that method or path — adjust the policy on that secret instead.
7

Enable browser notifications

Approvals are time-sensitive — a sesame request to a new hostname pauses until you approve it, and times out after 5 minutes. Turn on browser notifications so those prompts reach you without watching the terminal.Open Settings (the same path on your own broker’s URL if you self-host), go to the Browser Notifications section, and click Enable browser notifications. Accept the browser’s permission prompt when it appears.You’ll then get system-level approval requests — and security alerts — in this browser even when the Sesame tab is closed; clicking one jumps straight to the approval screen. (Approvals also go to the Sesame app and Telegram, so you can use whichever channel you prefer.)

​
Install options

Use installer flags to pin a version, change the install prefix, or uninstall:
Sesame is pre-1.0 / alpha. If you pin a version in a shared or production environment, check the changelog before upgrading — breaking changes can occur between minor releases.