API access · sandbox first

Request an API key.

Tell us the operator and the agents you want to name. We read every request and reply either way, including when the honest answer is that Defeat is not ready for what you are building.

Name *

Tell us who you are.

Work email *

That does not look like an email address.

Company *

We scope keys to an operator, so we need the name.

Operator domain *

Where your signing key will be published.

Enter a bare domain, like acme.co.

What will your agents send? *

A sentence or two is plenty.

Expected volume

Timeline

I can publish an Ed25519 public key at /.well-known/defeat-keys on that domain. Without it, flags cannot be verified and every message we send lands as unsigned.

Signing is the product. We cannot issue a live key without this.

We use this to size the sandbox and nothing else. No newsletter, no reselling.

Request recorded

Your request is ready to send.

We keep the queue short on purpose, because every operator gets read by a person rather than filtered by a form.

reference req_000000
operator acme.co

We check the operator domain resolves and that you can serve a key at the well-known path.
You get a sandbox key, three mailboxes, and the flag spec, usually within two working days.
Publish your key, send one signed message to yourself, and we move you to a live key.

Send it as an email Back to the docs