Tenzro Labs
Tutorial 04 · Platform API · MCP server

Create an agent

An agent gets its own identity and wallet under yours. You decide what it may do and spend, and approve that with your passkey.
Step 01

How an agent is made

An agent is an identity under yours, did:tenzro:machine:<your id>:<agent id>, with its own wallet on the Tenzro Network. It is always delegated by your passkey. The Platform, an API key or an MCP client can propose an agent or a change to one; only you can approve it.

1. Propose
You, your app or your assistant
Name, capabilities, limits and an optional expiry. The Platform returns an approve_url.
2. Approve
You, with your passkey
On your Tenzro Labs account you review the settings, adjust them if you like, and approve. The Tenzro Network registers the agent under your identity.
3. Active
The Platform
It collects the result. The settings you approved are the ones that apply.
4. Operate
The agent
Calls models with an API key you create for it, within the approved limits. Tutorial 05 covers this.
  • The agent runs on serving nodes of the Tenzro Network, run by independent operators. Tenzro Labs picks them; you never manage a node.
  • Each serving node holds its own key for the agent and signs the agent's actions itself, so within the approved limits there are no further prompts.
  • Nothing but you can widen those limits later: not the Platform, not the serving nodes, not the agent. Anything outside them is refused with an explicit error, never partly done.
Step 02

Have your Tenzro identity ready

Agents live under your Tenzro identity. It is created when you sign up for a Tenzro Labs account: your passkey becomes your did:tenzro:human:… identity and a passkey-controlled wallet. If you skipped that step, the Agents page offers Set up identity & wallet.

Check it with a Platform API key that has read, or the get_identity MCP tool.

shell
curl https://platform.tenzro.xyz/api/identity -H "Authorization: Bearer $TENZRO_READ_KEY"
response
{
  "state": "ready",
  "did": "did:tenzro:human:e0b27720-3043-84d5-9b66-49eba92b1a8d",
  "wallet_address": "0xd8aa2ca0a3b56be2b58d6c883c7b3ed31d749428",
  "error": null,
  "passkeys": 2,
  "can_send": true,
  "manage_url": "https://accounts.tenzro.xyz/wallet?return_to=…"
}

Until state is ready, proposing an agent is refused with 400 approval_refused: "Agents live under the account's Tenzro identity, which is not set up yet."

Step 03

Propose the agent

On the Platform

On the Agents page, name the agent, set its capabilities and limits, and press Continue to approval. You are taken to your Tenzro Labs account to approve.

Platform API

Use a Platform API key with the manage permission.

shell
curl https://platform.tenzro.xyz/api/agents \
  -H "Authorization: Bearer $TENZRO_MANAGE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "research-bot",
    "capabilities": ["inference"],
    "daily_limit_credits": 20000,
    "total_limit_credits": 500000,
    "expires_in_days": 90
  }'
response
{
  "approve_url": "https://accounts.tenzro.xyz/agents/approve/apr_3xQkV8mZp1LwRt2sN0cY",
  "agent": {
    "id": "agt_Zp3kQ9x1RmW4sT",
    "name": "research-bot",
    "status": "awaiting_approval",
    "approval": { "kind": "create", "state": "pending", "approve_url": "https://accounts.tenzro.xyz/agents/approve/apr_3xQkV8mZp1LwRt2sN0cY" },
    "limits": null,
    "proposed": {
      "agent_name": "research-bot",
      "capabilities": ["inference"],
      "max_transaction_tnzo": "",
      "max_daily_tnzo": "",
      "daily_limit_credits": 20000,
      "total_limit_credits": 500000,
      "expires_in_days": 90
    },
    "did": null,
    "serving": { "nodes": 3, "operators": 2 }
  }
}
name
string
Required. 1 to 64 lowercase letters, digits, dots, dashes or underscores. It cannot be changed later.
capabilities
inference | payments []
Default ["inference"]. payments also lets the agent transfer and pay for services on the network.
max_transaction_tnzo
string
The most the agent may pay in any one payment, in TNZO, for example "1.5".
max_daily_tnzo
string
The most the agent may pay per day, in TNZO.
daily_limit_credits
number
Tenzro Labs credits the agent may spend per UTC day.
total_limit_credits
number
Tenzro Labs credits the agent may spend in total.
expires_in_days
integer
1 to 3650. The delegation ends after this many days.

limits stays null until you approve: a proposal is never enforced. serving shows how many serving nodes, from how many independent operators, will run the agent.

MCP

With the MCP server connected on a manage key, the create_agent tool takes the same arguments and returns the same { approve_url, agent }. The assistant relays the link to you; it cannot approve for you.

tool call · create_agent
{
  "name": "research-bot",
  "capabilities": ["inference"],
  "daily_limit_credits": 20000,
  "total_limit_credits": 500000,
  "expires_in_days": 90
}
409 no_serving_nodes
The Tenzro Network has no nodes serving agents yet, so an agent cannot be created. The Agents page says the same. Agents can be created once the network has serving nodes.
503 network_unreachable
The Tenzro Network could not be reached to find serving nodes. Try again shortly.
400 invalid_request
A field is malformed: the name, a TNZO amount, a credit limit, the expiry or a capability.
A passkey cannot be pressed from code. Give approve_url to the person who owns the account. The link is valid for 30 minutes.
Step 04

Approve with your passkey

The approve_url opens on your Tenzro Labs account at https://accounts.tenzro.xyz. It shows the proposed settings, and you can change any of them before approving:

What it may do: Call models, Make payments
capabilities
Most it may spend in one payment (TNZO)
max_transaction_tnzo
Most it may spend in a day (TNZO)
max_daily_tnzo
Tenzro Labs credits per day
daily_limit_credits
Tenzro Labs credits in total
total_limit_credits
Expires after (days)
expires_in_days. Empty means no expiry; you can revoke it any time.
  • The page also says how many serving nodes from how many independent operators will run the agent.
  • Press Create with your passkey. Your passkey signs exactly the settings on the page, and the Tenzro Network registers the agent only against that signature.
  • You are then sent back to the agent's page on the Platform.
Step 05

Read the result

Reading the agent collects the outcome of its approval, so call it after the owner says they approved. Use GET /agents/{id} or the get_agent MCP tool.

shell
curl https://platform.tenzro.xyz/api/agents/agt_Zp3kQ9x1RmW4sT -H "Authorization: Bearer $TENZRO_READ_KEY"
response
{
  "id": "agt_Zp3kQ9x1RmW4sT",
  "name": "research-bot",
  "status": "active",
  "approval": null,
  "capabilities": ["inference"],
  "limits": {
    "max_transaction_tnzo": null,
    "max_daily_tnzo": null,
    "daily_limit_credits": 10000,
    "total_limit_credits": 500000,
    "expires_in_days": 90
  },
  "did": "did:tenzro:machine:e0b27720-3043-84d5-9b66-49eba92b1a8d:7c1d…",
  "wallet_address": "0x4b1f…",
  "serving": { "nodes": 3, "operators": 2 },
  "network_key_held": true,
  "approved_at": "2026-09-26T09:12:00.000Z",
  "expires_at": "2026-12-25T09:12:00.000Z",
  "spend": { "today_credits": 0, "total_credits": 0 }
}

Here the owner lowered the daily limit from 20,000 to 10,000 credits while approving: limits are always the approved values. The agent now has its identity (did) and wallet (wallet_address) on the Tenzro Network.

awaiting_approval
Proposed; waiting for the owner at approval.approve_url.
active
Registered on the network. approval is set while a change or revocation waits for the owner.
failed
The network refused it. error carries the network's reason word for word.
expired
The approval link expired before it was used. Start again on the Agents page.
revoked
Revoked on the network; its API keys no longer work.

GET /agents and the list_agents tool list every agent the same way, collecting outstanding approvals first.

Step 06

Change its limits

Propose new settings with POST /agents/{id}/settings, the update_agent MCP tool, or Change limits on the agent's page. Fields you leave out keep their approved values; the name cannot change.

shell
curl https://platform.tenzro.xyz/api/agents/agt_Zp3kQ9x1RmW4sT/settings \
  -H "Authorization: Bearer $TENZRO_MANAGE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"daily_limit_credits": 50000}'
response
{
  "approve_url": "https://accounts.tenzro.xyz/agents/approve/apr_9LmQ2cVx7RtK0pWs4NaE",
  "agent": {
    "id": "agt_Zp3kQ9x1RmW4sT",
    "status": "active",
    "approval": { "kind": "update", "state": "pending", "approve_url": "…" },
    "limits": { "daily_limit_credits": 10000, … }
  }
}
tool call · update_agent
{
  "agent_id": "agt_Zp3kQ9x1RmW4sT",
  "daily_limit_credits": 50000
}
  • Nothing changes until the owner approves at approve_url with their passkey. Until then the agent keeps working under its current limits.
  • Only one change can wait at a time; another is refused with 409 approval_pending.
  • Only an active agent can be changed; otherwise 409 agent_not_active.
Step 07

Revoke it

Propose revoking with POST /agents/{id}/revoke, the revoke_agent MCP tool, or Revoke this agent on the agent's page. It returns { approve_url, agent } like a change.

shell
curl -X POST https://platform.tenzro.xyz/api/agents/agt_Zp3kQ9x1RmW4sT/revoke -H "Authorization: Bearer $TENZRO_MANAGE_KEY"

Once the owner approves with their passkey, the agent's identity is revoked on the Tenzro Network, every serving node drops its key, and every token and Platform API key it holds stops working at once. It cannot be undone.

List agents
GET /agents
list_agents
Get an agent and its spend
GET /agents/{id}
get_agent(agent_id)
Propose an agent
POST /agents
create_agent
Propose new limits
POST /agents/{id}/settings
update_agent(agent_id, …)
Propose revoking
POST /agents/{id}/revoke
revoke_agent(agent_id)
Create an API key for an agent
POST /agents/{id}/keys
create_agent_key(agent_id, name?)

Paths are relative to https://platform.tenzro.xyz/api. Reading needs read; everything else needs manage. Every proposal is approved by the owner's passkey.