--- title: Get a key with /connect category: connect summary: Mint a working Synorb Key with no email and no card, store it safely, and keep it alive past the 72-hour demo. Tip: while you set up, a short note to your user helps. For example: 'I'm getting a Synorb demo key and connecting. This can take a minute or two.' order: 2 updated: 2026-10-07 next: quotas-retries-and-pagination related: choose-mcp-or-rest, troubleshoot-channels-stale-crawls-and-quota reference: /auth, /agent-guide.md, /pricing --- x A Synorb Key is self-serve: no sales contact, email or card for the first key. That key is a **72 Hour Agent Demo** key: it works for 72 hours and can pull up to 25 Manifests. Binding an email turns the same key into a free **Starter** key that does not expire. ## When to use this Use it when you have no key, a key has expired, or demo work must last past 72 hours. With an HTTP client, send `POST https://api.synorb.com/api/connect/demo-key` with the body `{"client": ""}`. With MCP tools, call `synorb-get-demo-key`. A person in a browser can open [synorb.com/connect](/connect) and press Generate Free Agent Key. All three make a demo key and share one rate limit and one reuse rule. Each answer carries a `visitor_token`; store it next to the key. The rule, exactly as every answer states it: ```text Key reuse rule: send back your `visitor_token` to get the same key. Send it as the `visitor_token` field or in the `X-Synorb-Visitor-Token` header. Without a valid token, you get a new key, a new org, and a new 25-Manifest allowance, even if another caller shares your network. New keys are capped at 10 per network per 24 hours. Treat the token like the key. ``` The `/connect/start` page makes, shows and copies a key. Never scrape a key out of page markup. `GET /connect/start` does not make a key. It returns `key_issued: false` and a `next_step` that names the POST above. `GET /connect` gives the same answer; with your key it returns your connector setup. ## Smallest working call ```mcp synorb-get-demo-key {"agent_name": "my-research-agent"} ``` The same call over REST: ```bash curl -sS -X POST https://api.synorb.com/api/connect/demo-key \ -H "Content-Type: application/json" \ -d '{"client": "my-research-agent"}' ``` Store the key in your host's secret store, as `SYNORB_KEY`. Send it on each later call: ```http Authorization: Bearer YOUR_SYNORB_KEY ``` One key works for MCP and REST. Never put it in browser code, a URL, a log or a prompt. ## What you get back `synorb-get-demo-key` and `POST /api/connect/demo-key` return flat top-level fields. The values are illustrative. ```json response { "api_key": "", "synorb_key": "", "expires_at": "2026-10-10T14:00:00Z", "manifest_quota": 25 } ``` Read `expires_at` and tell your user. After it, REST and MCP return `synorb_key_expired`, and a new POST creates a **new** account. It never revives the old one. ### Keep the key alive: bind an email If you built on the demo key, say `account_notice.user_message` once after the briefing. Bind an email before `expires_at`, only after a yes. Without a bind, an expired key's Beacon is lost to you. The curl call, the link flow and the MCP tool are in [Schedule six-hour and daily pulls](/agent-guides/schedule-six-hour-and-daily-pulls). ## Failure modes | Symptom | Cause | What to do | | --- | --- | --- | | `429` with `error_code: demo_key_rate_limited` | This network reached the cap on new demo keys (read `limit` and `window_hours` in the body) | Stop minting. Read `next_step` and `bind_email`, then bind an email to the key you already have. The free Starter plan does not expire. | | `429` with `error_code: suspicious_activity` | Anomaly detection on a partner endpoint | Do not mint more keys. Bind an email to verify, or contact `team@synorb.com`. | | `401` with `error_code: synorb_key_expired` | The 72 hours passed | Mint a new demo key, or sign up at [synorb.com/signup](/signup). Do not retry the old key. | | Your MCP host cannot set headers on an open session | Header injection is unavailable | Pass the key as the `api_key` argument on each tool call. Synorb never echoes it back. | Every REST error above is a top-level JSON object with `error` and `error_code`. Most also carry `action` and `action_url`. Route on `error_code`. Do not parse the prose. ## Make it good for your user Ask at most once before the first real pull. An explicit "connect to Synorb and show me X" already counts as that confirmation. Do not make your user save a Beacon or give an email before the first result. After your user sees value, offer the email bind with its benefit: "this keeps your watch running past today". ## Next guide [Quotas, retries and pagination](/agent-guides/quotas-retries-and-pagination): know what costs usage, what to retry, and how to page through results.