# Flottix Agent Quickstart

> Get an AI agent (Claude, Codex, Cursor, Antigravity, pi, Cline, Gemini CLI,
> any MCP client) operating your IT asset registry in under a minute.

## 1. Create an API key

In the dashboard (https://flottix.app): **Agents** (sidebar) → name your key → *Create key*.
Default preset **Read/Write** grants every `read:*`, `write:*` and `checkout:*`
scope — enough to operate the whole registry. **Full Access** adds the `admin`
scope (bypasses all checks: user management, API keys, org settings).

The raw key (`flottix_...`) is shown **once**, with ready-to-paste configs.

Via REST instead:

```bash
curl -X POST https://flottix.app/api/v1/api-keys \
  -H "Authorization: Bearer <session>" -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "scopes": ["read:assets", "write:assets"]}'
```

## 2. Connect your client

The MCP endpoint is native remote (Streamable HTTP) — no bridge, no extra process.

**Cursor / VS Code / Cline / Antigravity** (`mcp.json`):

```json
{
  "mcpServers": {
    "flottix": {
      "url": "https://flottix.app/api/mcp",
      "headers": { "Authorization": "Bearer flottix_YOUR_KEY" }
    }
  }
}
```

**Claude Code** (one-liner):

```bash
claude mcp add --transport http flottix https://flottix.app/api/mcp \
  --header "Authorization: Bearer flottix_YOUR_KEY"
```

**Any client** — plain MCP over HTTP with the same URL + `Authorization` header.
Prefer short-lived tokens? Exchange the key via OAuth 2.1 client credentials:

```bash
curl -X POST https://flottix.app/api/v1/oauth/token \
  -d grant_type=client_credentials \
  -u "flottix_YOUR_KEY:" \
  -d scope="read:assets"
```

**Agents acting for a human** (Claude Desktop connectors, Smithery, per-user
consent) — OAuth 2.1 authorization code + PKCE:

1. `GET /.well-known/oauth-authorization-server` (RFC 8414) — endpoints,
   scopes, PKCE methods.
2. `POST https://flottix.app/api/v1/oauth/register` (RFC 7591) — open, instant client
   registration; public clients authenticate with PKCE only.
3. `GET https://flottix.app/api/v1/oauth/authorize` — the user approves in the browser
   (consent screen, optional "remember this app").
4. `POST https://flottix.app/api/v1/oauth/token` with `grant_type=authorization_code` →
   1-hour access token + 30-day rotating refresh token (reuse detection).
   `POST https://flottix.app/api/v1/oauth/revoke` (RFC 7009) tears the grant down.

## 3. First commands to try

- "List all MacBooks checked out, grouped by department."
- "Jane Doe is leaving — offboard her: check in hardware, reclaim licenses. Show me the impact first."
- "Audit for zombie assets and unused license seats; quantify the monthly waste."
- "Here's a Dell packing slip: <text> — ingest it and stage the laptops."

Every mutating tool is two-phase: the first call returns an impact manifest,
nothing is written until you confirm. Every call is scoped, logged and auditable.

## Reference

- MCP endpoint: https://flottix.app/api/mcp
- Full agent-facing brief: https://flottix.app/llms.txt
- REST reference (OpenAPI): https://flottix.app/docs
- Website guide: https://www.flottix.app/agents/
- Pricing: full read/write MCP + API on every plan, including Free (50 items)