> ## Documentation Index
> Fetch the complete documentation index at: https://docs.khal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Mint an invite and approve access

> Create a new FDE's invite code, then approve their workstation's SSH lease.

For onboarding a new FDE. (New engineer? Go to the [engineer guide](/fde-start-here/access/engineer-guide).)

<Note>
  You need an authenticated `khal` session with **superadmin** rights. Not sure? Run the mint command — a clear permission error tells you fast.
</Note>

<Steps>
  <Step title="Mint a single-use invite">
    ```bash theme={null}
    khal fde invite create --email <new-fde>@namastex.ai
    ```

    Superadmin-only, `@namastex.ai` addresses only. Minting *is* what creates the engineer's identity — there's no account to set up first.

    <Warning>
      The code is shown **once** (the platform keeps only its SHA-256 hash). Copy it now; if you lose it, mint a fresh one.
    </Warning>
  </Step>

  <Step title="Hand it off securely">
    Send it over a channel you'd trust with a password — not a public channel or an archived screenshot. It's single-use: the engineer's first `khal fde enroll` consumes it.
  </Step>

  <Step title="Approve their SSH lease">
    After they enroll and request a workstation, its SSH lease sits behind the **Deploy Ledger** until you approve it. Get their instance ID (from their `khal fde status`), then approve through your `khal fde` admin tooling.

    No certificate authority — once approved, access is just the engineer's own SSH key plus Tailscale.

    <Tip>Until you approve, their `khal fde ssh` returns "not approved yet" — expected, just your turn.</Tip>
  </Step>
</Steps>

<Note>
  Your job is **mint** and **approve**. You don't set passwords or certs (the engineer's SSH key is the credential), pick a hostname (Tailscale does), or provision the VM (that's the engineer's `khal fde instance`).
</Note>

<Accordion title="🤖 Agent paste prompt">
  ```text theme={null}
  TASK: Use `fde-start-here/access/admin-guide.mdx` to guide a superadmin/lead through onboarding a new FDE; run safe verification first, return evidence + blockers.
  SAFE FIRST COMMANDS: `khal fde status`, `khal --version` (neither mutates).
  MUTATING — confirm first: `khal fde invite create` (creates a new identity + single-use secret) and the SSH-lease approval action. Never print the raw invite code into a shared log.
  EVIDENCE: command, exit status, sanitized output (redact the invite code), what it proves, next safe action.
  ```
</Accordion>