# Accounts

Three ways in. All end with the same account: members, sites, keys.

### Portal
[Get started, free](https://app.doubleagent.so/login?signup=1): email, magic link, add site, snippet, verify.
### CLI
```sh
npx @doubleagent-so/cli init --email you@company.com   # creates account + site, installs the pk
npx @doubleagent-so/cli login                          # device flow for an existing account
npx @doubleagent-so/cli sites
```
### API
```sh
curl -X POST https://api.doubleagent.so/v1/accounts \
  -H 'content-type: application/json' -H 'DA-PoW: <nonce>:<solution>' \
  -d '{"email":"you@company.com","domain":"shop.example.com"}'
```

```json
{ "account_id": "acc_…", "site_id": "st_…",
  "keys": { "pk_test": "pk_test_…", "pk_live": "pk_live_…", "sk_test": "sk_test_… (shown once)" },
  "verify": { "hostname": "shop.example.com", "token": "da-verify=…", "methods": ["dns", "meta", "file", "script"] },
  "login_url": "https://app.doubleagent.so/login" }
```

Keys work at once. Data stays hidden until the email **and** the domain are verified. `DA-PoW` is a small hashcash; the CLI solves it for you. Rate-limited per IP and email.

| Role | Can |
|---|---|
| `owner` | Everything, including deleting the account |
| `admin` | Sites, domains, keys, settings |
| `viewer` | Read HQ and settings |

Log in: email magic link, single-use, 15 minutes. Sessions last 30 days, sliding; "Log out everywhere" revokes all of them.