Create:sa-forge-signer key new alice-session --class session prints only the pubkey; add the printed [keys.alice-session] block to the config. To use a key you already have, sa-forge-signer key import alice-session --class session --from <file> copies a Solana CLI keypair file (a JSON array of 64 bytes, as solana-keygen writes) into key_dir as a 0600 file and prints the same block. Importing the same keypair again writes nothing and prints the block again; a different key under that name is refused, never overwritten. It leaves the original in place: delete it once the copy works (key show reports key file: ok).
Grant: build forge-mcp build_add_profile_key with that pubkey as newKey, scope sage, the narrowest permission mask and a short expireTime. The profile authority signs it: the human’s own wallet (Path B; the grant page builds and signs the grant with a browser wallet), or the agent’s wallet key through sign (Path A; it needs confirm or a testnet burner on auto). The key lands at the profile’s next free index, which is not always 1: read it from the profile (the grant page shows it) and give it to the agent, which passes it as forge-mcp’s keyIndex. The signer config has no index field.
Fund:sa-forge-signer key fund alice-session --zink 0.05 --from <payer> --out fund.json builds an unsigned transfer. Path A: sign --key alice-wallet fund.json, with the session key listed in the wallet’s transfer_to. Path B: pay it from the human’s wallet with any Solana-compatible tool. A small balance doubles as a spending cap.
Use:sign with the key. A missing or too narrow grant fails the simulation with the program’s error.
Revoke: build build_remove_profile_key, signed by the profile authority (or Revoke on the grant page), then sa-forge-signer key destroy alice-session. destroy zeroes and deletes the key file, and refuses while the key still holds ZINK unless you pass --abandon-balance. The on-chain expiry is the backstop if revocation is forgotten.