> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hexr.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Quick Start

> Deploy your first AI agent with Hexr — per-process SPIFFE identity, OPA evidence, and signed audit rows from day one.

## Prerequisites

* Python 3.10+
* Docker
* kubectl configured with a running Kubernetes cluster (EKS, GKE, AKS, or local)
* Hexr runtime deployed ([self-hosted quickstart](/self-hosted/quickstart))

***

## 1. Install the SDK

<CodeGroup>
  ```bash uv (recommended) theme={null}
  uv pip install "hexr-sdk[cli]" --extra-index-url https://pypi.hexr.cloud/simple/
  ```

  ```bash pip theme={null}
  pip install "hexr-sdk[cli]" --extra-index-url https://pypi.hexr.cloud/simple/
  ```
</CodeGroup>

***

## 2. Write Your Agent

Create `my_agent.py`:

```python theme={null}
import openai
from hexr import hexr_agent, hexr_tool, hexr_llm
from hexr.vault import VaultClient

@hexr_agent(name="my-first-agent", tenant="my-team")
def main():
    # Fetch API key from Hexr Vault (no secrets in code)
    vault = VaultClient()
    api_key = vault.get("api-keys/openai")

    # Wrap the OpenAI client — automatic OTel tracing on every call
    client = hexr_llm(openai.OpenAI(api_key=api_key))

    response = client.chat.completions.create(
        model="gpt-4o",
        messages=[{"role": "user", "content": "What is the capital of France?"}],
    )
    print(response.choices[0].message.content)

    # Get an authenticated S3 client via SPIFFE identity (no AWS keys)
    s3 = hexr_tool("aws_s3")
    buckets = s3.list_buckets()
    print(f"Found {len(buckets['Buckets'])} buckets")

if __name__ == "__main__":
    main()
```

***

## 3. Build

```bash theme={null}
$ hexr build my_agent.py --tenant my-team

Analyzing my_agent.py...
  Framework: pure_python
  Agents: 1 (my-first-agent)
  Resources: aws_s3
  A2A: disabled

Generated .hexr/ (5 files)
```

***

## 4. Push

```bash theme={null}
$ hexr push

Building for: linux/amd64, linux/arm64
Pushing to: registry/my-team/my-first-agent:latest

✓ Image pushed
✓ Vulnerability scan: 0 critical
```

***

## 5. Deploy

```bash theme={null}
$ hexr deploy

Applying manifests to tenant-my-team...
  ✓ Namespace created
  ✓ RBAC applied
  ✓ Agent pod created (4/4 containers)

Agent deployed!
  SPIFFE ID: spiffe://demo.hexr.dev/agent/my-team/my-first-agent/main
```

***

## What Just Happened?

<Steps>
  <Step title="AST Analysis">
    `hexr build` analyzed your Python code and discovered the agent name, framework, cloud resources, and A2A configuration — all without running your code.
  </Step>

  <Step title="Identity Assignment">
    Your agent received a SPIFFE identity: `spiffe://demo.hexr.dev/agent/my-team/my-first-agent/main`. This identity is used for all authentication.
  </Step>

  <Step title="Credential Injection">
    When your agent calls `hexr_tool("aws_s3", ...)`, the platform automatically exchanges the SPIFFE identity for short-lived AWS credentials. No AWS keys in your code.
  </Step>

  <Step title="Observability">
    Every `hexr_llm()` and `hexr_tool()` call is automatically traced with OpenTelemetry. Check the dashboard for traces, metrics, and costs.
  </Step>
</Steps>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Multi-Framework Agents" icon="layer-group" href="/guides/multi-framework">
    Use CrewAI, LangChain, or AutoGen with Hexr.
  </Card>

  <Card title="Agent-to-Agent" icon="arrows-split-up-and-left" href="/guides/agent-to-agent">
    Enable communication between agents.
  </Card>

  <Card title="SDK Reference" icon="book" href="/sdk/overview">
    Full API documentation.
  </Card>

  <Card title="Architecture" icon="sitemap" href="/architecture/overview">
    How the platform works.
  </Card>
</CardGroup>