Generate a keypair, register the public key under a username, then provision the private key into your agent's MCP UI.