​
Quickstart

This guide walks you through adding your first app, verifying it, and running your first audit.
Only run audits against systems you own or have explicit written authorization to test. Every audit requires accepting the authorized-testing terms for the app.

​
1. Sign in

  1. Sign in at we.usegolem.ai — enter your email and paste the 6-digit code we send you, or continue with Google.
  2. The first-run onboarding walks you through creating your first app.

​
2. Add an app

An app is the container for everything Golem knows about one target: its domain, its assets, its audits, and its billing. Web app
  1. Click New App (or start from onboarding).
  2. Enter a name and the target domain (e.g. acme.example.com).
  3. Pick optional security focus areas — what matters most to you.
  4. Click Create Draft — you’ll get verification instructions.
Verify ownership by either:
  • Meta tag — add <meta name="golem-verify" content="<token>"> to your site’s HTML head, or
  • DNS TXT — add a TXT record at _golem-verify.acme.example.com with value golem-verify=<token>
Then click Verify. On success, Golem immediately kicks off a subdomain scan and tech-stack scan, and your app becomes a full App. Mobile app
  1. Click New App and choose Mobile.
  2. Enter the iOS bundle ID or Android package name (e.g. com.acme.app).
  3. Golem pulls the app’s public store metadata for developer-contact verification.
  4. For iOS, upload your .ipa on the app’s Assets page — required before iOS scans.
  5. Accept the attestation (you confirm you’re the developer or have written permission), then run a prescan or audit.

​
3. Run your first audit

  1. Open the app’s Dashboard.
  2. Click Launch Audit and choose a mode:
  1. Optionally override the security focus for this run.
  2. Launch. Findings stream into the dashboard as they’re confirmed.
When the audit completes you get findings with evidence, a security score with a full breakdown, a Markdown report, and a downloadable PDF.

​
4. Get an API key

  1. Open Profile in the sidebar.
  2. Click Generate API Key — the key is shown once and looks like golem_sk_....
  3. Pass it as a Bearer token on every API call:
See the API overview for every endpoint.

​
What’s next

Core concepts

Apps, drafts, audits, findings, and the Golem agent.

Shallow vs Deep

Choose the right audit mode.

Findings & evidence

How Golem guarantees findings are real.

Scheduling

Run audits on a cron schedule.