1. Separate environments
Create different Connect applications for development and production. This keeps redirect URIs, credentials, linked agents, balances, and webhooks isolated.2. Register the application
CallPOST /applications with the application’s name, website, exact redirect URIs, default agent behavior, and visibility defaults. Use HTTPS redirect URIs in production; wildcards are rejected.
3. Create backend credentials
Create a service account only for a trusted application backend. Store its credential in a secrets manager and request the narrowest scopes required.4. Choose execution models
- Add Sign in with Darwin for user-owned agents and durable history.
- Use ephemeral goals for bounded app-funded work without a user agent.
- Fund the application operational balance before app-funded execution.
5. Register webhooks
Subscribe only to supported event types. Store the one-time signing secret, verify signatures over raw request bytes, and deduplicate delivery IDs.Applications
Review application ownership and lifecycle boundaries.