Skip to main content

1. Separate environments

Create different Connect applications for development and production. This keeps redirect URIs, credentials, linked agents, balances, and webhooks isolated.

2. Register the application

Call POST /applications with the application’s name, website, exact redirect URIs, default agent behavior, and visibility defaults. Use HTTPS redirect URIs in production; wildcards are rejected.

3. Create backend credentials

Create a service account only for a trusted application backend. Store its credential in a secrets manager and request the narrowest scopes required.

4. Choose execution models

  • Add Sign in with Darwin for user-owned agents and durable history.
  • Use ephemeral goals for bounded app-funded work without a user agent.
  • Fund the application operational balance before app-funded execution.

5. Register webhooks

Subscribe only to supported event types. Store the one-time signing secret, verify signatures over raw request bytes, and deduplicate delivery IDs.

Applications

Review application ownership and lifecycle boundaries.