Skip to main content

Building apps for ARC

Skeleton. This section grows as the App Platform ships; the first API version is 2027-01.

An ARC app is an integration that reads a tenant's data with its own, scoped access. It never signs in as a person: each installation acts as its own app user, with only the scopes the tenant's admin granted.

Today (phase P2a)​

  • Private apps. A tenant's Owner or Admin creates one in Settings → Apps and gets an OAuth client id and secret. Private apps need the Custom Apps plan switch.
  • Install. Send the admin through the OAuth authorization-code flow with PKCE and resource=https://<tenant host>/api/apps. The consent screen shows every scope you ask for; scopes the admin cannot grant are locked and left out.
  • Read. POST /api/apps/2027-01/graphql with Authorization: Bearer <app token>. Queries only, from an allowlisted set of roots. A field outside your scopes is refused, contact details need read_customer_pii, and money amounts are not exposed yet.
  • Lifecycle webhooks. Declare webhooks: { endpoint, topics } in your manifest. app.installed and app.uninstalled are delivered to your endpoint, signed with your client secret.

Never give an app token to an AI​

An app token acts on the tenant's data directly, with no approval step. Never paste a client secret or app token into an AI model, chatbot or agent. AI assistants connect through ARC's MCP connector, where every change waits for a person to approve it.

Coming next​

Writes and bulk export (P2b), domain event webhooks (P3a), and embedded admin UI (P5).