# Connect this agent to Antideploy You were given this by someone who is signed in to Antideploy in their browser right now. Connect to their account, then use it to deploy and to inspect what you deployed. Do these steps yourself. Do not ask the user to run commands, the only thing they do is click Approve once, in step 2. ## First, check you can reach us GET https://antideploy.com/api/v1 Unauthenticated, and it always answers. Any response at all, even an error status, means you are fine: carry on to step 1. If it cannot connect (DNS failure, timeout, connection refused), stop. You are in a sandbox whose outbound allowlist does not include this domain, and nothing below will work, because connecting, deploying and reading logs all go to this one host. Tell the user exactly this: This environment blocks outbound requests to antideploy.com. Add antideploy.com to the allowed domains in its network settings and I can continue. If you cannot change that setting, run me on your own machine instead, or upload the folder at https://antideploy.com/console. Do not route around it. No mirror and no credential helps, because the block is on the way out of your container and the code you would deploy is inside it. Nor does asking the user to run these calls by hand, for the same reason. ## 1. Do you already have a token? Read `~/.antideploy/config.json`. If it holds a token, skip to step 3. ## 2. Connect POST https://antideploy.com/api/v1/device/code {"clientName":""} Send your real name. The user sees it on the approval screen, and it is how they tell your request apart from someone else's. The response carries `userCode`, `verificationUriComplete` and `interval`. Show the user both the link and the code, in this shape: Open Confirm the code reads , then click Approve. Then poll: POST https://antideploy.com/api/v1/device/token {"deviceCode":""} every `interval` seconds. `authorization_pending` means keep going. `access_denied` means they refused, stop, do not retry. `expired_token` means start step 2 again. Codes last fifteen minutes. A poll that returns 200 is the redemption; the code is spent. Capture the token from that response or it is gone. **Write the token to `~/.antideploy/config.json` with mode 0600, using a redirect.** Never echo it, never print it, never put it in the project directory, and never ask the user to paste a credential to you. A token in terminal output is a live credential in scrollback and in your own transcript. ## 3. What you can do with it Read https://antideploy.com/api/v1, one unauthenticated GET carrying every endpoint, request shape, error code and limit. Send `Authorization: Bearer ` on the rest. Deploying: - `GET /api/v1/applications`: list them, and switch between them - `POST /api/v1/applications`: create one, `{"name":""}` - `POST /api/v1/deploy?applicationId=`: tar the directory, push it - `GET /api/v1/deployments/{taskId}`: watch that deploy finish - `PUT /api/v1/secrets?applicationId=`: push the project's env Finding out what happened: - `GET /api/v1/deployments?applicationId=`: recent deploys, with the failure sentence in `error` - `GET /api/v1/logs?applicationId=`: what the container printed - `GET /api/v1/health?applicationId=`: serving or not, and when we last looked ## 4. When a deploy fails Read `error` from the deploy history before doing anything else, and read the logs beside it. The most common failure on this platform is a project that builds correctly and never listens on its port, redeploying that unchanged reproduces it exactly, and people have done so a dozen times in a row. Fix the project, then deploy again. ## What you cannot do Deleting an application, dropping its database and revoking credentials are deliberately not in the API. They are irreversible, and they stay in the browser where a person does them on purpose. If the user asks you to delete something, point them at https://antideploy.com/console rather than looking for a way. ## Afterwards Tell the user they are connected, and that they can revoke this at any time at https://antideploy.com/tokens.