First-touch onboarding

Review the detected context, then approve one provider setup at a time. This page never grants access by itself. A server-side start flow must create state and PKCE, reuse an existing approved GitHub session when available, and return to this same origin.

Detected context

Service URL
Repository hint
Workspace selector
Safe return path

Provider steps

GitHub App installation request. Verify the repository and requested least-privilege permissions. If an approved GitHub session exists, reuse it; otherwise the provider login starts with state and PKCE.
Cloudflare application and domain authorization. Confirm the exact hostname and environment before authorizing Access, WAF, or Worker routing.
DNS verification. Add only the provider-issued CNAME or TXT record in a zone you control. The canonical nested workspace form is <child>.<parent>.id.drksci.com; hostnames select a workspace but never grant authority.

Approve provider setup

I reviewed the repository, service URL, workspace, and requested provider step. I explicitly approve opening a provider setup flow.

No provider flow is open.

Local git credential helpers are never uploaded or read as bearer secrets. The agent may inspect a remote URL to supply a repository hint, but provider credentials stay in the provider session or native secret store.

After verification, the gateway issues only a bounded grant for the declared repository, workspace chain, actions, and environment. Cross-workspace access still requires an explicit grant.

Could this run smoother? What were you trying to do? · policy assistant · machine discovery