# Guides

> Task-oriented how-tos — authentication, agent actions, permissions, rooms, offline behaviour and testing.

Source: https://miniapp.sollar.com/guides/

---

Each page here answers one question, with working code.

| Guide | Answers |
|---|---|
| [Authentication](/guides/authentication/) | How does the user sign in, and what does my backend verify? |
| [Agent actions](/guides/agent-actions/) | How does a Sollar AI agent call my mini app? |
| [Permissions](/guides/permissions/) | How do I ask for a capability, and what happens when I am refused? |
| [Messaging and rooms](/guides/messaging-and-rooms/) | How do I read room context and post a message? |
| [Offline and storage](/guides/offline-and-storage/) | Where do I put data, and what happens on a train? |
| [Testing](/guides/testing/) | How do I test this with tools I already know? |

New here? Start with [Get started](/start/) instead — it builds a working mini app end to end.
Looking for the normative surface? That is [Reference](/reference/).

## Three things that catch everyone

**The client is not an authority.** Anything the bridge hands your JavaScript is for drawing UI.
Authorisation happens on your server, against a token, every time.

**Your backend cannot post into an encrypted room.** In the Enterprise and Sovereign tiers,
encryption is on by default. Decide how notifications work before you build them —
[Messaging and rooms](/guides/messaging-and-rooms/) has the three patterns that do work.

**The manifest is the ceiling.** A permission or a network host that is not declared cannot be
obtained at runtime. There is no workaround, by design.