Guides
Each page here answers one question, with working code.
| Guide | Answers |
|---|---|
| Authentication | How does the user sign in, and what does my backend verify? |
| Agent actions | How does a Sollar AI agent call my mini app? |
| Permissions | How do I ask for a capability, and what happens when I am refused? |
| Messaging and rooms | How do I read room context and post a message? |
| Offline and storage | Where do I put data, and what happens on a train? |
| Testing | How do I test this with tools I already know? |
New here? Start with Get started instead — it builds a working mini app end to end. Looking for the normative surface? That is Reference.
Three things that catch everyone
Section titled “Three things that catch everyone”The client is not an authority. Anything the bridge hands your JavaScript is for drawing UI. Authorisation happens on your server, against a token, every time.
Your backend cannot post into an encrypted room. In the Enterprise and Sovereign tiers, encryption is on by default. Decide how notifications work before you build them — Messaging and rooms has the three patterns that do work.
The manifest is the ceiling. A permission or a network host that is not declared cannot be obtained at runtime. There is no workaround, by design.