Connect the agent panel

Install the SDK with the agent panel, link your OpenAPI document, give a test account and scan — Flamio builds the panel AI agents use on your site.

The agent panel lets an AI agent that opens your site finish a task through your API instead of clicking through your pages. You give Flamio what it needs — the SDK with the panel on your pages, your OpenAPI document and a test account — and click Scan. Flamio builds the panel from them. The agent panel is in beta: it needs the beta of web SDK 0.11.0 and of @flamioai/agent-panel.

Before you begin

You need the Editor, Admin or Owner role.
Verify your domain first — see Set up your site and verify your domain. Until then Scan is off and reads "Verify your domain first."
A developer who can change your site's code and deploy it.
Your API described in an OpenAPI 3 document, at a link that opens without signing in.
A test account on your site that holds no real customers' data. AI describes the screens Flamio sees with it.

Connect and scan

Open Connect the agent panel

Open AI agents. On Setup, below Domain verification, find Connect the agent panel. It lists everything to do before the scan, in order.

Install the SDK with the agent panel

Under Install the SDK with the agent panel, a developer runs the install command and adds the snippet to your site's code:

npm install @flamioai/web-sdk@beta @flamioai/agent-panel@beta

import { Flamio } from '@flamioai/web-sdk';
import { agentPanel, AGENT_PANEL_AUTH } from '@flamioai/agent-panel';

Flamio.init({
  projectKey: 'YOUR_KEY_HERE',
  endpoint: 'https://api.flamio.org/api',
  agentPanel: agentPanel({
    api: {
      origins: ['https://api.example.com'],
      // TODO: where your app keeps the signed-in user's token
      auth: { type: AGENT_PANEL_AUTH.bearer, token: () => localStorage.getItem('token') },
      // Session cookies instead: auth: { type: AGENT_PANEL_AUTH.cookie },
    },
  }),
});

YOUR_KEY_HERE is your project key. Setup shows the snippet with your key filled in.
https://api.example.com is the origin of your API. Once you link your OpenAPI document, Setup fills in its origin.
Replace localStorage.getItem('token') with wherever your app keeps the signed-in user's token, or use the cookie line instead if your API signs users in with cookies.

The Agent panel reference lists every option.

Link your OpenAPI document

Under Link your OpenAPI document, enter the link to the document and click Save. Flamio reads from it what agents may read and change.

Give a test account

Under Give a test account, enter the Login page, the Start page to open after signing in, the Login and the Password. Tick This account has no real customers’ data. and click Save account.

Flamio signs in with this account and reads the screens behind your login. It only looks — it never sends a form or signs out. Without a test account, agents get only your public pages and your API.

Optional: mark what agents may not do

In your OpenAPI document, add x-flamio-policy to an operation:

openapi.yaml

paths:
  /orders/{id}:
    delete:
      x-flamio-policy: human_only

Value	What agents do with the operation
`excluded`	Never see it.
`human_only`	Leave it to a person.
`write`	Run it after the user confirms.
`read`	Run it freely.

Without marks, agents read freely, a person deletes, and every other change waits for the user's confirmation.

You can also tag the sections and forms of your public pages — see Tag forms and sections.

Let Flamio through

Flamio reads your public pages as FlamioSiteReader — if your site has bot protection, let that User-Agent through (see FlamioSiteReader in your logs). The screens behind your login are read in a Chrome browser that Flamio drives. It sends an ordinary Chrome User-Agent and connects from cloud servers whose addresses change, so there is no User-Agent or address to allow it by: bot protection that challenges automated browsers — a captcha or a JavaScript check — keeps it out, and the scan builds the panel without those screens. If your site sends a Content-Security-Policy header, allow https://api.flamio.org in connect-src and in frame-src — see Content Security Policy.

Scan

Click Scan. The button reads Scanning… while Flamio checks the tag, reads your OpenAPI document and the screens behind your login, describes them with AI, reads your public pages and builds the panel. Next to the button, Flamio shows what this month's scans of your site have used of its monthly limit.

Result

Scan results lists every step of the scan and what it found: the operations agents get and the ones kept out, the screens read, the screens and operations described, the public pages read. A scan that missed something reads Done with gaps and says under the step what was missing and what to do.

After you change your site or its API, click Rescan. Rescan on Site tree runs the same scan.

Rescan on a new version

Under Scan results, Rescan when a new version comes out is on by default. Flamio then rescans your site by itself when:

real visitors reach a new version of your site — the version you pass to Flamio.init, the same value Scout's release checks read;
your OpenAPI document changes. Flamio reads it once a day.

An automatic rescan runs at most once in 6 hours and within your site's monthly limit. A rescan that has to wait is not dropped: it starts as soon as the gap or the limit allows. Each new version is listed with what Flamio did:

The version reads	Meaning
Rescanned	Flamio rescanned for this version.
Read by a later scan	A scan that began after the version came out already read it.
Waiting — at most one automatic rescan in 6 hours, within this month’s limit	The rescan starts when the gap or the limit allows.
Skipped — automatic rescans were off	The version came out while the switch was off.
Starting point	The version was live before your first scan, or before Flamio started following your site's versions.

If a step has a gap

The step reads	What to do
"No OpenAPI link — agents get no data or actions of your API."	Link your OpenAPI document, then click Rescan.
"No test account — screens behind the login are not read."	Give a test account, then click Rescan.
"The OpenAPI link did not open …"	Make sure the link opens publicly, without signing in.
"The OpenAPI document could not be read …"	Link an OpenAPI 3 document.
"Flamio could not sign in with the test account."	Check the login page, the login and the password. Sign-in through SSO, a one-time code or a captcha is not supported.
"Reading the screens took too long."	Click Rescan. The panel was built without the screens.
"… more screens behind your login were not read: one scan reads at most 200 screens."	Nothing to fix: the panel has the first 200 screens Flamio reached behind your login, the rest are left out.
"This month’s limit for AI descriptions ran out …"	The rest is described after the month turns: click Rescan then.
"The verification tag is not on your home page."	Put the tag back, deploy, and click Rescan.

If Scan is refused because this month's scans used your site's limit, you can scan again next month.

Connect the agent panel

On this page