Skip to main content
Provisioning is the next step past a click link. When the Index recommends your service and the user says yes, Gravity creates a real account or resource on your platform and hands working credentials straight to the user’s coding agent. The agent wires them into the project and keeps building. The user never leaves the conversation.

​
What you need to know

  • Human consent is always required. The agent asks the user first; POST /provision rejects any request without explicit consent, and the account is created under the user’s verified signed-in email, so agents can’t supply arbitrary addresses.
  • You still own the customer. The account lives on your platform under the user’s email. Send your own welcome email on creation: it comes from your brand and lands where the user expects it.
  • Credentials are delivered exactly once. Gravity returns them to the agent at provision time, then holds them only encrypted at rest. No later API call ever returns them again.
  • No duplicate accounts. If you expose an account-lookup endpoint, Gravity checks it first and tells the user “you already have an account” instead of creating one.
  • Attribution and CPA work exactly like click-through. Every provision mints a grclid and emits a conversion event at provision time. Same ledger, same billing.
  • Abuse is bounded. Per-publisher daily provisioning caps and per-recipient email caps apply.

​
Two modes

Signup handoff (default)

Zero engineering. We generate an attributed signup deep link and the agent sends the user to your normal signup page. This is the click-through flow every listing already gets.

Provisioning API (recommended)

You expose one endpoint; Gravity creates the account and returns the credential (API key, PAT, connection string) to the agent instantly. Full contract: Provisioning API.

​
Setting it up in the dashboard

Everything lives in the Provisioning section of your advertiser Index dashboard, per service:
1

Pick a mode

Each of your services is Off by default. Switch it to Signup link (attributed deep link, no engineering) or Provisioning API.
2

Provisioning API: save your API base URL

The base URL of your provisioning API. Gravity calls it to create accounts and (optionally) check for existing accounts.
3

Mint your signing secret

One click generates the shared HMAC secret. It’s shown exactly once, so copy it then; Gravity stores it only encrypted. Every call between Gravity and your API is signed with it, in both directions.
4

Copy your webhook URL (optional)

The dashboard shows the webhook endpoint your platform can call back, signed with the same secret. Most platforms never need it.
Need to rotate the secret? Mint again: the new secret replaces the old one immediately (no grace window), so have your side ready to swap it.

​
What you’ll see once it’s live

The dashboard shows a summary line per service as agents provision accounts:
Neon Postgres: 3,203 accounts provisioned · 214 this week · last 7/25/2026
Each provision also appears in your conversion ledger like any other CPA conversion. If nothing has been provisioned yet (or a service is Off), the section simply shows your setup. There’s no empty table to manage. Already an Index advertiser? Enabling provisioning is additive: your listing, campaign, and conversion tracking stay exactly as they are.