Skip to main content
Provisioning is the next step past a click link. When the Index recommends your service and the user says yes, Gravity creates a real account or resource on your platform and hands working credentials straight to the user’s coding agent. The agent wires them into the project and keeps building. The user never leaves the conversation.

​
What you need to know

  • Human consent is always required. The agent asks the user first; POST /provision rejects any request without explicit consent, and the account is created under the user’s verified signed-in email, so agents can’t supply arbitrary addresses.
  • You still own the customer. The account lives on your platform under the user’s email. Send your own welcome email on creation: it comes from your brand and lands where the user expects it.
  • Credentials are delivered exactly once. Gravity returns them to the agent at provision time, then holds them only encrypted at rest. No later API call ever returns them again.
  • No duplicate accounts. If you expose an account-lookup endpoint, Gravity checks it first and tells the user “you already have an account” instead of creating one.
  • Attribution and CPA work exactly like click-through. Every provision mints a grclid and emits a conversion event at provision time. Same ledger, same billing.
  • Abuse is bounded. Per-publisher daily provisioning caps and per-recipient email caps apply.

​
One mode: your sign-up MCP App

Provisioning runs through a sign-up MCP App — a small MCP server you host that serves your branded sign-up card. Hosts render it inline, the user consents with a click, your server creates the account through your own API, and credentials are delivered one-time into the card (never into the model’s context). What it is: Sign-up MCP Apps. How to build one (~a day with the reference implementation): Build your sign-up app.

​
Setting it up in the dashboard

Provisioning is configured per product. Open your advertiser Index dashboard → Your products → click a product:
1

Turn on MCP App

Each product is Off by default. In the product’s Provisioning card, switch the mode to MCP App.
2

Enter your MCP endpoint

The public HTTPS URL of your MCP server. Hosts fetch your sign-up card from it — one URL covers the server and the UI.
3

Mint your signing secret

One click in the Your products header generates a single HMAC secret for your whole account. It’s shown exactly once, so copy it then; Gravity stores it only encrypted. Your server verifies Gravity-signed provision grants with it (set it as GRAVITY_SIGNING_SECRET).
4

Copy your webhook URL (optional)

The dashboard shows the webhook endpoint your platform can call back, signed with the same secret. Most platforms never need it.
Need to rotate the secret? Mint again: the new secret replaces the old one immediately (no grace window), so have your side ready to swap it.

​
What you’ll see once it’s live

The dashboard shows a summary line per service as agents provision accounts:
Neon Postgres: 3,203 accounts provisioned · 214 this week · last 7/25/2026
Each provision also appears in your conversion ledger like any other CPA conversion. If nothing has been provisioned yet (or a service is Off), the section simply shows your setup. There’s no empty table to manage. Already an Index advertiser? Enabling provisioning is additive: your listing, campaign, and conversion tracking stay exactly as they are.