# Orbit developer resources

Orbit is an application platform you can drive from code. Every surface below
has a fixed address that does not move. Point a person, a script, or an agent
at it.

## Orbit Apps API

The Orbit Apps REST API treats apps as HTTP resources. Create an app with a
POST, change it with a PATCH, deploy it with a call.

- **Base URL** — `https://api.orbitapps.io`
- **API reference** — [https://api.orbitapps.io/swagger](https://api.orbitapps.io/swagger)
- **Service information** — [https://api.orbitapps.io/](https://api.orbitapps.io/)
- **What you can build with it** — [Build an app programmatically](/build-from/api)

## Orbit Apps OpenAPI specification

The full OpenAPI 3.1 document. Generate a client from it, or hand it to an
agent.

- **OpenAPI document** — [https://api.orbitapps.io/openapi.json](https://api.orbitapps.io/openapi.json)

## Orbit Apps API authentication

Orbit authenticates with a bearer token. A CLI or an agent mints its first
token through the OAuth 2.0 device-authorization grant (RFC 8628): start at
`POST /api/v1/device/code`, show the user code, then poll
`POST /api/v1/device/token`.

- **Protected-resource metadata (RFC 9728)** — [https://api.orbitapps.io/.well-known/oauth-protected-resource](https://api.orbitapps.io/.well-known/oauth-protected-resource)
- **Authorization-server metadata (RFC 8414)** — [https://api.orbitapps.io/.well-known/oauth-authorization-server](https://api.orbitapps.io/.well-known/oauth-authorization-server)

## Orbit Apps API scopes

A token carries a scope set. Each scope is a verb on a resource — `read:app`,
`write:deployment`, `manage:secret`. The verbs escalate: `manage` covers
`write`, and `write` covers `read`. Grant an agent the narrowest set that does
its job.

The complete vocabulary is published as `scopes_supported` in both metadata
documents above, so a client can read it instead of guessing.

## Orbit MCP server

Connect Claude, Codex, or any MCP client to Orbit. The server exposes the
build surface as tools: create an app, edit its nodes, run a workflow, deploy
it. It requires OAuth 2.0.

- **MCP endpoint** — `https://mcp.orbitapps.io/mcp`
- **Server card** — [https://mcp.orbitapps.io/.well-known/mcp/server-card.json](https://mcp.orbitapps.io/.well-known/mcp/server-card.json)
- **Protected-resource metadata** — [https://mcp.orbitapps.io/.well-known/oauth-protected-resource/mcp](https://mcp.orbitapps.io/.well-known/oauth-protected-resource/mcp)
- **How to connect it** — [Build an app with Claude](/build-from/claude)

Your own app can expose an MCP server too. See
[Build an app agents can use](/build/mcp-servers).

## Orbit CLI

Create an app, apply changes, deploy, and read the logs without leaving the
terminal.

- **Install and reference** — [https://cli.orbitapps.io/](https://cli.orbitapps.io/)
- **What it does** — [Build an app from the command line](/build-from/cli)

## Webhooks

An Orbit app receives a webhook through a workflow with a webhook trigger. The
trigger owns a reserved path and verifies the sender's signature.

- **Workflows and triggers** — [https://docs.orbitapps.io/workflows](https://docs.orbitapps.io/workflows)

## Errors

Every Orbit API error is an RFC 7807 `problem+json` document. Its `type` is a
URL that explains the error and what to do about it.

- **Error reference** — [https://docs.orbitapps.io/errors](https://docs.orbitapps.io/errors)

## Documentation

- **Product documentation** — [https://docs.orbitapps.io/](https://docs.orbitapps.io/)
- **Machine-readable site map** — [https://orbitapps.io/llms.txt](https://orbitapps.io/llms.txt)
- **Orbit for developers** — [What Orbit gives you](/for/developers)