Integration Demo

One sign-in across your zone

The browser sends the shared HttpOnly cookie. Session credentials are never displayed or stored by this demo in browser storage.

Permissions for this app

The backend checks this app's roles. Roles belonging to another zone app do not grant access here.

Try this with and without the demo-admin role to see the server enforce access.

Fixed session, fresh permissions

The session ends after at most 12 hours or at midnight in America/Edmonton, whichever comes first. There is no inactivity timeout. A shorter configured app lifetime still applies.

Identity responses can be reused for up to five minutes. Refresh identity requests a new permission check once the 30-second refresh window allows it.

Agent Assistant refreshes active identity caches in the background after 150 seconds. This Function demo uses auth-storage's shared cache and explicit refresh; the timer above does not send polling requests or extend your session.

Apps available to you

JSON storage

Try a short-lived Redis value or durable Blob-backed JSON. Writes stay inside the demo's own namespace.

Account keys are separated by user ID in this demo. The JSON API uses zone-wide storage, so these prefixes are not a privacy boundary. Use sample data only.

For an expiry test, use cache storage with a 30-second TTL, save, wait, then load.

Attachments

Upload an image or another file, retrieve it privately, then try sharing it with a public link.

Attachment controls

Choose a file Up to 10 MiB Keep the attachment Until I delete it 5 minutes 1 hour 1 day

Upload file

Attachment ID

Keep this ID to retrieve the file later using the same account.

Load details & preview Download Delete attachment

Sign in to try attachments.

Public links

Anyone with a public link can open the file without signing in.

Link type Expiring Persistent Expires after (seconds)

Create public link

Saved link ID Revoke saved link

Backend configuration

Sign in to load the configured greeting.

Configuration indicates readiness to try a feature. Storage workload grants and network access are verified when you use it.

Use a secret without revealing it

The optional example reads one configured secret in the backend and returns only whether it is available. The app key, workload access tokens, and secret value never enter the page.

Configure APP_KEY and DEMO_SECRET_NAME on the backend, and assign demo-admin to try this example.

A sibling app, discovered as a tab

1. Register this backend as app test in environment dev, zone aa.
2. Give your account an app role through an Entra group grant.
3. Let the ingress worker provision test.aa.dev-ai-pbs.com and allow Agent Assistant to frame it.
4. Reload Agent Assistant after the permission-refresh window. Its tab list comes from zone_apps.

What this tab shares

Zone sign-in, the user's identity, app-specific roles, and the zone's storage service. This demo adds server-enforced private data and attachment ownership.

Caller and call context

Agent Assistant's built-in tabs have a separate Store Context contract for selected calls and read-only caller views. A sibling app needs an explicitly authorized backend integration for that data. This demo does not access or modify live calls, tickets, or Agent Assistant's own stored keys.

Try the complete flow

Refresh your identity, test a role, save and reload private JSON, compare a shared value with another authorized account, then upload a sample file and create an expiring public link. Revoke the link when finished.