# Kapable developer documentation > Documentation for developers building on and operating Kapable. [Full documentation](https://docs.kapable.ai/llms-full.txt) ## Start here - [Build on Kapable](https://docs.kapable.ai/): Use the API, ship an app, or run Kapable on your own server. - [Getting Started](https://docs.kapable.ai/getting-started): Go from a new workspace to a working API call and a live app. - [Authentication](https://docs.kapable.ai/authentication): Kapable supports two customer authentication methods: API keys for server-to-server calls and session/JWT bearer tokens for user-context requests. Operator surfaces use a separate token tier and a separate SDK — see Operator SDK. - [kapable CLI](https://docs.kapable.ai/cli): A single native binary (linux-amd64, darwin-arm64) that mirrors the SDK's customer-tier surface from your terminal — auth, board, data, comms, knowledge, store, and a local dev/preview supervisor. It rides kapable-sdk exclusively, so anything you can do with the Rust SDK you can do from the CLI. - [Operator SDK](https://docs.kapable.ai/ops-sdk): @kapable/ops-sdk (TypeScript) and kapable-ops-sdk (Rust) wrap the operator/platform tier: the deploy, CI, hosting, and admin surfaces that the customer SDK deliberately excludes. It mirrors the kapable (customer) vs kapable-ops (operator) CLI trust split. ## Build - [Apps & Deployment](https://docs.kapable.ai/apps): The platform's core story: create an app from a template, push code to the built-in Git remote, request a deploy, and it's live at {app}.{org}.kapable.run. The full lifecycle — environments, env vars, deployment lanes, logs, pause/resume — is part of the auth SDK module today (the methods live on client.auth). - [Sign users in to your app](https://docs.kapable.ai/app-sign-in): Members of your organisation sign in to your app with their Kapable account. You write no callback and store no secret. Turn sign-in on, then one call reads the user and one call checks a permission. - [Kaps](https://docs.kapable.ai/kaps): A kap is one folder of files that runs at its own address the moment you save it. It belongs to your organisation and is private to your organisation's signed-in members by default. No build step, no deploy pipeline, no containers to manage. - [Deployments](https://docs.kapable.ai/deployments): Kapable handles the full build-and-deploy pipeline for your apps. Push your code, and Kapable builds, packages, and deploys it to production automatically. - [Environment Variables](https://docs.kapable.ai/environment-variables): Configure your apps with environment variables for secrets, feature flags, and runtime settings. - [Custom Domains](https://docs.kapable.ai/custom-domains): Connect your own domain to any Kapable app. Visitors see your brand; Kapable handles hosting, SSL, and routing behind the scenes. - [Runners](https://docs.kapable.ai/runners): Runners are machines you own that build and run your pipelines: a Mac mini in the office, a build server in your rack, a spare laptop. Instead of waiting on shared platform capacity, your pushes build on your own hardware — and your git credentials are never copied to it. - [Conductor](https://docs.kapable.ai/conductor): Run Kapable's designer on your own Claude subscription. A small daemon called kapable-conductor (Kapable Conductor) sits on your Mac. Kapable sends design turns to it instead of to Kapable's own model access. The turns then draw on the Claude plan you already pay for, at your own rate limits, on hardware you control. - [Webhooks](https://docs.kapable.ai/webhooks): Webhooks are a planned capability — this page describes the intended design, but there is no webhook configuration surface or delivery pipeline on the platform today (verified 2026-07-12). For reacting to platform activity now, use the audit log in the console or the Comms API's messaging primitives. - [Agents & Mail](https://docs.kapable.ai/agents-and-mail): Give your apps a real mailbox. Receive email at {mailbox-slug}@{org-slug}.worker.email, let agents in your app read it, reply via the same path. Included with every Kapable org — no extra charge. - [Skills](https://docs.kapable.ai/skills): Kapable ships Claude Code skills — installable capabilities that let any Claude Code agent use the platform to your taste. Drop one into ~/.claude/skills/ and invoke it by name in any session; it carries the platform's own doctrine so what it produces is on-brand, not generic scaffolding. - [Artifacts API](https://docs.kapable.ai/artifacts): Durable, designed renders. An artifact is a self-contained HTML document — a report, a plan, a business case, a spec — published once, frozen at a version, addressable forever, and shared with a person rather than queried by a machine. The wiki is the living telling; artifacts are the documents kept. - [Drops API](https://docs.kapable.ai/drops): Zero-knowledge, burn-after-read secret sharing. Hand a credential, key, or sensitive string to a person or an agent once — without it living in a chat transcript, a log, or even the drop server's own database. ## API reference - [API reference](https://docs.kapable.ai/api): Find a module and open its reference. - [Board API](https://docs.kapable.ai/board): Work tracking orchestration -- stories, sprints, plans, products, comments, and sprint closures. Full lifecycle management from backlog to release. - [Store API](https://docs.kapable.ai/store): S3-backed object storage with org-scoped buckets, presigned URLs for direct browser uploads, and cursor-based pagination. - [Kaps API](https://docs.kapable.ai/kaps-api): The route reference for kaps: create and save kaps, manage versions, triggers, tokens and audience, and read and write a kap's database, file store and secrets. For the guide, see Kaps. - [Data API](https://docs.kapable.ai/data): Typed-table CRUD service with dynamic row schemas, full-text search, bulk operations, CSV import/export, and real-time SSE change streams. - [Comms API](https://docs.kapable.ai/comms): Agent communication infrastructure -- agents, mailboxes, channels, rooms, email sending, SSE streams, Telegram bridges, presence, and MCP transport. - [Knowledge API](https://docs.kapable.ai/knowledge): A knowledge graph service for claims, predicates, perspectives, entity resolution, provenance tracking, and invariant monitoring. Build structured knowledge bases with multi-perspective conflict detection. - [AI API](https://docs.kapable.ai/ai): Org-scoped AI provider management and a pass-through proxy: configure provider credentials once per org, then call any provider's native API through Kapable without shipping provider keys to clients. - [Model Catalog](https://docs.kapable.ai/models): Every AI model we track — what it costs, how much context it holds, when it shipped — merged nightly from models.dev and LiteLLM, plus intelligence scores from Artificial Analysis. Below the catalog sits the roster: the models an org has approved for each kind of work. - [Secrets API](https://docs.kapable.ai/secrets): Org-scoped encrypted secrets from strongbox (the encrypted secrets service): store provider keys and app credentials once, reference them by name everywhere (e.g. the AI provider proxy reads provider keys from here at request time). - [Billing API](https://docs.kapable.ai/billing): Stripe-backed org billing: read billing state, initialize a subscription checkout, open the Stripe customer portal, and start checkouts for Warrant-licensed products. - [Wiki API](https://docs.kapable.ai/wiki): Org wikis with markdown pages, collections, tags, and projects — plus AI-assisted authoring: generate pages from prompts or the knowledge graph (the claim store) entities, and regenerate them as the underlying knowledge changes. - [Harbor API](https://docs.kapable.ai/harbor): Harbor handles release files and licenses. Use it to activate a license, check a license, and download a release from releases.kapable.ai. - [Warrant API](https://docs.kapable.ai/warrant): Product licensing and feature entitlements for software you sell: define products, plans, and features; issue signed licenses; and gate features at runtime with offline-verifiable tokens (per-org Ed25519 signing). - [Teams](https://docs.kapable.ai/teams): A team is a named group inside an organization — with its own members, its own roles, and its own bound resources. Teams let an org owner answer “who works on what, and what can they touch?” without giving anyone org-wide permissions they don’t need. This page covers managing teams from the console and carrying team context through the API and SDKs. ## Operate - [Roles & Permissions](https://docs.kapable.ai/roles): Kapable uses role-based access control (RBAC) to manage what members can do within your organisation. This guide explains the built-in roles, how to create custom roles, and best practices for access management. - [Security & Compliance](https://docs.kapable.ai/security): Kapable takes security seriously. This guide covers the platform's security features, compliance controls, and best practices for keeping your organisation safe. - [Troubleshooting](https://docs.kapable.ai/troubleshooting): Common issues and how to resolve them. ## Own server - [Kapable On-Prem](https://docs.kapable.ai/onprem-overview): Run the entire Kapable platform on a server you own — the same services, the same deploy pipeline, the same console that power the cloud, installed by one command against your own domain. With this documentation and a license key, you can stand up a production-shaped Kapable from a blank Ubuntu box. - [Install](https://docs.kapable.ai/onprem-install): One command installs the platform: kapable-ops bootstrap walks a 10-node dependency graph from a blank box to a served, TLS-terminated sample app. Every node is idempotent — the same command is the installer, the verifier, and the repair tool. - [Licensing](https://docs.kapable.ai/onprem-license): An on-prem installation runs under a signed license issued by Kapable. The license is the wall — this documentation is public, the platform bits are licensed. You never receive or handle signing keys; you receive a license for your installation. - [Verify: the Seal](https://docs.kapable.ai/onprem-verify): You don't have to take the installer's word for it. The seal check is a read-only verification pass you run yourself: exit code 0 means your installation is sealed — serving a real app over a real certificate, with its security gates re-proven live. It mutates nothing. - [Operate](https://docs.kapable.ai/onprem-operate): Day-2 on-prem is deliberately boring: the installer is also the repair tool, every error tells you what to do, and the seal check tells you when you're done. There is no separate runbook to memorize. ## Resources - [Changelog](https://docs.kapable.ai/changelog): API changes, new features, and deprecations across all Kapable services.