Interfaces
The interfaces that reach an app's methods (web, API, MCP, agent, voice, cron, webhook, email, task), each with its trigger, its auth, and where it enters, all invoking the same methods through one execution path.
An app's methods are its backend contract. Interfaces are the ways the outside world reaches that contract: a web app, a REST API, an MCP tool server, a conversational agent, a voice line, a cron schedule, a webhook, an inbound mailbox. Every interface invokes the same methods through the same execution path, and a method does not know which interface called it. This chapter covers each interface at the infrastructure level: its trigger, its auth, and where it enters the platform.
#The Matrix
| Interface | Trigger | Auth | Enters at | Runs as | Sandbox |
|---|---|---|---|---|---|
| Web | Browser on the app's origin | App session cookie, or guest | serve and proxy on the HTTP role | The signed-in app user or a visitor | Interactive, warm |
| API | HTTPS request | App API key as bearer | /_/api/... on the app origin, or the platform API host | The key's owner | Interactive, warm |
| MCP | An MCP client | App API key or session | /_/mcp on the app origin | The caller | Interactive, warm |
| Agent | A chat turn from the browser | App session or guest | /_/agent/... | The user; methods as tools | Interactive, warm |
| Voice | A phone call or a browser session | Per-session credential from the voice worker | The voice serve routes | The caller; methods as tools | Interactive, warm |
| Cron | A schedule | None; system invocation | The dispatcher on every HTTP pod | The system user | Disposable |
| Webhook | An external POST | The webhook's configured secret | /_/webhook/... | The system user | Interactive, warm |
| An inbound message | None; system invocation | SMTP on the mail-inbound role | The system user | Disposable | |
| Task | A background task an agent or method starts | Hook token | The task routes | The originating identity | Interactive, warm |
Each interface is declared in the app's manifest, compiled at build time to its platform representation, and diffed against the previous release at promotion so schedules, routes, and mailboxes are added and removed exactly. See Build and Deploy.
#Web
The web interface is the app's frontend build, uploaded per release and served from the app's origin with the session injected. Its calls to the backend go under the internal methods path and are dispatched by the segment switch. Mounted child apps, web routing rules, and embedding origins are validated at build. The interface is safe by construction: every mutation inside it is a method call the platform authorizes.
#API
The API interface exposes methods as REST routes. Callers authenticate with per-user API keys the app issues: shown once, stored as a hash, revocable, and displayed masked. The same routes answer on the app's origin and on the platform's API host with the app named in the path, which is what the CLI tunnel and the editor use in development.
#MCP
The MCP interface exposes the methods the manifest selects as tools, with schemas derived from the method signatures. An MCP client connects to the app's origin, lists tools, and calls them; each call is a method invocation with the caller's identity. A downloadable skill document describes the tool set so an agent can be pointed at the app.
#Agent
The agent interface is a conversational front end over the methods. The platform runs the agent loop in the model service, with the app's methods as tools and its data sources as retrieval; it streams the response and persists threads per user. The agent's model and configuration are compiled from the manifest, and the workspace's model and vendor controls apply.
#Voice
The voice interface puts the same methods behind a phone number or a browser call. See Voice.
#Cron
A cron interface is a schedule and a method. The build writes the schedule to the job table. A dispatcher on every HTTP pod claims due jobs with row-level locking that skips already-claimed rows, so pods compose rather than race. Each run is a system invocation on a disposable sandbox, finalized exactly once, with missed ticks coalesced after an outage and a per-workspace concurrency cap. Consecutive failures pause a job; platform-side failures do not count against it.
#Webhook
A webhook interface is a route and a method. The platform verifies the configured secret and runs the method as a system invocation on a warm sandbox, because webhook senders enforce response latency.
An email interface is an address on the app's subdomain and a method. The mail-inbound role accepts the message over SMTP, resolves the app from the recipient, and runs the method as a system invocation on a disposable sandbox with the parsed message as input. See Email.
#Task
A method or an agent can start a task. A task is a background unit of work with its own identity, progress, and result; it runs on the app's methods and reports back through the platform.
Figure 27, "Interfaces": one backend, many doors. Left: a column of nine interface doors, each labelled with its trigger and its authentication. Web (browser, session or guest) · API (HTTPS, per-user API key) · MCP (client, key or session) · Agent (chat turn, session or guest) · Voice (call, per-session credential) · Cron (schedule, system) · Webhook (external POST, shared secret) · Email (SMTP, system) · Task (background start, hook token). Cron and Email carry a second line, "disposable sandbox"; the rest are interactive and warm. The nine doors feed a collector that lands on one heavy node on the right, "The methods": the app's backend contract, reached through one authorization and one execution path, so a method does not know which door it came through. A header over the column notes that all nine are declared in the manifest, compiled at build, and diffed at promotion. A cross-reference points to Figure 15 for the execution path each door lands on. No trust boundary is drawn in this figure, so there is no crimson.