SDK ingest
Open Tools and SDKs in the customer portal and download the package for your language. Your portal permissions control package access. You do not need a GitLab credential.
Configure the application
At runtime, configure:
- The ingest address published by deployment discovery.
- The application ID.
- An application-scoped key created by an authorized administrator or developer.
Application keys authorize only ingest and policy evaluation traffic. They do not authorize CLI user operations, MCP tools, or Azure SQL Ledger verification.
Protect the key
Keep application keys in your approved secret manager. When rotating an existing key, coordinate the application update with its owner. Revoking that same key after rotation also disables its new secret. For a planned change or an exposed key, follow Manage application credentials.
Confirm evidence arrives
For rejected or missing evidence, run veriproof doctor to check local configuration and the
selected deployment. The command is read-only and does not create a session.
Send an approved test session, then find it under the intended application and environment. Inspect the recorded steps and required fields. Connectivity checks alone do not prove that evidence was received or a policy evaluated it.