# Not Organic integration Start: https://docs.notorganic.info/integrate Apply: https://id.notorganic.info/?view=integrations&product=notorganic Not Organic connects portable ATProto/PDS accounts, workspaces and scoped AI services. Production third-party apps require review and an explicit origin mapping. A pending application does not enable access. Browser helper: download https://docs.notorganic.info/notorganic-sign-in.js and host with the app. createSignInRequest({clientId: location.origin, redirectUri: new URL('/auth/notorganic', location.origin).href, scopes: ['wallet:read']}) returns an attempt with URL, verifier, state and expiry. Store the attempt in sessionStorage before navigation. On callback consume the stored attempt once, retain the callback URL locally, remove callback parameters from browser history, then call completeSignIn(attempt, callbackUrl). It returns a proof-bound BrowserClient. Catch failures and offer a new attempt. Credentials remain in memory and access lasts five minutes. This starter does not implement persistent refresh. See the authentication guide for device sessions. Ordinary cross-origin account links do not sign a user into an application. Never embed provider or product signing secrets. Public MCP: https://id.notorganic.info/mcp, Streamable HTTP. This MCP exposes public guidance only, not account data or administrative mutations. --- # Learning and workspace design Full architecture: https://docs.notorganic.info/learning Choose context-only, personal adaptation, organization adaptation, or shared adaptation with private personal context. Per-customer LoRA is optional. Keep account identity, workspace ownership, training eligibility and serving access distinct. A PDS identity does not imply that every private artifact is stored in a public record. The existing account-evolution contracts manage artifacts, evidence, jobs and active revisions. Routes include /v1/evolution/artifacts, /v1/evolution/evidence, /v1/evolution/jobs, and /v1/evolution/active-revision. Required scopes are evolution:read, evolution:write and evolution:execute, depending on the action. Ordinary public browser access does not grant these scopes. Managed training/serving, organization membership and workspace portability require integration-specific setup and verification. Do not invent APIs for these. Agree on provenance, consent, training/evaluation separation, budget, compatibility, regression checks and rollback. Removing source data does not necessarily remove its influence from trained weights. --- # Integration review Admin panel: https://id.notorganic.info/?view=admin&product=notorganic Operator guide: https://docs.notorganic.info/admin Admin access is denied unless the authenticated DID is explicitly assigned by the operator. No admin identity is assigned by default. Applicants cannot approve themselves. Reviews require a note visible to the applicant and are recorded in audit history. Concurrent edits are rejected until the application is refreshed. Approval records a business review. Launch access is configured separately: verify control of the origin, configure exact origin and product scope, CORS, required providers/billing and permitted services; then verify a real applicant-approved sign-in and API request. No automatic deployment, purchase or training is performed by a review. Public MCP guidance never grants admin privileges. --- # Integrate my app with Not Organic Integrate this application with Not Organic. First inspect the repository and identify the framework, app origin, callback route and existing authentication. Read https://docs.notorganic.info/integrate and https://docs.notorganic.info/ai/integration.md, or use the Not Organic MCP guides. Use the supplied browser sign-in module where appropriate. Implement a user-triggered sign-in with PKCE and state, a single-use callback attempt, clear loading/error states and recovery. Keep provider secrets out of browser code. Request only necessary scopes. Do not assume production access: applications require review and exact-origin configuration. Do not submit an application, change deployment settings, spend money or create an account without user authorization. Verify callback mismatch, stale state and unsuccessful exchange. Report local checks separately from a real user-approved sign-in. --- # Plan the right learning scope Design a Not Organic learning integration for this product. Read https://docs.notorganic.info/learning and https://docs.notorganic.info/ai/learning.md. Compare context-only, individual LoRA, organization LoRA, and organization adaptation plus private individual context. Ask only for missing business decisions. Define account/workspace ownership, permitted training data, consent, isolation, evaluation, budget, serving compatibility, revision promotion and rollback. A personal adapter is optional. Existing evolution APIs manage artifacts, evidence, jobs and revisions; do not invent a hosted LoRA training API or organization membership endpoint. Identify what is implemented, what needs provider configuration and what needs engineering. Do not launch training, publish data or spend money without authorization. --- # Diagnose a sign-in or AI response failure Diagnose this Not Organic integration using https://docs.notorganic.info/authentication and https://docs.notorganic.info/operations. Trace the path from the user's sign-in action through callback, token exchange, scoped request, wallet and model response. Use sanitized errors and request references. Never request or print passwords, tokens, private keys, cookies or authorization codes. Keep approval failures, CORS, expired sessions, insufficient wallet balance and upstream provider failures distinct. Preserve the user's message and offer the appropriate recovery. A healthy endpoint or passing unit test is not proof of end-to-end sign-in or inference. Report exactly which stage is verified.