Build for other workspaces

Custral has three things you can register, and they answer different questions. Pick the row that matches what you are building before you create anything.

Which one do you need?

You want to	Register	Reviewed by
Read or write your own workspace from your code	An application and an API key	Nobody
Show a tool your team already uses (Grafana, Metabase, Loom) on a page	Nothing. Paste the URL into the Embed block	Nobody
Connect Claude, Cursor or another MCP client	Nothing. The client registers itself through MCP	The admin who approves it
Ship UI that other workspaces install, with access to their data	A provider, then an embed block	Custral, then each installing admin

Most integrations are the first row. A provider is only needed when a workspace you do not belong to will install what you build.

The pieces

your workspace

A container for API keys, created in Settings → Applications. Its keys act on the workspace that created it and nowhere else. See Applications & API keys.

your account

The name your integration is listed under, like GitHub or Stripe. It belongs to your Custral account across every workspace you are in, and you get one by applying for developer access.

your provider

One thing a provider ships. An embed block frames a page you host inside a customer’s workspace. Workflow and task blocks exist too, but only an embed can be submitted for review from the portal today.

your provider

A group of blocks a workspace installs together. Installing a module is where the workspace admin is shown what your blocks can read.

the customer's workspace

A workspace’s record that it installed your module. Uninstalling it stops every token your blocks were handed, immediately.

How a provider’s embed reaches a workspace

Apply for developer access

At app.custral.com/developers. Custral approves the application and creates your provider.

Create an embed block and declare it

In the provider portal, give the block an origin, a URL template and the scopes it needs. Saving the declaration submits it.

Custral reviews the declaration

A reviewer checks the origin belongs to you, the scopes fit what the block does, and the template cannot resolve anywhere else.

A workspace admin installs your module

They are shown the scopes your blocks ask for and decide whether to accept them. A module whose blocks ask for no scopes installs without a prompt.

Members add the block to a page

Your page is framed in a sandbox and receives a short-lived token over postMessage. See Embed blocks for the protocol.

Two kinds of embed, two levels of trust

	Authored by	Reviewed by	Asks for scopes	Gets a token
Pasted URL	Anyone who can edit the page	Nobody	No	No
Provider embed	A developer with an approved provider	Custral, then the installing admin	Yes	Yes

Both gates on a provider embed are needed. Custral can check that embed.acme.com belongs to Acme, but it cannot know whether a given workspace is comfortable handing Acme its conversations. The admin can make that call, but cannot audit Acme’s origin and URL template.

Limits today

Your code runs on your servers. Custral frames your page and calls your URLs. It never executes code you upload.
One provider per account. A second provider is set up by Custral on request.
Only embed blocks go through the review queue. A workflow or task block is created private, and Custral lists one by hand.
Being approved does not list you. A new provider, and every module it creates, is hidden from workspaces until Custral lists it.
An unlisted embed still works. A block Custral approves as unlisted stays out of the catalog, and a workspace that installs its module can still add it to a page.

Next steps

Become a provider

Apply for developer access and open the provider portal.

Register an embed block

Declare what your block frames, submit it, and get it installed.

Embed protocol

The postMessage handshake, the token, and reading your block’s rows.

Applications & API keys

For code that acts on your own workspace.

Get started

Manage your integration