Connect your app
Install the SDK in your demo deployment and run the agent beside it. Keep the project key on the server. Install with npm install @trylane/sdk @trylane/adapter-postgres postgres.
import { Trylane } from "@trylane/sdk";
import { postgresAdapter, withVisitor } from "@trylane/adapter-postgres";
const adapter = postgresAdapter(demoDb, [agency]);
await demo.run(adapter, abortController.signal);
// In a request handler:
const grant = await demo.verify(identity, "invoice.read");
await withVisitor(demoDb, grant, async (tx) => {
return tx`select * from invoices`; // row-level security applies
});1. Add a product
In your workspace, add a product with a public link name and the HTTPS origin of your demo deployment. Copy the project key that appears once, and store it in your app’s and agent’s secrets. Trylane never calls this origin to run code; visitors are sent to /enter on it.
2. Write an adapter
Implement the Adapter contract: a manifest describing your recipes and an execute(job) function. The PostgreSQL helper wraps your seed and cleanup functions in transactions, resource locks and cleanup tombstones.
3. Check every request
When a visitor arrives at /enter, exchange the one-time code on your server, store the identity in a signed HttpOnly cookie, and call demo.verify(identity, action) before each operation. Scope every query to the returned grant.
4. Start the agent and publish
Run demo.run(adapter, signal) as a long-lived process. Once it reports a heartbeat, the product page in your workspace walks you through choosing sample data and publishing.
Show visitors what to try
Add an endpoint that returns demo.progress(identity), then add <script src="https://trylane.app/widget.js" data-endpoint="/api/trylane/progress" defer> to your demo pages and allow that origin in script-src. Visitors see the checklist you wrote for the scenario, ticked off as your app reports milestones. To pin a version with Subresource Integrity, host a copy of widget.js yourself.
5. Run the doctor
Export { sql, recipes, transfer? } from a module and run npx trylane-doctor ./path/to/module. It checks your visitor role, forced row-level security with USING and WITH CHECK on every table that references trylane_resources, seeding, isolation between two throwaway visitors, Keep export and cleanup, then removes everything it created. Add --no-dry-run to skip writing to the database.
See every step from the visitor’s side.
Try the Ledger example