# APP.md — how the floor uses raidbay.dev

raidbay.dev is the **public door**. It is not the authorizer.

## Links the floor may use

- Footer → `https://raidbay.dev`
- After a room exists, copy a display-only join URL:
  `https://raidbay.dev/join/<joinCode>`
  Show it. Do not treat it as a Grant.

## What must stay on loopback

- Health / presence
- `POST /v0/intent`, `/v0/complete`, `/v0/grants`
- WebSocket seats
- Anything that needs the keep

**The app must never retarget `/v0/*` at raidbay.dev.**

## Keep path (local only)

- macOS / Linux: `~/.raidbay/keep/xai.key`
- Windows: `%USERPROFILE%\.raidbay\keep\xai.key`

Never paste a key into the door. The door has nowhere to put one.

## Discovery

`https://raidbay.dev/.well-known/raidbay.json` states `publicRelay: false` and points authorizer at `127.0.0.1:8787`.