Installation

Configure > Installation builds the install code for the environment in the address, token filled in.

Before you start

• The page follows the Development and Production switcher in the top row: switch there for the other environment.
• The Development environment answers from any address. Production answers only on a Site under a Domain verified on Domains, whose DNS record can take hours to spread: add it early.

Setting it up

Three steps are required:

1. Add arcy.js. Pick your framework, then how you sign users in. Everything after this step appears once both are chosen. The code, and what init() and identify() do, is on the Quickstart.
2. Replace the placeholders. Shown only when the code you picked has any. What each one means is on the Quickstart.
3. Verify the installation. The check watches for a session carrying this environment's token, and stops after two minutes; Check again restarts it.

Hand it to your agent with the ARCY MCP opens Set up ARCY end to end on ARCY MCP, where your coding agent installs arcy.js and every other surface.

Keep arcy.js up to date

On every framework but HTML, step 1 ends with Keep arcy.js up to date: the update command, such as npm install arcy.js@latest (npm update keeps the old range), and two files that open a pull request for each release and merge it once your checks pass. Its four buttons copy all of it as one task for Claude Code, Cursor, Codex or Antigravity to run in your repository.

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    target-branch: "main"
    schedule:
      interval: "daily"
    cooldown:
      default-days: 2
    allow:
      - dependency-name: "arcy.js"

# Merges Dependabot's arcy.js pull requests once your required checks pass.
name: arcy.js auto-merge

on: pull_request

jobs:
  auto-merge:
    if: github.event.pull_request.user.login == 'dependabot[bot]'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - id: metadata
        # Pinned by digest: a tag can be moved, and this step holds a token
        # that can write to your repository.
        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      # A patch only. A minor can carry a change your own code must make,
      # which the Update arcy.js prompt applies; merging it here would skip
      # that step and leave the change unmade.
      - if: steps.metadata.outputs.dependency-names == 'arcy.js' && steps.metadata.outputs.update-type == 'version-update:semver-patch'
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Name your default branch in target-branch: a missing one stops the bot, and the line keeps allow from limiting your security updates to arcy.js. Add the entry to an existing dependabot.yml, never replacing it. On bun, write bun for npm, which needs bun.lock.

Add the workflow only after your default branch requires a check, or it merges the moment the pull request opens, and turn on Allow auto-merge in your repository's settings. Only a patch merges itself; a minor waits, since it can ask you to change your code.

What it changes

Verify reads what arrives, never a click. On an npm install, Keep arcy.js up to date stays open below the steps; which version each environment runs, and what newer versions change, is on Updates.

When it goes wrong

The verify check names the failure:

• No traffic from this environment: open your site in another tab so arcy.js loads.
• Another environment is receiving sessions: the live code carries its token. Switch the page to it, or replace the token in your code.
• Requests from a Site are refused: the Site is not under a verified Domain. Verify its Domain on Domains.
• Identity verification is failing: wrongly signed sessions continue as anonymous. Check your server's signature on Identity verification.
• Unknown attributes: declare the ones the check lists on Attributes.
• Only localhost traffic so far: the install works; no verified production domain has sent a session yet.

See also

• Quickstart
• API Keys
• Domains