Orchestration Setup

Service Information

Prerequisites

Before starting, the user needs:

  1. An invite code — provided by their administrator
  2. The email address the invite was issued to

Setup Steps

Step 1: Collect Information

Ask the user for:

  1. Invite code — the code they received from their administrator
  2. Email address — must match the email the invite was issued to
  3. Username — 3-30 characters, alphanumeric and hyphens, no leading/trailing hyphens
  4. Password — minimum 12 characters, must contain uppercase, lowercase, digit, and special character

Also ask what they want to name their project (used for Triad tenant/project naming).

Step 2: Validate Invite (Optional Pre-check)

Before registration, you can verify the invite code is valid:

POST https://orc.aoendpoint.com/api/validate-invite
Content-Type: application/json

{
  "code": "THE_INVITE_CODE",
  "email": "user@example.com"
}

Success: 200 { "data": { "valid": true } }
Errors:
  404 INVALID_INVITE — code not found or email mismatch
  410 INVITE_ALREADY_USED — code already redeemed
  410 INVITE_EXPIRED — code past expiration

Step 3: Register

POST https://orc.aoendpoint.com/api/register
Content-Type: application/json

{
  "invite_code": "THE_INVITE_CODE",
  "email": "user@example.com",
  "username": "chosen-username",
  "password": "SecureP@ssw0rd!"
}

Success: 201
{
  "data": {
    "id": "uuid",
    "email": "user@example.com",
    "username": "chosen-username",
    "status": "active",
    "created_at": "2026-02-26T00:00:00Z"
  },
  "provisioning": {
    "doit": {
      "tenant_slug": "chosen-username",
      "api_key": "SHOWN_ONCE_SAVE_NOW",
      "api_key_prefix": "abcd1234",
      "project_slug": "default",
      "status": "success"
    }
  }
}

Errors:
  400 INVALID_INVITE — code not found or email mismatch
  400 INVALID_EMAIL — bad email format
  400 INVALID_USERNAME — bad username format
  400 WEAK_PASSWORD — password policy not met
  409 USERNAME_TAKEN — username already exists
  409 EMAIL_TAKEN — email already registered
  410 INVITE_ALREADY_USED — code already redeemed
  410 INVITE_EXPIRED — code past expiration

Step 4: Save API Key

IMPORTANT: The API key in the provisioning response is shown exactly once and cannot be retrieved again. Present it to the user immediately and warn them to save the key.

Display something like:

Your account has been created. Here is your Doit API key — save it now, it will not be shown again:
Doit: [key]

Step 5: Install Scaffolding

Fetch the scaffolding templates:

GET https://orc.aoendpoint.com/api/scaffolding

This returns a JSON object with file paths and template contents. For each file:

  1. Replace placeholders with the user's values:
    • {{PROJECT_NAME}} — the user's project name
    • {{PROJECT_KEY}} — the user's project key (slug form of project name)
    • {{DOIT_URL}}https://din.aoendpoint.com
    • {{DOIT_API_KEY}} — the Doit API key from registration
  2. Create the file at the specified path relative to the project root

This delivers 37 files total:

Step 6: Configure MCP Server

Add the Doit MCP server to the project's .mcp.json file:

{
  "mcpServers": {
    "doit": {
      "type": "url",
      "url": "https://din.aoendpoint.com/mcp",
      "headers": { "Authorization": "Bearer {{DOIT_API_KEY}}" }
    }
  }
}

Replace {{DOIT_API_KEY}} with the actual API key from Step 4.

Verification

After setup, verify everything works by running these checks:

  1. Doit: Call doit_list_projects() — expect the user's "default" project to appear
  2. Config: Verify .orchestra/config.yaml exists with correct API key
  3. Governance: Verify CLAUDE.md exists with orchestration instructions

If all checks pass, setup is complete. Suggest the user run /orc-backlog to see the system working.

Troubleshooting

ErrorCauseResolution
INVALID_INVITECode not found or email doesn't matchDouble-check the invite code and use the exact email it was issued to
INVITE_EXPIREDCode past its expiration dateContact administrator for a new invite code
INVITE_ALREADY_USEDCode was already redeemedEach code is single-use. Contact administrator for a new one
USERNAME_TAKENUsername already registeredChoose a different username
EMAIL_TAKENEmail already registeredUse a different email or contact administrator
WEAK_PASSWORDPassword doesn't meet policyUse 12+ chars with uppercase, lowercase, digit, and special character
Provisioning failedOne or more Triad services unreachableAccount was created. Contact administrator to manually provision failed services
MCP auth error after setupAPI key not configured correctlyCheck .mcp.json has the correct keys. Keys are case-sensitive.