An installable custom service is exactly that: a real service running in its own container — document processing, a specialist model, an industry calculation, anything that does not belong inside a visual builder. It arrives as a signed package, declares the endpoints it exposes, and is then callable from your pages, workflows, scheduled jobs, and AI actions. In the product these are called appliance endpoints.
Every version is signed, and signing key history is retained so an old release can still be verified.
The exact build and the exact declared contract, both fingerprinted.
A bill of materials for what is inside the package, for the review your security team will ask for.
One value derived from the manifest, the image, and the egress policy together — a single thing to compare.
Provenance tells you what is running. These three tell you what it is allowed to do.
A package states what it needs to reach. Sealed means nothing. Allowlist means exactly the declared destinations and nothing else.
A version cannot be listed until it passes validation, so the marketplace does not become a distribution channel for unfinished work.
A bad release can be revoked centrally rather than depending on every installer noticing and acting.
Request and response hashes, outcome, status, duration, package version, endpoint, and the code identity frozen at the moment of the call.
The execution path is deliberately boring, because the interesting failures happen when it is not.
They are closely related. An extension is custom code you commission for your own application. An appliance is that same isolated-container model packaged as a distributable, signed, versioned product that others can install.
Only if its manifest declares it. Sealed packages reach nothing at all, allowlist packages reach only what they declared, and the manifest is authoritative — a mismatch is a validation failure, not a warning.
A release can be revoked. Revocation does not depend on every installer noticing an advisory and acting on it.
Create an account, explore the full builder console, and launch your first application on a custom domain. Nothing is charged while your application is still in development.
No credit card required. The console preview, the documentation, and the architecture reference are all readable before you sign up.
Get started free Read the docsAn app has routed Core, Logs and AI database planes. Provisioning is a staged operation: wait for readiness and any reported setup requirements before inviting customers. Marketplace presentation installs are pinned snapshots; upgrading a template is explicit. Customer-hosted Appliance operation and optional extension compute have their own deployment requirements.
Read the guide