# Claiming and the sandbox

`mirio init` needs no account, so an agent can go from a prompt to a tested form on localhost without a human. The trade-off is that anonymous projects must not collect real people's data. Unclaimed projects therefore run in a sandbox.

## Sandbox rules

- Submissions are accepted only from localhost origins (`localhost`, `127.0.0.1`, `*.localhost`, any port). A public origin gets HTTP 403 with code `project_unclaimed` and the claim link in the hint.
- Requests made with the project's secret key (the CLI, server code) are accepted without an origin check, because they are the owner's own test traffic.
- Sandbox data expires after 72 hours. Read it with `mirio submissions`.
- No emails or webhooks are sent from a sandbox project.
- `mirio status` and `mirio push` warn; `mirio check` fails a production build.

## Claiming

The claim link looks like `https://trymirio.com/claim/<token>`. A human opens it, signs in with Google, GitHub or a code sent to their email, picks or creates a workspace, accepts the terms, and enters the production domains (one per line; `example.com`, `https://app.example.com`, or `*.example.com`). The project becomes live and starts accepting submissions from those origins. The secret key does not change.

Claiming gives every live form an identified owner who has accepted the terms, which matters under GDPR and for abuse response.

## Content Security Policy

Sites with a CSP must list the API in `connect-src`: `https://api.trymirio.com` in production and your local API URL in development. Without it the browser refuses the request before it reaches Mirio.

## Connecting a site created in the dashboard

A site can also start in the dashboard (sign up at [trymirio.com/signup](https://trymirio.com/signup)): **New form** creates the site (already yours, no claim step) and a draft form. The draft's page has **Copy prompt**: it holds a one-time setup command for the coding agent,

```bash
npx @trymirio/mirio init --link mil_XXXXX-XXXXX-XXXXX-XXXXX
```

which writes `mirio.json` and `.mirio/secret` for that site and lists the drafts waiting for their files. The agent then writes `mirio/forms/<slug>.ts`; the first registration turns the draft into a live form and keeps the notifications and triage settings you already set up. Codes work once and expire after 24 hours; copy the prompt again for a new one. To move a site to another repo, open the site under **Sites** and use **Reconnect with a new key** (the old repo's key stops working).

## After claiming

- Add more domains any time: `npx mirio domains add acme.com` (or the site's page under Sites in the dashboard); `acme.com` also covers `www.acme.com`, and the other way round. Domains belong to the site, not to a form. Localhost keeps working on a live site; those responses are stored as `test`.
- The person who claims the site (or creates it in the dashboard) gets email notifications on every form, including forms added later, unless a form already has a destination. Add teammates to the workspace to notify them too (email goes to members only), or use Slack for shared channels.
- `mirio status` shows `live` and `mirio check` passes.