Anypoint Self-Hosting Setup

Skip this page if you use a hosted Agent Explorer — connecting takes one click and needs no setup. This page is for running your own instance.

Agent Explorer authenticates to Anypoint as a registered OAuth application. You register it once; everyone using your instance then just clicks Connect.

1. Register a Connected App

In Anypoint, go to Access Management → Connected Apps → Owned Apps and create an app of type App acts on behalf of user.

Add this redirect URI, matching your deployment's origin exactly:

https://your-agent-explorer.example.com/api/anypoint/callback

For local development add a second entry:

http://localhost:3000/api/anypoint/callback

Grant these scopes: read:full, profile, email, offline_access.

1a. Pin the redirect URI

Set ANYPOINT_REDIRECT_URI to the exact value you registered:

ANYPOINT_REDIRECT_URI=https://your-agent-explorer.example.com/api/anypoint/callback

This is required on any hosted deployment. Without it the redirect URI is derived from the incoming request's origin, which fails wherever that origin is not the registered one — notably every preview deployment, which gets a unique hostname that cannot be registered in advance. Leave it unset only for local development.

2. Set environment variables

Each control plane is a separate Anypoint deployment and needs its own registration. Configure only the planes you intend to serve:

ANYPOINT_CLIENT_ID_US=...        ANYPOINT_CLIENT_SECRET_US=...
ANYPOINT_CLIENT_ID_EU=...        ANYPOINT_CLIENT_SECRET_EU=...
ANYPOINT_CLIENT_ID_GOV=...       ANYPOINT_CLIENT_SECRET_GOV=...

# A private or regional control plane
ANYPOINT_CUSTOM_HOST=anypoint.internal.example.com
ANYPOINT_CLIENT_ID_CUSTOM=...    ANYPOINT_CLIENT_SECRET_CUSTOM=...

The control-plane dropdown shows only planes with a complete configuration. A plane with a client ID but no secret is treated as unconfigured.

ANYPOINT_CUSTOM_HOST must be a hostname only — no https://, no path, no port.

Tokens are encrypted at rest with OAUTH_ENCRYPTION_KEY, which must already be set.

3. Verify

Open /anypoint. You should see a Connect button rather than "Setup required".

Common problems

Anypoint rejects the authorization before returning. The redirect URI does not match a registered value exactly, including scheme and port. On a hosted deployment this almost always means ANYPOINT_REDIRECT_URI is unset and the origin is being used instead.

Users reconnect every session. The offline_access scope is missing from the Connected App, so Anypoint issues no refresh token.