# Developer overview

> Everything programmable in OpenAgent: the widget embed and JavaScript SDK, verified identity, webhooks out, the CRM ingest API in, the Contacts API, and the hosted MCP server.

OpenAgent is operable without code — but every edge is programmable. This section covers the surfaces you'd wire into your own site or backend:

- [Embed & JavaScript SDK](/docs/developers/embed-sdk) — One script tag; window.bookbag to control the widget from your own UI.
- [Identity verification](/docs/developers/identity-verification) — Server-signed HMAC identity: the agent knows who it's talking to, provably.
- [Webhooks](/docs/developers/webhooks) — Signed HTTP POSTs when leads land, conversations end, or actions run.
- [CRM ingest API](/docs/api/crm-ingest) — POST any form's fields into a board with a crk_ Connections key.
- [Contacts API](/docs/api/contacts) — Create, upsert, and manage contacts and custom attributes.
- [MCP server](/docs/mcp/overview) — The whole platform as tools for any MCP-capable AI.

## Auth at a glance

| Credential | Prefix | Used for |
| --- | --- | --- |
| Workspace API key | `bk_…` | The [MCP server](/docs/mcp/overview) and workspace APIs — full access, treat as a password. |
| CRM Connections key | `crk_…` | Write-only lead ingest to one board/column. Safe to give a partner site. |
| Agent signing secret | (per agent) | HMAC for [identity verification](/docs/developers/identity-verification) — server-side only. |
| Webhook signing secret | (per endpoint) | Verifying [webhook](/docs/developers/webhooks) deliveries are really from OpenAgent. |