ORYH user guide

Connect ORYH to the agent you already use.

Download one credential-free bootstrap Skill, approve the device in your browser, and let ORYH deliver only the company Skills your identity is allowed to receive.

Download
No credential or company data
Authentication
Browser approval with a short-lived code
Authorization
Live role and Skill-audience checks

Before you start

Four requirements make the connection real.

01

An ORYH user

You need an active company account that can sign in to the ORYH browser console.

02

An Agent Skills host

The agent must discover a SKILL.md directory and follow its referenced files.

03

Local tools

The runtime needs outbound HTTPS, archive extraction, and a persistent writable Skill directory.

04

Company policy

Your organization must permit this runtime and the data it will handle.

Client status · 6 September 2026

Choose a client. Validate the workflow.

Codex, Claude Code, Hermes and OpenClaw are certified clients. Client certification is separate from validation of a specific business workflow. Check its status, then test your client version, permissions and exception paths before rollout. The additional host instructions below do not extend certification to GitHub Copilot or Claude Cowork.

Step 1 · Download

Get ORYH Connect from the ORYH deployment you will use.

The public zip is safe to distribute inside your organization because it has no user identity, password, API key, or company records. It does carry the issuing deployment's address, so download it from the same ORYH environment you intend to connect.

oryh-connect.zipCredential-free bootstrap Skill

Contains oryh-connect/SKILL.md and its connection reference.

Download zip
Terminal downloadReplace the origin for a private deployment
curl -fL https://oryh.ai/api/v1/connect-skill -o oryh-connect.zip
unzip -l oryh-connect.zip
Inspect before installing.

A Skill is executable guidance for an agent. Review SKILL.md, its references, and any scripts before enabling any Skill package, including internal packages.

Step 2 · Install

Put the bootstrap Skill where your agent discovers Skills.

Each example below leaves the resulting entry at the path shown. On Windows without WSL, unzip with the desktop archive tool and move the oryh-connect folder to the equivalent user Skill location.

CodexCodex app, CLI, and IDE extensionORYH validation planned
Expected Skill entry~/.agents/skills/oryh-connect/SKILL.md

For macOS, Linux, or WSL:

mkdir -p ~/.agents/skills
unzip oryh-connect.zip -d ~/.agents/skills

Codex detects Skill changes automatically. Restart Codex if the new Skill does not appear.

Type this in your agent
$oryh-connect Connect this device to ORYH.

Host installation location verified from the Codex documentation. This does not yet mean ORYH has passed a pinned-version, end-to-end workflow validation on this runtime.

Claude CodeLocal Claude Code sessionsORYH validation planned
Expected Skill entry~/.claude/skills/oryh-connect/SKILL.md

For macOS, Linux, or WSL:

mkdir -p ~/.claude/skills
unzip oryh-connect.zip -d ~/.claude/skills

Existing Skill roots reload live. Restart Claude Code if ~/.claude/skills did not exist when the session started.

Type this in your agent
/oryh-connect Connect this device to ORYH.

Host installation location verified from the Claude Code documentation. This does not yet mean ORYH has passed a pinned-version, end-to-end workflow validation on this runtime.

Hermes AgentHermes CLI and connected messaging surfacesORYH validation planned
Expected Skill entry~/.hermes/skills/oryh-connect/SKILL.md

For macOS, Linux, or WSL:

mkdir -p ~/.hermes/skills
unzip oryh-connect.zip -d ~/.hermes/skills

Start a new session, or reload the session after confirming the Skill appears in hermes skills list.

Type this in your agent
/oryh-connect Connect this device to ORYH.

Host installation location verified from the Hermes Agent documentation. This does not yet mean ORYH has passed a pinned-version, end-to-end workflow validation on this runtime.

OpenClawOpenClaw workspace or managed local SkillsORYH validation planned
Expected Skill entry~/.openclaw/skills/oryh-connect/SKILL.md

For macOS, Linux, or WSL:

unzip oryh-connect.zip
openclaw skills install ./oryh-connect --global

OpenClaw installs local directories, not zip archives. Unzip first, then confirm with openclaw skills info oryh-connect.

Type this in your agent
/oryh-connect Connect this device to ORYH.

Host installation location verified from the OpenClaw documentation. This does not yet mean ORYH has passed a pinned-version, end-to-end workflow validation on this runtime.

GitHub CopilotCopilot CLI and supported agent modesORYH validation planned
Expected Skill entry~/.agents/skills/oryh-connect/SKILL.md

For macOS, Linux, or WSL:

mkdir -p ~/.agents/skills
unzip oryh-connect.zip -d ~/.agents/skills

In Copilot CLI, run /skills reload and then /skills info oryh-connect.

Type this in your agent
/oryh-connect Connect this device to ORYH.

Host installation location verified from the GitHub Copilot documentation. This does not yet mean ORYH has passed a pinned-version, end-to-end workflow validation on this runtime.

Claude chat and Cowork

Custom Skill upload is not yet the complete ORYH connection path.

Claude can upload a custom zip through Customize → Skills, but the current ORYH flow must also replace a personal, credential-bearing Skill bundle in a durable local Skill root after authorization. ORYH does not yet ship a managed Cowork installer for that second step. Use only a local agent surface that your pilot team has explicitly validated; do not upload a personal ORYH bundle to Cowork as a workaround.

Read Claude's custom Skill documentation

Step 3 · Authorize

Authentication starts in the agent and finishes in your browser.

Type this in your agent
Connect this device to my company's ORYH.
  1. 01

    Start from the agent

    Ask the agent to connect this device to ORYH. The bootstrap Skill starts a short-lived device authorization and identifies the agent and machine requesting access.

  2. 02

    Open the ORYH link

    The agent shows a browser link and an eight-character code. Open the link yourself; the link also works when the agent runs over SSH, in WSL, or inside a container.

  3. 03

    Sign in and verify

    Enter your ORYH credentials only on the ORYH website. Check that the displayed code and device name match what the agent showed, then authorize or deny the request.

  4. 04

    Receive a device credential

    After approval, the agent receives a new credential for this device exactly once. Connecting another device does not invalidate credentials on devices you already use.

  5. 05

    Install the personal bundle

    The agent downloads the Skills allowed by your current role and audience assignments, installs the company bundle as one unit, and keeps each employer in a separate namespaced directory.

The agent sees

  • The device authorization status
  • The company and user identity returned after approval
  • A one-time device credential
  • The personal Skill bundle allowed for that identity

The agent never needs

  • Your ORYH password
  • A password copied from the browser
  • A company selected by an unverified prompt
  • A credential copied between employers or devices
The personal bundle is a secret.

Unlike the public bootstrap zip, the personal bundle embeds this device's ORYH credential in its Skill files. Do not share it, upload it to a public service, or commit it to source control. Delete any temporary zip after installation.

Step 4 · Use ORYH

Ask for the business outcome, not an API operation.

The agent selects an installed company Skill from your natural-language request. You receive only the scenarios allowed by your role and the Skill's audience. For consequential writes, ask the agent to show the complete proposed result before it acts.

Connection

Connect or recover a device

Available nowEvery user
Type this in your agent
Connect this device to my company's ORYH.
Expected result
The agent starts browser authorization, shows the verification code, and installs the personal bundle after approval.
Boundary
Never give the agent your password. A revoked or expired credential is recovered by running this flow again.
Personal work

Review work waiting for you

Available nowEmployees and approvers
Type this in your agent
Show me everything waiting for me in ORYH, and flag anything returned or overdue.
Expected result
The agent retrieves the connected user's open work and explains the source record and current state.
Boundary
Results depend on the connected identity and the work assigned to it.
Time

Submit a complete timesheet

Available nowEmployees with timesheet access
Type this in your agent
Submit last week's time: Monday was eight hours of customer research, Tuesday through Thursday was proposal work, and Friday was the client readout. Show me the full week before you submit it.
Expected result
The agent resolves the period, checks the entries, reads back the full week, and writes only after explicit confirmation.
Boundary
Approval routing is advanced by the configured workflow agent; submitting a record alone does not imply automatic manager approval.
Finance

File expenses with evidence

Available nowEmployees with expense access
Type this in your agent
File these three travel receipts against the Meridian project. Send the client-dinner exception to finance, and let me confirm every receipt before submission.
Expected result
The agent proposes values from the files, checks possible duplicates, and keeps the confirmed fields with their source evidence.
Boundary
Receipt reading depends on the selected agent's file and vision capabilities; ORYH validates the submitted facts but is not the OCR engine.
Procurement

Create a purchase request

Available nowRequesters with purchasing access
Type this in your agent
Request three Dell monitors at about 3,000 each. We do not have a final quote yet, so mark the price as estimated and show me the request before submitting.
Expected result
The agent resolves available vendor and product facts, records uncertainty explicitly, and asks for confirmation before writing.
Boundary
Creating a supplier purchase order and recording receipt require separate authorized actions.
Approvals

Decide one item at a time

Available nowAssigned approvers
Type this in your agent
Show my pending approvals, explain the material exceptions, and let me approve or return each item individually.
Expected result
The agent presents each assigned task with its source record and records the approver's explicit decision.
Boundary
The approver records a decision; a separate workflow agent advances later nodes or the final business state.
Sales

Revise a quotation and create an order

Available nowSales users with quotation or order access
Type this in your agent
The customer accepted quotation Q-1042. Create the sales order from the accepted revision and list any missing fulfilment details before you write it.
Expected result
The agent preserves the accepted commercial facts and links the new order to its source quotation.
Boundary
Sending documents to a customer or a fulfilment system requires a configured external integration or a human handoff.
Resources

Book a room or shared device

Available nowUsers with booking access
Type this in your agent
Reserve the testing room and two devices for the Meridian workshop next Thursday afternoon. Show conflicts and alternatives before booking.
Expected result
The agent checks ORYH availability, presents the selected resources, and commits the reservation after confirmation.
Boundary
ORYH resource booking does not by itself synchronize an external calendar or send invitations.
Finance

Bill a customer and collect

Available nowAccounts-receivable staff
Type this in your agent
Invoice Shanghai First Hospital for order SO-2026-0031 on 30-day terms, then tell me which of their invoices are already overdue.
Expected result
The agent issues the invoice against the order, records its due date, and lists what is still outstanding — measured against the settlement ledger, not a status.
Boundary
Which customer a bank transfer belongs to is a judgment the agent puts to you; ORYH refuses to over-apply money or to match across currencies, but it does not identify payers.
Finance

Match a payment to invoices

Available nowAccounts staff with settlement access
Type this in your agent
We received 60,000 from Shanghai First Hospital. Apply it to their two open invoices, oldest first, and show me what is left over.
Expected result
The agent records the receipt and applies it across the invoices, reporting each one's remaining balance and any advance still unmatched.
Boundary
Applications are append-only: a wrong match is corrected by a reversing entry that stays visible, never by editing or deleting the original.
Finance

Check a supplier invoice before paying

Available nowAccounts-payable staff and approvers
Type this in your agent
The Dell invoice for PO-2026-00012 arrived. Compare it against what we ordered and what actually arrived, and check the payee account against their record before you file the payment request.
Expected result
The agent books the invoice, reports ordered vs received vs billed per line with the differences, and flags an account that does not match the supplier's own record.
Boundary
ORYH states the differences; whether a gap is acceptable is decided by your company's published workflow definition and the approver, never by the system.
Finance

Take a prepayment and draw against it

Available nowAccounts staff
Type this in your agent
Shanghai First Hospital prepaid 100,000. Put it on their account, then charge this month's 23,000 against it and tell me what is left.
Expected result
The agent applies the receipt to the customer's standing account and records the charge, reporting the remaining balance and how much credit is still available.
Boundary
The account's balance can only go negative as far as the credit limit someone set for it; a movement past that is refused and reported, not silently allowed.
Membership

Grant and redeem loyalty points

ConfigurableMembership and customer-facing staff
Type this in your agent
Give this member points for the order, then use 500 of them against today's invoice and show me the balance.
Expected result
The agent posts the points and records the redemption as two facts: the points leaving the account, and the matching discount on the invoice.
Boundary
How many points a purchase earns and what they are worth are your company's rules, published in its workflow definition. ORYH never converts points into money on its own.
Company records

Operate a configured record

ConfigurableUsers assigned the published company Skill
Type this in your agent
Create a warranty-card application for installed asset IA-00421, then link any future repair records to the same card.
Expected result
The agent reads the company's published schema and lifecycle, gathers missing required facts, and creates typed linked records.
Boundary
A company owner must first configure and publish the record type, workflow, permissions, and Skill.
Administration

Import master data safely

Available nowAuthorized administrators
Type this in your agent
Import the products in this spreadsheet. First show the column mapping and a dry run; do not write anything until I approve the preview.
Expected result
The agent validates mappings and reference data, presents a dry-run result, then imports only after confirmation.
Boundary
File access and spreadsheet parsing depend on the agent runtime. ORYH enforces the authenticated import permission and validates accepted rows.
Administration

Publish a targeted company Skill

Available nowSkill and access administrators
Type this in your agent
Create a weekly project-status Skill for project managers, require the right business-object capability, and show exactly who will receive it before publishing.
Expected result
The agent drafts the Skill contract while ORYH versions it and reports the capability and audience reach.
Boundary
Publishing a Skill does not broaden server authorization, and targeted distribution cannot override a missing capability.

Manage and recover

Skills can change without turning credentials into shared files.

Sync

Update what this user may receive

Type this in your agent
Check whether my ORYH Skills are current and update them if needed.

Self-service sync uses the existing device credential. It does not rotate credentials on other devices.

Reconnect

Recover this device after a 401

Type this in your agent
ORYH says this device's key is invalid. Reconnect this device.

A new browser approval creates a replacement credential for this device.

Revoke

Remove a device you no longer trust

Open Access credentials, find the device label, and deactivate it. Other device credentials remain active.

Second company

Keep employers separate

Type this in your agent
I also need to use ORYH for another company. Connect that account without replacing my current company.

The browser login decides the company identity; the new namespaced bundle is installed beside the existing one.

Know where enforcement lives

ORYH server

Tenant identity, system capabilities, schema, legal state transitions, idempotency, stored approvals, and audit evidence.

Workflow agent

Reads configured human-language routing rules and advances later approval nodes; thresholds are not interpreted automatically by the database.

User's agent

Understands the request, reads files or images when supported, gathers missing facts, and presents the confirmation.

External integration

Sends customer or supplier documents, synchronizes calendars, or delivers notifications when such an integration is configured.

For workspace administrators

Prepare users before sending the download link.

  1. 01

    Create or invite the user and link the correct employee record.

    Users
  2. 02

    Assign the least-privileged role needed for the person's work.

    Roles
  3. 03

    Publish the required Skills and verify capability plus audience reach.

    Skills
  4. 04

    Send the public bootstrap link—not a personal bundle or copied key.

    Download

Troubleshooting

Common connection questions.

Does the public ORYH Connect download contain a credential?

No. The bootstrap download contains no password, API key, user identity, or company data. It does contain the address of the ORYH deployment that issued it.

Should I paste my ORYH password or API key into an agent?

No. Enter your password only on the ORYH website opened by the device authorization flow. ORYH delivers the device credential directly to the requesting agent after you approve it.

Why did I receive fewer Skills than a colleague?

Personal bundles are generated from live role capabilities and Skill audience assignments. An administrator can review both conditions without granting broader access than your job requires.

What happens when a device credential is revoked?

ORYH requests from that device return an authentication error. Run ORYH Connect again on that device and approve a new authorization in the browser.

Can one agent connect to more than one company?

Yes. Each company is installed into its own namespaced bundle with its own identity and credential. State the company in ambiguous requests so the agent selects the correct Skill.

Does installing a Skill grant permission to perform its actions?

No. Skill possession is not authorization. ORYH evaluates the connected identity, server-enforced capabilities, tenant boundary, schema, and legal record state when an action is requested.

The agent cannot find ORYH Connect

Check that there is exactly one folder level before SKILL.md, compare the path with the runtime guide above, then reload or restart the agent.

The code expired

Device codes normally expire after about 15 minutes. Ask the agent to start a new connection; do not reuse the old code.

The expected business Skill is missing

The user's capability and the Skill audience must both allow delivery. Ask an administrator to inspect Skill reach before changing either control.

The approval page names the wrong device

Deny the request. Start again from the agent you are actually connecting and verify both the code and device name.

Still blocked? Contact your ORYH workspace administrator, ask in the community Discord, or open an issue on GitHub. For a security concern, use the security contact instead of a public channel, and never include a password, API key, personal bundle, or production record in email, chat, or an issue.