Before you start
Four requirements make the connection real.
An ORYH user
You need an active company account that can sign in to the ORYH browser console.
An Agent Skills host
The agent must discover a SKILL.md directory and follow its referenced files.
Local tools
The runtime needs outbound HTTPS, archive extraction, and a persistent writable Skill directory.
Company policy
Your organization must permit this runtime and the data it will handle.
Client status · 6 September 2026
Choose a client. Validate the workflow.
Codex, Claude Code, Hermes and OpenClaw are certified clients. Client certification is separate from validation of a specific business workflow. Check its status, then test your client version, permissions and exception paths before rollout. The additional host instructions below do not extend certification to GitHub Copilot or Claude Cowork.
Step 1 · Download
Get ORYH Connect from the ORYH deployment you will use.
The public zip is safe to distribute inside your organization because it has no user identity, password, API key, or company records. It does carry the issuing deployment's address, so download it from the same ORYH environment you intend to connect.
Contains oryh-connect/SKILL.md and its connection reference.
curl -fL https://oryh.ai/api/v1/connect-skill -o oryh-connect.zip
unzip -l oryh-connect.zipA Skill is executable guidance for an agent. Review SKILL.md, its references, and any scripts before enabling any Skill package, including internal packages.
Step 2 · Install
Put the bootstrap Skill where your agent discovers Skills.
Each example below leaves the resulting entry at the path shown. On Windows without WSL, unzip with the desktop archive tool and move the oryh-connect folder to the equivalent user Skill location.
CodexCodex app, CLI, and IDE extensionORYH validation planned
~/.agents/skills/oryh-connect/SKILL.mdFor macOS, Linux, or WSL:
mkdir -p ~/.agents/skills
unzip oryh-connect.zip -d ~/.agents/skillsCodex detects Skill changes automatically. Restart Codex if the new Skill does not appear.
$oryh-connect Connect this device to ORYH.
Host installation location verified from the Codex documentation. This does not yet mean ORYH has passed a pinned-version, end-to-end workflow validation on this runtime.
Claude CodeLocal Claude Code sessionsORYH validation planned
~/.claude/skills/oryh-connect/SKILL.mdFor macOS, Linux, or WSL:
mkdir -p ~/.claude/skills
unzip oryh-connect.zip -d ~/.claude/skillsExisting Skill roots reload live. Restart Claude Code if ~/.claude/skills did not exist when the session started.
/oryh-connect Connect this device to ORYH.
Host installation location verified from the Claude Code documentation. This does not yet mean ORYH has passed a pinned-version, end-to-end workflow validation on this runtime.
Hermes AgentHermes CLI and connected messaging surfacesORYH validation planned
~/.hermes/skills/oryh-connect/SKILL.mdFor macOS, Linux, or WSL:
mkdir -p ~/.hermes/skills
unzip oryh-connect.zip -d ~/.hermes/skillsStart a new session, or reload the session after confirming the Skill appears in hermes skills list.
/oryh-connect Connect this device to ORYH.
Host installation location verified from the Hermes Agent documentation. This does not yet mean ORYH has passed a pinned-version, end-to-end workflow validation on this runtime.
OpenClawOpenClaw workspace or managed local SkillsORYH validation planned
~/.openclaw/skills/oryh-connect/SKILL.mdFor macOS, Linux, or WSL:
unzip oryh-connect.zip
openclaw skills install ./oryh-connect --globalOpenClaw installs local directories, not zip archives. Unzip first, then confirm with openclaw skills info oryh-connect.
/oryh-connect Connect this device to ORYH.
Host installation location verified from the OpenClaw documentation. This does not yet mean ORYH has passed a pinned-version, end-to-end workflow validation on this runtime.
GitHub CopilotCopilot CLI and supported agent modesORYH validation planned
~/.agents/skills/oryh-connect/SKILL.mdFor macOS, Linux, or WSL:
mkdir -p ~/.agents/skills
unzip oryh-connect.zip -d ~/.agents/skillsIn Copilot CLI, run /skills reload and then /skills info oryh-connect.
/oryh-connect Connect this device to ORYH.
Host installation location verified from the GitHub Copilot documentation. This does not yet mean ORYH has passed a pinned-version, end-to-end workflow validation on this runtime.
Claude chat and Cowork
Custom Skill upload is not yet the complete ORYH connection path.
Claude can upload a custom zip through Customize → Skills, but the current ORYH flow must also replace a personal, credential-bearing Skill bundle in a durable local Skill root after authorization. ORYH does not yet ship a managed Cowork installer for that second step. Use only a local agent surface that your pilot team has explicitly validated; do not upload a personal ORYH bundle to Cowork as a workaround.
Read Claude's custom Skill documentationStep 4 · Use ORYH
Ask for the business outcome, not an API operation.
The agent selects an installed company Skill from your natural-language request. You receive only the scenarios allowed by your role and the Skill's audience. For consequential writes, ask the agent to show the complete proposed result before it acts.
Connect or recover a device
Connect this device to my company's ORYH.
- Expected result
- The agent starts browser authorization, shows the verification code, and installs the personal bundle after approval.
- Boundary
- Never give the agent your password. A revoked or expired credential is recovered by running this flow again.
Review work waiting for you
Show me everything waiting for me in ORYH, and flag anything returned or overdue.
- Expected result
- The agent retrieves the connected user's open work and explains the source record and current state.
- Boundary
- Results depend on the connected identity and the work assigned to it.
Submit a complete timesheet
Submit last week's time: Monday was eight hours of customer research, Tuesday through Thursday was proposal work, and Friday was the client readout. Show me the full week before you submit it.
- Expected result
- The agent resolves the period, checks the entries, reads back the full week, and writes only after explicit confirmation.
- Boundary
- Approval routing is advanced by the configured workflow agent; submitting a record alone does not imply automatic manager approval.
File expenses with evidence
File these three travel receipts against the Meridian project. Send the client-dinner exception to finance, and let me confirm every receipt before submission.
- Expected result
- The agent proposes values from the files, checks possible duplicates, and keeps the confirmed fields with their source evidence.
- Boundary
- Receipt reading depends on the selected agent's file and vision capabilities; ORYH validates the submitted facts but is not the OCR engine.
Create a purchase request
Request three Dell monitors at about 3,000 each. We do not have a final quote yet, so mark the price as estimated and show me the request before submitting.
- Expected result
- The agent resolves available vendor and product facts, records uncertainty explicitly, and asks for confirmation before writing.
- Boundary
- Creating a supplier purchase order and recording receipt require separate authorized actions.
Decide one item at a time
Show my pending approvals, explain the material exceptions, and let me approve or return each item individually.
- Expected result
- The agent presents each assigned task with its source record and records the approver's explicit decision.
- Boundary
- The approver records a decision; a separate workflow agent advances later nodes or the final business state.
Revise a quotation and create an order
The customer accepted quotation Q-1042. Create the sales order from the accepted revision and list any missing fulfilment details before you write it.
- Expected result
- The agent preserves the accepted commercial facts and links the new order to its source quotation.
- Boundary
- Sending documents to a customer or a fulfilment system requires a configured external integration or a human handoff.
Book a room or shared device
Reserve the testing room and two devices for the Meridian workshop next Thursday afternoon. Show conflicts and alternatives before booking.
- Expected result
- The agent checks ORYH availability, presents the selected resources, and commits the reservation after confirmation.
- Boundary
- ORYH resource booking does not by itself synchronize an external calendar or send invitations.
Bill a customer and collect
Invoice Shanghai First Hospital for order SO-2026-0031 on 30-day terms, then tell me which of their invoices are already overdue.
- Expected result
- The agent issues the invoice against the order, records its due date, and lists what is still outstanding — measured against the settlement ledger, not a status.
- Boundary
- Which customer a bank transfer belongs to is a judgment the agent puts to you; ORYH refuses to over-apply money or to match across currencies, but it does not identify payers.
Match a payment to invoices
We received 60,000 from Shanghai First Hospital. Apply it to their two open invoices, oldest first, and show me what is left over.
- Expected result
- The agent records the receipt and applies it across the invoices, reporting each one's remaining balance and any advance still unmatched.
- Boundary
- Applications are append-only: a wrong match is corrected by a reversing entry that stays visible, never by editing or deleting the original.
Check a supplier invoice before paying
The Dell invoice for PO-2026-00012 arrived. Compare it against what we ordered and what actually arrived, and check the payee account against their record before you file the payment request.
- Expected result
- The agent books the invoice, reports ordered vs received vs billed per line with the differences, and flags an account that does not match the supplier's own record.
- Boundary
- ORYH states the differences; whether a gap is acceptable is decided by your company's published workflow definition and the approver, never by the system.
Take a prepayment and draw against it
Shanghai First Hospital prepaid 100,000. Put it on their account, then charge this month's 23,000 against it and tell me what is left.
- Expected result
- The agent applies the receipt to the customer's standing account and records the charge, reporting the remaining balance and how much credit is still available.
- Boundary
- The account's balance can only go negative as far as the credit limit someone set for it; a movement past that is refused and reported, not silently allowed.
Grant and redeem loyalty points
Give this member points for the order, then use 500 of them against today's invoice and show me the balance.
- Expected result
- The agent posts the points and records the redemption as two facts: the points leaving the account, and the matching discount on the invoice.
- Boundary
- How many points a purchase earns and what they are worth are your company's rules, published in its workflow definition. ORYH never converts points into money on its own.
Operate a configured record
Create a warranty-card application for installed asset IA-00421, then link any future repair records to the same card.
- Expected result
- The agent reads the company's published schema and lifecycle, gathers missing required facts, and creates typed linked records.
- Boundary
- A company owner must first configure and publish the record type, workflow, permissions, and Skill.
Import master data safely
Import the products in this spreadsheet. First show the column mapping and a dry run; do not write anything until I approve the preview.
- Expected result
- The agent validates mappings and reference data, presents a dry-run result, then imports only after confirmation.
- Boundary
- File access and spreadsheet parsing depend on the agent runtime. ORYH enforces the authenticated import permission and validates accepted rows.
Publish a targeted company Skill
Create a weekly project-status Skill for project managers, require the right business-object capability, and show exactly who will receive it before publishing.
- Expected result
- The agent drafts the Skill contract while ORYH versions it and reports the capability and audience reach.
- Boundary
- Publishing a Skill does not broaden server authorization, and targeted distribution cannot override a missing capability.
Manage and recover
Skills can change without turning credentials into shared files.
Update what this user may receive
Check whether my ORYH Skills are current and update them if needed.
Self-service sync uses the existing device credential. It does not rotate credentials on other devices.
Recover this device after a 401
ORYH says this device's key is invalid. Reconnect this device.
A new browser approval creates a replacement credential for this device.
Remove a device you no longer trust
Open Access credentials, find the device label, and deactivate it. Other device credentials remain active.
Keep employers separate
I also need to use ORYH for another company. Connect that account without replacing my current company.
The browser login decides the company identity; the new namespaced bundle is installed beside the existing one.
Know where enforcement lives
Tenant identity, system capabilities, schema, legal state transitions, idempotency, stored approvals, and audit evidence.
Reads configured human-language routing rules and advances later approval nodes; thresholds are not interpreted automatically by the database.
Understands the request, reads files or images when supported, gathers missing facts, and presents the confirmation.
Sends customer or supplier documents, synchronizes calendars, or delivers notifications when such an integration is configured.
For workspace administrators
Prepare users before sending the download link.
Troubleshooting
Common connection questions.
Does the public ORYH Connect download contain a credential?
No. The bootstrap download contains no password, API key, user identity, or company data. It does contain the address of the ORYH deployment that issued it.
Should I paste my ORYH password or API key into an agent?
No. Enter your password only on the ORYH website opened by the device authorization flow. ORYH delivers the device credential directly to the requesting agent after you approve it.
Why did I receive fewer Skills than a colleague?
Personal bundles are generated from live role capabilities and Skill audience assignments. An administrator can review both conditions without granting broader access than your job requires.
What happens when a device credential is revoked?
ORYH requests from that device return an authentication error. Run ORYH Connect again on that device and approve a new authorization in the browser.
Can one agent connect to more than one company?
Yes. Each company is installed into its own namespaced bundle with its own identity and credential. State the company in ambiguous requests so the agent selects the correct Skill.
Does installing a Skill grant permission to perform its actions?
No. Skill possession is not authorization. ORYH evaluates the connected identity, server-enforced capabilities, tenant boundary, schema, and legal record state when an action is requested.
Check that there is exactly one folder level before SKILL.md, compare the path with the runtime guide above, then reload or restart the agent.
Device codes normally expire after about 15 minutes. Ask the agent to start a new connection; do not reuse the old code.
The user's capability and the Skill audience must both allow delivery. Ask an administrator to inspect Skill reach before changing either control.
Deny the request. Start again from the agent you are actually connecting and verify both the code and device name.
Still blocked? Contact your ORYH workspace administrator, ask in the community Discord, or open an issue on GitHub. For a security concern, use the security contact instead of a public channel, and never include a password, API key, personal bundle, or production record in email, chat, or an issue.