Build the one-click apply URL (sync) or start the managed async rail

Rail A (one-click sync-redirect) by default. service_id may be omitted when a default/sole template is loaded; the response carries the provider-hosted apply_url, the resolved service_id, and the discovered dc_provider name. Set managed: true (or rail: "async") to request the managed async rail instead. When the provider supports it the response carries a consent_url and rail: "async" (and the grant lets the control plane re-apply / revert server-side without re-consent). service_ids (plural) bundles several templates under one managed consent (async only; the OAuth scope is the space-separated list and the callback applies each); on the sync fallthrough only the first template applies.

Either rail is offered only when the DNS provider holds the exact template: the control plane runs the Domain Connect template check against the provider's API first (remembered for a few minutes), and a provider that has not onboarded it is refused with a 503 that names it. A root domain uses apex-a (an A record to the edge address, which needs APEX_A_TARGETS). Our templates point domains at the edge, so a domain routed to your own infrastructure is refused with 422 custom_routing. The sync apply_url carries a signed redirect_uri back to /connect/dc/return/{state} whenever the template allows it; pass return_origin on a sync start to have that return page post the outcome to your page.

A widget JWT starts either rail for its own application's connections (a domain-bound token for its own domain only); an API key for a connection of any application in its tenant, and a member's key needs a role that operates apps.

A delegated agent token needs domains:connect and starts the setup of its own application's connections.