Welcome to Rough

Your users describe what they need—a custom report, a dashboard, or a small workflow—and Rough builds it inside your product. You choose where Features appear and which data and actions they can use.

Want to see it first? Try the live demo—no integration needed.

Get started with an AI agent

Your coding agent can wire Rough into the app you already have. Give it the prompt below from your app's repository. It will read the setup guides, inspect your framework and authentication, and help you add a place where users can build their own Features.

This is for the coding agent you use to develop your product. Once Rough is installed, your users build Features in Rough's Feature Builder, without access to your source code.

Give your agent this prompt

Copy this into your coding agent with your app's repository open:

Help me add Rough to this app so signed-in users can build and publish
Features inside it.

Read these docs before making changes:
- https://rough.app/docs/getting-started.md
- https://rough.app/docs/sdk-reference.md
- https://rough.app/docs/security.md

For Next.js or SvelteKit, also read the matching guide:
- https://rough.app/docs/getting-started/react.md
- https://rough.app/docs/getting-started/svelte.md

Inspect this repository's instructions, framework, package manager,
authentication and UI conventions. Use the documented SDK APIs; don't
invent a Rough CLI or copy framework-specific code into a different stack.

Before implementing, propose a page for the first Surface and a small set
of read-only capabilities backed by existing app data. Ask me to confirm
where Features should appear and whether they should be shared within an
account or private to each user. Don't add write capabilities without asking.

Help me create a Rough Project and signing key if I don't have them yet.
Tell me which server environment variables to set, but don't ask me to paste
the private key into this conversation. Never commit secrets or expose the
signing key to the browser.

Implement the integration using @roughapp/feature and Zod 4:
- Add a server token endpoint using the existing authenticated session.
  Derive user and account IDs on the server, never from caller-supplied IDs.
  Follow the documented JWT claims, signing algorithm and expiry rules.
- Load the SDK only in the browser. Keep the client's project, user and
  account IDs consistent with the token, and recreate it on identity changes.
- Define a Surface with a stable key, explicit capability schemas and
  fictional output samples. Reuse existing data access and authorization.
- Add a Create a Feature button that creates a draft and opens the Builder.
- Subscribe to published Features and mount them on the chosen page.
  Clean up subscriptions and mounted Features before destroying the client.
- Fit the integration into the app's existing UI and error handling.

Run the relevant checks and tests. Verify that signed-out token requests
are rejected and that account boundaries are preserved. Tell me what you
changed, what configuration is still needed, and how to build, publish and
reload a first Feature. Be explicit about anything you couldn't test.

The prompt links to Markdown versions of our docs so your agent can read the same instructions as you. If it cannot fetch URLs, open the Getting Started guide and use Copy page to give it the content directly.

Have your Rough credentials ready

You'll need a Rough Project and a workspace signing key. You can create them before running the prompt, or let your agent walk you through creating a project and signing key.

The integration uses three environment variables:

ROUGH_PROJECT_ID="your-project-id"
ROUGH_SIGNING_KEY_ID="your-signing-key-id"
ROUGH_SIGNING_PRIVATE_KEY_PEM="your-private-key"

Set the real values in your server's environment or secret manager. Keep the signing key ID and private key server-side and out of version control. The Project ID is not secret and is also used by the browser.

Your users keep signing in through your app. The token endpoint connects that existing session to Rough; it should not introduce a second login for them.

Choose a small first Surface

A Surface is a place in your app where Features can appear. Start with one page and a few read-only capabilities, such as a dashboard that can read the current account's projects or a report that can read recent activity.

Tell your agent:

• Where it belongs: the page and the space Features should occupy.
• What it can read: existing data the signed-in user is already allowed to see.
• Who shares Features: users in the same account, or each user separately.

Capabilities are explicit host operations, not blanket access to your database. Their implementations run in your app's browser code and can call your existing backend. Your backend must still enforce permissions. Use made-up values in output samples, because Rough uses those samples while building Features.

Try the complete flow

Once your agent has finished the integration and you've configured credentials:

1. Sign in to your app and open the chosen page.
2. Click Create a Feature and ask for something using the capabilities you exposed.
3. Wait for the build to finish, then publish it.
4. Check that the Feature appears on your page with real data, and remains after a reload.
5. Sign in with another account and confirm it only sees the Features and data it should.

Review the changes before shipping, especially the token endpoint, account IDs and capability implementations. A working build isn't a substitute for checking permissions.

If you'd rather wire it yourself, follow the Vanilla, React or Svelte guide.