Managing Projects

What Are Projects?

A project in Checkpoint represents a single property (website, API, or application) that you want to protect. Each project has its own:

• Project ID and API Key — Credentials for SDK integration
• Detection settings — Classification preferences and sensitivity
• Enforcement policies — How to handle detected agents
• Analytics — Detection data, trends, and reports
• Team access — Who can view and manage the project

Prerequisites

• A Checkpoint account. If you don't have an organization yet, you'll be prompted to create one the first time you sign in.

Creating a Project

1. Sign in to the Checkpoint dashboard
2. Select your organization (or create one)
3. Click New Project
4. Enter:
   • Project name — A descriptive name (e.g., "Production Website")
   • Domain — The domain you want to protect (e.g., example.com)
5. Click Create

The project is created immediately and you'll land on its Installations page (legacy name: the Deployment tab) with integration instructions.

Project Credentials

Every project has two credentials:

Find both under Installations in the dashboard. See Credentials for the full walkthrough.

Project Settings

General

Configure basic project properties:

• Project name
• Domain
• Description
• Environment (production, staging, development)

Detection

Configure detection behavior:

• Detection sensitivity
• Classification preferences
• Custom detection rules

Enforce

Set up active enforcement:

• Gateway — Add DNS-based enforcement domains. See Gateway.
• Middleware — View integration code for Next.js or Express. See Middleware.
• Policies — Configure enforcement rules. See Policies.

Policy → Auth (Govern)

Configure KYA-OS governance on the Policy → Auth page — one three-card journey (Auth → Consent → Success):

• Auth methods — Add OAuth or credential providers agents authenticate with
• Consent branding — Customize the consent and success screens agents' users see
• Tool coverage — Assign each discovered tool an auth method (per-tool delegation requirements — OAuth, credentials, or consent-only)

See Govern for details.

API Keys

Your Project ID and API key are managed under Installations, not on a Project Settings tab. See Credentials for where to find and use them.

Deny List (Legacy)

Manually block specific detected agents through the legacy structured policy layer — superseded by Cedar forbid rules authored in Compose:

• Block by agent DID — an exact match against the request's delegation DID
• Block by detected agent name — a case-insensitive substring match (not a raw user agent string match)

The deny list runs after detection, and after path rules and the allow list have already been evaluated — it is not a pre-detection fast path or a priority override. See Deny List: Evaluation Order for the full pipeline.

Installations (Legacy Name: Deployment)

Installations provides integration instructions for each detection method:

1. Pixel — Copy the script tag, GTM, or React snippet
2. Beacon — npm install command and initialization code
3. Middleware — Next.js or Express setup code
4. Gateway — DNS record configuration, see Gateway

Each section includes your Project ID and API key pre-filled for easy copy-paste. See Credentials if you need these values elsewhere.

Team Management

Manage who can access the project:

1. Navigate to organization Settings → Team
2. Invite members by email
3. Set roles:
   • Owner — Full access, can delete projects
   • Admin — Manage settings and team
   • Member — View data, cannot change settings
   • Viewer — Read-only access

Multiple Projects

Common multi-project setups:

Each project has independent settings, policies, and analytics. Use the project switcher in the dashboard sidebar to navigate between them.

Next Steps

• Analytics & Reporting — Understand your detection data
• Detect — Choose and configure detection methods
• Enforce — Set up enforcement policies
• Govern — Configure KYA-OS governance