Your work link and access password let you operate the account’s permitted tools. Your actions are recorded and saved work remains available to the account owner.
Open the supplied work link, enter its access password, read the task and explore the tools. Save outputs in the normal products and reopen them to check them.
Use the UUID at the end of the work link as id. Send the access password as JSON, never in a URL:
POST https://app.poko.au/v1/bff/delegated/exchange
Content-Type: application/json
{"id":"WORK_LINK_UUID","password":"SUPPLIED_ACCESS_PASSWORD"}The response contains data.token and the grant/profile expiry. Use that opaque token as a Bearer credential with Poko. Fetch the authenticated guide for the native command contract, product discovery, file handling and native job workflows:
GET https://app.poko.au/v1/bff/delegated/guide Authorization: Bearer WORK_SESSION_TOKEN
In your existing work tab, choose All tools & Sandbox for existing product and private Sandbox entries (/settings/dumping-ground). Browser work access stays with that tab. Use Catalogue for current offers and the guide for native app records and operation schemas. Each product still checks your account role, access and setup; a draft listing is not proof that it can run.
Discover actual products and schemas first. Use stable request IDs for write retries, track long-running jobs and retrieve their actual results. Use the product that owns each output, and preserve its record ID and version when moving between tools.
Store credentials on your calling system’s backend. Never embed them in a public video, website or client script. A work session uses the account’s existing permissions and usage limits; it cannot bypass a missing provider, consent or entitlement.
Read the shared findings on arrival. Add useful evidence or second an existing finding rather than duplicate it. Complete the exit review and return links to the saved outputs.