In Orko

1. Sign in to Orko.
2. Open Profile → Marketplace (/profile?tab=integrations).
3. Open the Nora card and choose Connect Nora.
4. Paste Nora’s consult HTTPS URL (required; max 500 characters; must be a valid URL).
5. HMAC secret is optional on first connect. Leave it blank and Orko generates one (csltsec_…). Copy it immediately — it is shown once. On later saves, leave the field blank to keep the current secret.
6. Leave Enabled checked. Orko fails closed on timeout (see below).
7. Save. The card shows Connected when the stored agent is enabled.

Disconnect deletes that consult agent. Orko then scores the briefing from Orko only — it does not invent MLS listings.

When Orko consults

Consultation runs only when the workspace pack is real estate and the briefing kind sets requiresConsult. Those kinds are:

• new_inquiry_speed
• buyer_nurture
• listing_checkin
• post_closing
• sphere_touch

Travel and small-business briefing kinds do not require consult. Orko picks the stored agent with agentIdentity: nora (or the same vertical pack), then POSTs to the consult URL. Only enabled agents are used, up to eight per org.

Consult protocol

Orko POSTs JSON to your consult URL and waits 4 seconds. Headers:

• Content-Type: application/json
• X-Orko-Timestamp — Unix time in seconds
• X-Orko-Signature — hex HMAC-SHA256 of timestamp + "." + rawBody

Request type is always next_action.consult. The person object includes emails (when the contact has one), status, tags, lastOutboundAt, and lastInboundAt. Phones are not sent on the current briefing path.

{
  "id": "cslt_<personId>_<kind>",
  "type": "next_action.consult",
  "proposed": {
    "kind": "sphere_touch",
    "personId": "uuid",
    "reason": "Past client / sphere has been quiet…",
    "channel": "email",
    "title": "Sphere touch: Jordan Hale"
  },
  "person": {
    "emails": ["jordan@example.com"],
    "status": "past_client",
    "tags": ["sphere"],
    "lastOutboundAt": "2026-06-01T12:00:00.000Z",
    "lastInboundAt": null
  }
}

Verify the signature

const crypto = require("crypto");
const timestamp = req.headers["x-orko-timestamp"];
const signature = req.headers["x-orko-signature"];
const expected = crypto
  .createHmac("sha256", HMAC_SECRET)
  .update(`${timestamp}.${rawBody}`)
  .digest("hex");
if (expected !== signature) {
  return res.status(401).end();
}

Respond with JSON. Accepted verdicts: proceed, suppress, modify, enrich, unknown. action is accepted as an alias for verdict. Unknown or empty bodies become unknown. Non-2xx HTTP is treated as unknown (not a timeout).

{
  "verdict": "proceed",
  "reason": "Listing is live; outreach is appropriate",
  "copyNotes": "Optional notes for the draft",
  "afterEnrich": "proceed",
  "updates": {
    "status": "optional-pipeline-status",
    "tagsAdd": ["optional-tag"],
    "note": "Optional CRM note"
  },
  "delayUntil": "2026-09-20T15:00:00.000Z"
}

• proceed — Orko continues the briefing draft or calendar follow-up.
• suppress — skip outreach. Orko writes a read_note Needs attention item titled “Nora: skip follow-up…”, unless that person already has an open sendable draft — then the suppress is skipped so an Approve & send body is not overwritten.
• modify — if delayUntil is in the future, this pass is skipped.
• enrich — Orko may write updates.status, updates.tagsAdd, and updates.note to the contact, then continues with afterEnrich or proceed.
• unknown or timeout — for real estate, Orko still queues a draft titled “Verify MLS, then follow up…”. It does not leave a dead blocked item with no copy.

Session API (same as the Marketplace card)

/api/briefing/consult-agents accepts a Clerk session JWT only — not an orko_ API key.

• GET — lists agents (id, agentIdentity, consultUrl, enabled, capabilities, verticalPack). HMAC is never returned.
• POST — upsert by (organizationId, agentIdentity). Body: consultUrl (required URL), hmacSecret (optional, 8–200 chars), capabilities, verticalPack (travel | real_estate | other), enabled. The Marketplace card sends { agentIdentity: "nora", capabilities: ["consult"], verticalPack: "real_estate" }. If hmacSecret is omitted, the response includes generatedHmacSecret — a new csltsec_… on first create, or the existing stored secret when you leave the field blank on a later save.
• DELETE — ?id= of the stored agent.

What this is not

• Not MCP. Nora does not use /api/hub/grok/mcp. That endpoint is the Orko Life job queue for Grok Bot.
• Not an Orko API key. Consult is Orko → Nora HTTPS, signed with the HMAC secret.
• Not a public /api/agent/v1 gateway. That path is not shipped.
• Orko does not have MLS data unless Nora is connected. Do not invent listings in Orko.