docs(developer): document the Workflow Step Type module comprehensively

src/content/docs/developer/crowdin-apps/app-descriptor.mdx

@@ -168,13 +168,16 @@ The app descriptor is a JSON object with the following structure:
 
 ## Authentication
 
-Specifies the authentication type to use when signing requests from the host application to the Crowdin app. Crowdin Apps support two types of authentication:
+Specifies the authentication type to use when signing requests from the host application to the Crowdin app. Crowdin Apps support the following types of authentication:
 
 * using OAuth app (`crowdin_app` value)
 * without OAuth app (`none` value)
+* using a dedicated agent user (`crowdin_agent` value) – required by the [Workflow Step Type](/developer/crowdin-apps-module-workflow-step-type/#authentication) module
 
 In case your Crowdin app requires access to Crowdin API at any time, it’s recommended to use the `crowdin_app`, in other cases feel free to use the `none`. The authentication type `none` grants access to Crowdin API as well as the `crowdin_app`, but only when the Crowdin app is executed on the user side, for example, when the iframe opens.
 
+The `crowdin_agent` type is for apps that keep working in your projects after installation, for example, apps that process strings on a custom workflow step. When such an app is installed, Crowdin creates a dedicated bot user, and the app's API calls are authenticated as that user. Read more about [agent authentication](/developer/crowdin-apps-module-workflow-step-type/#authentication).
+
 Example:
 
 ```json title="manifest.json"
@@ -199,7 +202,7 @@ Example:
     <td>
       <p><strong>Type:</strong> <code>string</code></p>
       <p><strong>Defaults to:</strong> <code>none</code></p>
-      <p><strong>Allowed values:</strong> <code>none</code>, <code>crowdin_app</code></p>
+      <p><strong>Allowed values:</strong> <code>none</code>, <code>crowdin_app</code>, <code>crowdin_agent</code></p>
       <p><strong>Description:</strong> The type of authentication to use.</p>
     </td>
   </tr>
@@ -254,7 +257,7 @@ Example:
     <td>
       <p><strong>Type:</strong> <code>string</code></p>
       <p><strong>Description:</strong> The event that is sent to an app after a user installed the app in Crowdin.</p>
-      <p>This event is required if you use <code>crowdin_app</code>. Read more about [Authentication](#authentication).</p>
+      <p>This event is required if you use <code>crowdin_app</code> or <code>crowdin_agent</code>. Read more about [Authentication](#authentication).</p>
     </td>
   </tr>
   <tr>
@@ -364,6 +367,13 @@ Properties:
       <p><strong>Description:</strong> The `baseUrl` of the organization in Crowdin Enterprise the app was installed to. For Crowdin the `baseUrl` value is always `https://crowdin.com`</p>
     </td>
   </tr>
+  <tr>
+    <td><code>agentId</code></td>
+    <td>
+      <p><strong>Type:</strong> <code>integer</code></p>
+      <p><strong>Description:</strong> The numeric identifier of the agent user created for the app. Sent only for apps with the <code>crowdin_agent</code> authentication type.</p>
+    </td>
+  </tr>
   </tbody>
 </table>
 

src/content/docs/developer/crowdin-apps/installation.mdx

@@ -115,7 +115,7 @@ When a Crowdin App is installed in the Account Settings, an authorization flow t
 <Image src={communicationFlow} alt="Communication between Crowdin and Crowdin App" />
 
 <Aside>
-  The Installed event is used only for `authorization.type: "crowdin_app"`.
+  The Installed event is used for the `crowdin_app` and `crowdin_agent` authentication types. For `crowdin_agent`, the payload additionally contains the `agentId` property.
 </Aside>
 
 Let's examine each step in the illustration in detail:

src/content/docs/developer/crowdin-apps/security.mdx

@@ -4,8 +4,14 @@ description: Ensure the high level of security for Crowdin apps
 slug: developer/crowdin-apps-security
 ---
 
+import { Aside } from '@astrojs/starlight/components';
+
 To ensure the high level of security for cases when the Crowdin app works with the data from Crowdin (i.e. uses the authorization via `crowdin_app`), we've developed a security mechanism. The main principle of this security mechanism is based on the exchange of the JWT token between Crowdin and the Crowdin app. JWT token is signed with an OAuth Client Secret known only to the two final parties. This way, the Crowdin app can get a confirmation that the page is opened precisely in Crowdin.
 
+<Aside>
+  Apps with the [Workflow Step Type](/developer/crowdin-apps-module-workflow-step-type/#authentication) module must use the `crowdin_agent` authentication type instead of `crowdin_app`.
+</Aside>
+
 ## Implementation
 
 To implement the authorization and authentication in your Crowdin app, follow these steps: