diff --git a/.vscode/tasks.json b/.vscode/tasks.json
new file mode 100644
index 000000000..5cc038fc4
--- /dev/null
+++ b/.vscode/tasks.json
@@ -0,0 +1,19 @@
+{
+  "version": "2.0.0",
+  "tasks": [
+    {
+      "label": "Start backend containers",
+      "type": "shell",
+      "command": "NX_TUI=false NX_DAEMON=false bash ./start-backend-containers.sh",
+      "isBackground": false,
+      "problemMatcher": []
+    },
+    {
+      "label": "Check backend container status",
+      "type": "shell",
+      "command": "docker ps --format '{{.Names}} {{.Status}} {{.Ports}}'",
+      "isBackground": false,
+      "problemMatcher": []
+    }
+  ]
+}
diff --git a/apps/agenstra/backend-agent-controller/.start-containers.env.example b/apps/agenstra/backend-agent-controller/.start-containers.env.example
index bdf3cb3f7..34f879570 100644
--- a/apps/agenstra/backend-agent-controller/.start-containers.env.example
+++ b/apps/agenstra/backend-agent-controller/.start-containers.env.example
@@ -29,11 +29,11 @@ WEBSOCKET_CORS_ORIGIN=
 WEBSOCKET_NAMESPACE=socket/clients
 
 # Environment variables for the authentication method
-# AUTHENTICATION_METHOD: api-key | keycloak | users (default: api-key when STATIC_API_KEY set, else keycloak)
+# AUTHENTICATION_METHOD: api-key | keycloak | users (default: users)
 # - api-key: Static API key auth (requires STATIC_API_KEY)
 # - keycloak: Keycloak OAuth2 (requires Keycloak env vars)
 # - users: Built-in user registration with JWT (requires JWT_SECRET)
-AUTHENTICATION_METHOD=api-key
+AUTHENTICATION_METHOD=users
 
 # Environment variables for disabling signup
 DISABLE_SIGNUP=false
@@ -133,9 +133,9 @@ DYNAMIC_PROVIDERS_FAIL_FAST=false
 DYNAMIC_PROVIDER_PLUGIN_PATH=
 DYNAMIC_PROVIDER_PLUGIN_INSTALL=
 CLIENT_ENDPOINT_ALLOWED_HOSTS=
-CLIENT_ENDPOINT_ALLOW_INSECURE_HTTP=false
-CLIENT_ENDPOINT_ALLOW_INTERNAL_HOST=false
-CLIENT_ENDPOINT_TLS_REJECT_UNAUTHORIZED=true
+CLIENT_ENDPOINT_ALLOW_INSECURE_HTTP=true
+CLIENT_ENDPOINT_ALLOW_INTERNAL_HOST=true
+CLIENT_ENDPOINT_TLS_REJECT_UNAUTHORIZED=false
 KEYCLOAK_SERVER_URL=
 KEYCLOAK_AUTH_SERVER_URL=
 KEYCLOAK_REALM=
diff --git a/apps/decabill/backend-billing-manager/.start-containers.env.example b/apps/decabill/backend-billing-manager/.start-containers.env.example
index 8e7c81874..e63fce2d4 100644
--- a/apps/decabill/backend-billing-manager/.start-containers.env.example
+++ b/apps/decabill/backend-billing-manager/.start-containers.env.example
@@ -20,11 +20,11 @@ WEBSOCKET_CORS_ORIGIN=
 # Encryption key for sensitive data (base64 encoded)
 ENCRYPTION_KEY=MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDE=
 
-# Authentication method: api-key | keycloak | users
+# Authentication method: api-key | keycloak | users (default: users)
 # - api-key: Static API key auth (requires STATIC_API_KEY)
 # - keycloak: Keycloak OAuth2 (requires Keycloak env vars)
 # - users: Built-in user registration with JWT (requires JWT_SECRET)
-AUTHENTICATION_METHOD=api-key
+AUTHENTICATION_METHOD=users
 
 # Environment variables for disabling signup
 DISABLE_SIGNUP=false
diff --git a/hooks.sh b/hooks.sh
deleted file mode 100755
index e3ca2effc..000000000
--- a/hooks.sh
+++ /dev/null
@@ -1,113 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-SCRIPT_NAME="hooks.sh"
-FORCE=0
-
-# Colors
-if [ -t 1 ]; then
-    RED="\033[0;31m"; GREEN="\033[0;32m"; YELLOW="\033[1;33m"; BLUE="\033[0;34m"; NC="\033[0m"
-else
-    RED=""; GREEN=""; YELLOW=""; BLUE=""; NC=""
-fi
-
-timestamp() { date +"%Y-%m-%dT%H:%M:%S%z"; }
-log_info() { echo -e "$(timestamp) ${BLUE}[INFO]${NC} $*"; }
-log_warn() { echo -e "$(timestamp) ${YELLOW}[WARN]${NC} $*"; }
-log_error() { echo -e "$(timestamp) ${RED}[ERROR]${NC} $*" 1>&2; }
-log_success() { echo -e "$(timestamp) ${GREEN}[SUCCESS]${NC} $*"; }
-die() { log_error "$*"; exit 1; }
-
-usage() {
-    cat <<EOF
-${SCRIPT_NAME} - Setup Cursor hooks symlinks
-
-This script symlinks .cursor/hooks and .cursor/hooks.json from the current
-directory to ~/.cursor/ to enable project-specific Cursor hooks.
-
-Options:
-  --force          Overwrite existing symlinks or files
-  -h, --help       Show this help message
-EOF
-}
-
-while [ "${1-}" != "" ]; do
-    case "$1" in
-        --force)
-            FORCE=1; shift ;;
-        -h|--help)
-            usage; exit 0 ;;
-        *)
-            usage; die "Unknown option: $1" ;;
-    esac
-done
-
-# Detect project root: prefer script location, fallback to current working directory
-# This handles both direct execution (./hooks.sh) and curl | bash execution
-# When run via curl | bash, BASH_SOURCE[0] may be a pipe, so we use current directory
-if [ -f "${BASH_SOURCE[0]}" ] 2>/dev/null; then
-    # Try to use script's directory
-    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)" || SCRIPT_DIR=""
-fi
-
-# Fallback to current working directory (required for curl | bash execution)
-# User should run this command from the project root directory
-if [ -z "${SCRIPT_DIR}" ]; then
-    SCRIPT_DIR="$(pwd)"
-fi
-
-CURSOR_DIR="${SCRIPT_DIR}/.cursor"
-HOME_CURSOR_DIR="${HOME}/.cursor"
-
-log_info "Setting up Cursor hooks from ${SCRIPT_DIR}..."
-
-# Create ~/.cursor directory if it doesn't exist
-if [ ! -d "${HOME_CURSOR_DIR}" ]; then
-    log_info "Creating ${HOME_CURSOR_DIR}..."
-    mkdir -p "${HOME_CURSOR_DIR}"
-fi
-
-# Function to create symlink
-create_symlink() {
-    local source="$1"
-    local target="$2"
-    local name="$3"
-
-    if [ ! -e "${source}" ]; then
-        log_warn "${name} not found at ${source}, skipping..."
-        return 0
-    fi
-
-    # Check if target already exists
-    if [ -e "${target}" ] || [ -L "${target}" ]; then
-        if [ "${FORCE}" -eq 1 ]; then
-            log_warn "Removing existing ${target}..."
-            rm -f "${target}"
-        else
-            log_warn "${target} already exists. Use --force to overwrite."
-            return 0
-        fi
-    fi
-
-    # Create symlink
-    log_info "Creating symlink: ${target} -> ${source}"
-    ln -s "${source}" "${target}"
-    log_success "Symlinked ${name} to ${target}"
-}
-
-# Symlink hooks directory if it exists
-if [ -d "${CURSOR_DIR}/hooks" ]; then
-    create_symlink "${CURSOR_DIR}/hooks" "${HOME_CURSOR_DIR}/hooks" "hooks directory"
-else
-    log_info "No hooks directory found at ${CURSOR_DIR}/hooks"
-fi
-
-# Symlink hooks.json if it exists
-if [ -f "${CURSOR_DIR}/hooks.json" ]; then
-    create_symlink "${CURSOR_DIR}/hooks.json" "${HOME_CURSOR_DIR}/hooks.json" "hooks.json"
-else
-    log_info "No hooks.json found at ${CURSOR_DIR}/hooks.json"
-fi
-
-log_success "Cursor hooks setup complete!"
diff --git a/start-backend-containers.sh b/start-backend-containers.sh
new file mode 100755
index 000000000..febcb4aa1
--- /dev/null
+++ b/start-backend-containers.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+cd "$ROOT_DIR"
+
+backend_apps=(
+  "agenstra/backend-agent-controller:agenstra-backend-agent-controller"
+  "agenstra/backend-agent-manager:agenstra-backend-agent-manager"
+  "decabill/backend-billing-manager:decabill-backend-billing-manager"
+  "forepath/backend-communication:forepath-backend-communication"
+)
+
+for app in "${backend_apps[@]}"; do
+  app_dir="${app%%:*}"
+  example="$ROOT_DIR/apps/$app_dir/.start-containers.env.example"
+
+  if [[ ! -f "$example" ]]; then
+    printf 'Missing env example: %s\n' "$example" >&2
+    exit 1
+  fi
+done
+
+for app in "${backend_apps[@]}"; do
+  app_dir="${app%%:*}"
+  example="$ROOT_DIR/apps/$app_dir/.start-containers.env.example"
+  env_file="$ROOT_DIR/apps/$app_dir/.start-containers.env"
+
+  if [[ ! -e "$env_file" && ! -L "$env_file" ]]; then
+    cp -- "$example" "$env_file"
+    printf 'Created %s\n' "$env_file"
+  else
+    printf 'Preserving existing %s\n' "$env_file"
+  fi
+done
+
+for app in "${backend_apps[@]}"; do
+  project="${app#*:}"
+  printf '\nStarting %s\n' "$project"
+  npx nx run "$project:start-containers"
+done
\ No newline at end of file