Credentials

Every route accepts exactly one kind of bearer token.

Plane	Credential	What it can do
Owner (control)	Session hyc0_… from POST /v0/signup or /v0/login. Argon2id password verifier; 24 hours; not refreshable.	Everything: projects, keys, snapshots, restore, bucket creation, function deploy and delete, secrets — plus anything a project key may do.
Project (data)	Live project key hyp1_<32 hex>_<64 hex> from POST /v0/projects/{id}/keys.	/v2/* through the proxy, storage objects and bucket list, realtime publish and SSE, function invoke.

Project keys

• The full key is returned once, at creation. The server stores a verifier, never the key, and cannot show it again.
• A key is checked on every request against its verifier and its revocation status. There is no cache and no grace period: a revoked key fails the very next request on any connection, and its open realtime streams are closed at that moment.
• A key belongs to one project and can never name another (404). Presented on an owner-only route it is 401: a valid credential on the wrong plane.
• Receipts record the key id as the actor, never the secret.
• Revoke is idempotent and keys are never deleted, so the list is the full history.

There is no key rotation primitive: issue a replacement, move your application to it, revoke the old one. The Cloud manages no overlap window.

Creating an account

POST /v0/signup takes an email and a password (8–1024 bytes). On an invite-gated deployment — the hosted one is — it also requires an invite_code handed to you by the operators. A missing or unknown code answers 403 authorization_denied, with the same body either way and before the server looks at the email, so the response never tells anyone whether an address already has an account. Codes are compared in constant time and are never stored in clear, logged or receipted. There is no self-service invitation flow: request access and an operator gives you a code.

Sessions

A session token is a bearer for the owner plane. It lives 24 hours (expires_at is in the response), is stored hashed on the server, and is rejected on every route except signup and login once expired. The Studio keeps it in the browser tab’s sessionStorage only. There is no OAuth, no magic link, no refresh and no server-side revocation in this version — see what it is not.

The Cloud never injects a key

Not into functions, not into tickets. An application holds its own key and is responsible for it. A function that needs Native must be handed a key by its caller and call the proxy itself.