Platform
The account side of B3OS beta, covering organizations, projects, keys, CLI login, usage, limits, webhook secrets and the per-request log.
Platform covers everything around the products: who can call them, what they used, and what happened on each request.
| You want | Call | Served by |
|---|---|---|
| Create, list, update and revoke API keys | /v1/keys | Edge |
| See who a credential is | GET /v1/keys/current | Edge |
| Usage totals and records | /v1/usage | Edge |
| Your limits and current usage against them | GET /v1/limits | Edge |
| Organizations, members and projects | /v1/orgs, /v1/projects | Edge |
| Signing secrets and delivery history for job webhooks | /v1/webhooks | Node |
| The record of any request, with its timing phases | /v1/requests | Node |
Edge-served operations answer at https://beta-api.b3os.org only. From inside a sandbox they return 421 edge_only.
Organizations and projects
Your invite creates an organization with one project, named default, and a first key. Members have a role in the organization: owner, admin or member; members cannot manage keys or billing. Every object you create belongs to one project, and every key to one project, so projects separate environments or customers. Create more with POST /v1/projects (platform:write). Organization settings are managed in the dashboard.
Signing in
| Who | How |
|---|---|
| People, in the dashboard | GitHub or a 6-digit code sent by email, then a session cookie |
| The CLI | b3os login, a device login (RFC 8628) that issues a b3os_pat_ token |
| Code | An API key, b3os_sk_... |
The device login works from any terminal. The CLI shows a code and a link to https://beta.b3os.org/app/device; you approve it there for one organization and project, with scopes no wider than your own, and the CLI receives its token. Tokens last 90 days by default.
Scopes
| Scope | For |
|---|---|
platform:read | Read keys, usage, requests, organizations, projects and webhook deliveries |
platform:write | Create, update and revoke keys; manage projects; read and rotate webhook secrets |
A few operations need only a valid credential (GET /v1/keys/current, GET /v1/limits, GET /v1/orgs), and dashboard-only operations need a signed-in session.