One interface, from first login to production.

Choose your interface

The oneclient npm package is both the universal TypeScript client and the command-line tool. Browser code uses a public environment key; trusted server code uses a scoped server key. Deploy automation uses a separate deploy token.

Platform model

Organizations own billing and contain projects. Each project contains isolated development and production environments. An environment has its own auth secret, database, storage, KV, credentials, policies, domains, and usage boundary.

organization
└── project
    ├── development  (private, tightly capped)
    └── production   (subscription + prepaid controls)

Keys are intentionally different

• Public key (pk_*) identifies an environment. It grants no authority by itself; auth and row policies decide access.
• Server key (sk_*) is secret, scoped, rotatable, and shown once. It may bypass client row policies only when its scope permits.
• Deploy token (dp_*) is for CI and deployment operations, restricted to selected organizations, projects, and environments.

Structured failures

The API returns stable machine-readable codes including PAYMENT_REQUIRED, SUBSCRIPTION_REQUIRED, PROJECT_SUSPENDED, POLICY_DENIED, RATE_LIMITED, and REGION_UNAVAILABLE. The CLI adds human guidance while --json preserves automation-friendly output.