API reference

Credentials

Your credential is your account. There is no separate account resource, no username, and no password.

Getting a credential

There is no unauthenticated self-service provisioning endpoint, and no single documented request/response pair that hands you an app_id/app_key directly. Getting one is two stages:

Create a billing account with tessera signup (POST /agents) and mint a one-time connect key (POST /credentials). See Accounts & billing.
Register storage with that connect key. This is a cryptographic handshake, done by the CLI (tessera signup / tessera login) or the SDK it wraps. There is no documented raw-HTTP way to finish this stage.

Once registration completes you have an app_id and a 128-hex-character app_key (the full 64-byte Ed25519 private key), stored locally by the CLI.

GET /auth/check

Verifies that a credential is provisioned, active, and that your signature is correct. The cheapest way to test a signing implementation.

curl -sD - -o /dev/null "$TESSERA_API/auth/check?$AUTH"

Response — 204 No Content on success. No body.

401 with a plain-text reason otherwise; see Authentication for the full list of reasons and what each one means.

Parameter	Required	Description
`credential`	yes	The credential to revoke, padded base64url.

Status	Body	Cause
`400`	`missing credential`	The `credential` parameter was absent.
`401`	(various)	The signing credential was not accepted.
`405`	`method not allowed`	Not a `DELETE`.

Revoking a credential stops authorisation. It does not delete your objects, and the storage contracts covering their shards remain funded until they expire. If you intend to remove data, delete the objects first and then revoke — in that order, because after revocation you can no longer issue the deletes.

Account state

Internally a credential is in one of four states. Only active authorises requests:

State	Behaviour
`provisioned`	Created but not yet activated. Requests are refused as `unknown credential`.
`active`	Normal operation.
`suspended`	Temporarily refused, for example for non-payment. Data is retained.
`revoked`	Permanently refused. The record is kept so the key cannot be re-provisioned.

A refused request returns 401 unknown credential regardless of which non-active state applies — the API does not distinguish, deliberately, since telling an unauthenticated caller why a key is refused is more useful to an attacker than to you.

Caps

Each credential carries caps for maximum stored bytes, daily read and write volume, and monthly spend. Requests that would exceed a storage cap are refused with 402 Payment Required:

{
  "error": "storage cap exceeded",
  "capBytes": 5497558138880,
  "incomingBytes": 62914560
}

Caps are set when the credential is provisioned for you as part of a plan. Self-provisioned credentials are created with the default plan limits. See Limits.

Getting a credential

GET /auth/check

DELETE /auth/revoke

Account state

Caps