[{"data":1,"prerenderedAt":546},["ShallowReactive",2],{"docs:\u002Fdocs\u002Fapi\u002Fprovisioning":3,"docs:nav":504},{"id":4,"title":5,"badge":6,"body":7,"description":107,"extension":496,"meta":497,"navigation":498,"order":114,"path":499,"section":500,"seo":501,"stem":502,"__hash__":503},"docs\u002Fdocs\u002Fapi\u002Fprovisioning.md","Credentials",null,{"type":8,"value":9,"toc":489},"minimark",[10,14,19,22,81,94,98,101,149,160,170,174,177,209,245,251,256,324,332,336,343,399,410,414,421,478,485],[11,12,13],"p",{},"Your credential is your account. There is no separate account resource, no username, and no\npassword.",[15,16,18],"h2",{"id":17},"getting-a-credential","Getting a credential",[11,20,21],{},"The billing account and the storage credential are different.",[23,24,25,47,56,75],"ol",{},[26,27,28,32,33,36,37,40,41,46],"li",{},[29,30,31],"code",{},"POST \u002Fapi\u002Fv1\u002Fagents"," with ",[29,34,35],{},"X-Altcha"," returns ",[29,38,39],{},"api_key",". The call is in\n",[42,43,45],"a",{"href":44},"\u002Fdocs\u002Fapi-quickstart","API quickstart",".",[26,48,49,52,53,46],{},[29,50,51],{},"POST \u002Fapi\u002Fv1\u002Fcredentials"," with that bearer key returns a one-time ",[29,54,55],{},"connect_key",[26,57,58,59,62,63,66,67,70,71,74],{},"Register it with ",[29,60,61],{},"go.sia.tech\u002Fsiastorage",": ",[29,64,65],{},"RequestConnection",", approve that URL with the\nconnect key, ",[29,68,69],{},"WaitForApproval",", then ",[29,72,73],{},"Register",". The same page has the calls.",[26,76,77,80],{},[29,78,79],{},"POST \u002Fapi\u002Fv1\u002Fcredentials\u002Factivate"," with the bearer key.",[11,82,83,86,87,89,90,46],{},[29,84,85],{},"sdk.AppKey()"," is the storage private key. It is not the billing ",[29,88,39],{},". Signing is\n",[42,91,93],{"href":92},"\u002Fdocs\u002Fauthentication","Authentication",[15,95,97],{"id":96},"get-authcheck","GET \u002Fauth\u002Fcheck",[11,99,100],{},"Verifies that a credential is provisioned, active, and that your signature is correct. The cheapest\nway to test a signing implementation.",[102,103,108],"pre",{"className":104,"code":105,"language":106,"meta":107,"style":107},"language-bash shiki shiki-themes github-dark-default github-dark-default","curl -sD - -o \u002Fdev\u002Fnull \"$TESSERA_API\u002Fauth\u002Fcheck?$AUTH\"\n","bash","",[29,109,110],{"__ignoreMap":107},[111,112,115,119,123,127,130,133,136,140,143,146],"span",{"class":113,"line":114},"line",1,[111,116,118],{"class":117},"sAxfE","curl",[111,120,122],{"class":121},"sEQcL"," -sD",[111,124,126],{"class":125},"skZ57"," -",[111,128,129],{"class":121}," -o",[111,131,132],{"class":125}," \u002Fdev\u002Fnull",[111,134,135],{"class":125}," \"",[111,137,139],{"class":138},"sb7RM","$TESSERA_API",[111,141,142],{"class":125},"\u002Fauth\u002Fcheck?",[111,144,145],{"class":138},"$AUTH",[111,147,148],{"class":125},"\"\n",[11,150,151,155,156,159],{},[152,153,154],"strong",{},"Response"," — ",[29,157,158],{},"204 No Content"," on success. No body.",[11,161,162,165,166,169],{},[29,163,164],{},"401"," with a plain-text reason otherwise; see ",[42,167,93],{"href":168},"\u002Fdocs\u002Fauthentication#failure-modes","\nfor the full list of reasons and what each one means.",[15,171,173],{"id":172},"delete-authrevoke","DELETE \u002Fauth\u002Frevoke",[11,175,176],{},"Revokes a credential. Effective immediately — the next request using it fails.",[102,178,180],{"className":104,"code":179,"language":106,"meta":107,"style":107},"curl -X DELETE \"$TESSERA_API\u002Fauth\u002Frevoke?credential=$TARGET&$AUTH\"\n",[29,181,182],{"__ignoreMap":107},[111,183,184,186,189,192,194,196,199,202,205,207],{"class":113,"line":114},[111,185,118],{"class":117},[111,187,188],{"class":121}," -X",[111,190,191],{"class":125}," DELETE",[111,193,135],{"class":125},[111,195,139],{"class":138},[111,197,198],{"class":125},"\u002Fauth\u002Frevoke?credential=",[111,200,201],{"class":138},"$TARGET",[111,203,204],{"class":125},"&",[111,206,145],{"class":138},[111,208,148],{"class":125},[210,211,212,228],"table",{},[213,214,215],"thead",{},[216,217,218,222,225],"tr",{},[219,220,221],"th",{},"Parameter",[219,223,224],{},"Required",[219,226,227],{},"Description",[229,230,231],"tbody",{},[216,232,233,239,242],{},[234,235,236],"td",{},[29,237,238],{},"credential",[234,240,241],{},"yes",[234,243,244],{},"The credential to revoke, padded base64url.",[11,246,247,155,249,46],{},[152,248,154],{},[29,250,158],{},[11,252,253],{},[152,254,255],{},"Errors",[210,257,258,271],{},[213,259,260],{},[216,261,262,265,268],{},[219,263,264],{},"Status",[219,266,267],{},"Body",[219,269,270],{},"Cause",[229,272,273,291,306],{},[216,274,275,280,285],{},[234,276,277],{},[29,278,279],{},"400",[234,281,282],{},[29,283,284],{},"missing credential",[234,286,287,288,290],{},"The ",[29,289,238],{}," parameter was absent.",[216,292,293,297,303],{},[234,294,295],{},[29,296,164],{},[234,298,299],{},[300,301,302],"em",{},"(various)",[234,304,305],{},"The signing credential was not accepted.",[216,307,308,313,318],{},[234,309,310],{},[29,311,312],{},"405",[234,314,315],{},[29,316,317],{},"method not allowed",[234,319,320,321,46],{},"Not a ",[29,322,323],{},"DELETE",[325,326,329],"app-callout",{"title":327,"tone":328},"Revocation stops access, not storage","warn",[11,330,331],{},"Revoking a credential stops authorisation. It does not delete your objects, and the storage\ncontracts covering their shards remain funded until they expire. If you intend to remove data,\ndelete the objects first and then revoke — in that order, because after revocation you can no longer\nissue the deletes.",[15,333,335],{"id":334},"account-state","Account state",[11,337,338,339,342],{},"Internally a credential is in one of four states. Only ",[29,340,341],{},"active"," authorises requests:",[210,344,345,355],{},[213,346,347],{},[216,348,349,352],{},[219,350,351],{},"State",[219,353,354],{},"Behaviour",[229,356,357,370,379,389],{},[216,358,359,364],{},[234,360,361],{},[29,362,363],{},"provisioned",[234,365,366,367,46],{},"Created but not yet activated. Requests are refused as ",[29,368,369],{},"unknown credential",[216,371,372,376],{},[234,373,374],{},[29,375,341],{},[234,377,378],{},"Normal operation.",[216,380,381,386],{},[234,382,383],{},[29,384,385],{},"suspended",[234,387,388],{},"Temporarily refused, for example for non-payment. Data is retained.",[216,390,391,396],{},[234,392,393],{},[29,394,395],{},"revoked",[234,397,398],{},"Permanently refused. The record is kept so the key cannot be re-provisioned.",[11,400,401,402,405,406,409],{},"A refused request returns ",[29,403,404],{},"401 unknown credential"," regardless of which non-active state applies —\nthe API does not distinguish, deliberately, since telling an unauthenticated caller ",[300,407,408],{},"why"," a key is\nrefused is more useful to an attacker than to you.",[15,411,413],{"id":412},"caps","Caps",[11,415,416,417,420],{},"Each credential carries caps for maximum stored bytes, daily read and write volume, and monthly\nspend. Requests that would exceed a storage cap are refused with ",[29,418,419],{},"402 Payment Required",":",[102,422,426],{"className":423,"code":424,"language":425,"meta":107,"style":107},"language-json shiki shiki-themes github-dark-default github-dark-default","{\n  \"error\": \"storage cap exceeded\",\n  \"capBytes\": 5497558138880,\n  \"incomingBytes\": 62914560\n}\n","json",[29,427,428,433,448,461,472],{"__ignoreMap":107},[111,429,430],{"class":113,"line":114},[111,431,432],{"class":138},"{\n",[111,434,436,440,442,445],{"class":113,"line":435},2,[111,437,439],{"class":438},"sV7Mv","  \"error\"",[111,441,62],{"class":138},[111,443,444],{"class":125},"\"storage cap exceeded\"",[111,446,447],{"class":138},",\n",[111,449,451,454,456,459],{"class":113,"line":450},3,[111,452,453],{"class":438},"  \"capBytes\"",[111,455,62],{"class":138},[111,457,458],{"class":121},"5497558138880",[111,460,447],{"class":138},[111,462,464,467,469],{"class":113,"line":463},4,[111,465,466],{"class":438},"  \"incomingBytes\"",[111,468,62],{"class":138},[111,470,471],{"class":121},"62914560\n",[111,473,475],{"class":113,"line":474},5,[111,476,477],{"class":138},"}\n",[11,479,480,481,46],{},"Caps are set when the credential is provisioned for you as part of a plan. Self-provisioned\ncredentials are created with the default plan limits. See ",[42,482,484],{"href":483},"\u002Fdocs\u002Flimits","Limits",[486,487,488],"style",{},"html pre.shiki code .sAxfE, html code.shiki .sAxfE{--shiki-default:#FFA657;--shiki-dark:#FFA657}html pre.shiki code .sEQcL, html code.shiki .sEQcL{--shiki-default:#79C0FF;--shiki-dark:#79C0FF}html pre.shiki code .skZ57, html code.shiki .skZ57{--shiki-default:#A5D6FF;--shiki-dark:#A5D6FF}html pre.shiki code .sb7RM, html code.shiki .sb7RM{--shiki-default:#E6EDF3;--shiki-dark:#E6EDF3}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sV7Mv, html code.shiki .sV7Mv{--shiki-default:#7EE787;--shiki-dark:#7EE787}",{"title":107,"searchDepth":450,"depth":450,"links":490},[491,492,493,494,495],{"id":17,"depth":435,"text":18},{"id":96,"depth":435,"text":97},{"id":172,"depth":435,"text":173},{"id":334,"depth":435,"text":335},{"id":412,"depth":435,"text":413},"md",{},true,"\u002Fdocs\u002Fapi\u002Fprovisioning","API reference",{"title":5,"description":107},"docs\u002Fapi\u002Fprovisioning","pL27JNlDJ184EBJgCswTeLvZ1MPprty5KkzYLNpFXO4",[505,509,512,515,518,521,522,525,526,530,533,536,538,543],{"path":506,"title":507,"description":107,"section":508,"order":435,"badge":6},"\u002Fdocs\u002Faccounts","Accounts & billing","Guides",{"path":44,"title":45,"description":510,"section":511,"order":114,"badge":6},"Create a billing account over HTTP, then register a storage key with the SDK.","API",{"path":513,"title":514,"description":107,"section":500,"order":474,"badge":6},"\u002Fdocs\u002Fapi\u002Faccount","Account",{"path":516,"title":517,"description":107,"section":500,"order":463,"badge":6},"\u002Fdocs\u002Fapi\u002Fobjects","Objects",{"path":519,"title":520,"description":107,"section":500,"order":435,"badge":6},"\u002Fdocs\u002Fapi\u002Fplacement","Placement",{"path":499,"title":5,"description":107,"section":500,"order":114,"badge":6},{"path":523,"title":524,"description":107,"section":500,"order":450,"badge":6},"\u002Fdocs\u002Fapi\u002Fslabs","Slabs",{"path":92,"title":93,"description":107,"section":508,"order":450,"badge":6},{"path":527,"title":528,"description":107,"section":529,"order":435,"badge":6},"\u002Fdocs\u002Fconcepts","Concepts & data model","Introduction",{"path":531,"title":255,"description":107,"section":532,"order":114,"badge":6},"\u002Fdocs\u002Ferrors","Reference",{"path":534,"title":535,"description":107,"section":511,"order":114,"badge":6},"\u002Fdocs","Overview",{"path":483,"title":537,"description":107,"section":532,"order":435,"badge":6},"Limits & quotas",{"path":539,"title":540,"description":541,"section":542,"order":114,"badge":6},"\u002Fdocs\u002Fquickstart","CLI quickstart","Install the CLI, create an account, store one file, and read it back.","CLI",{"path":544,"title":545,"description":107,"section":508,"order":463,"badge":6},"\u002Fdocs\u002Frecovery","Recovery without Tessera",1794060204999]