Agent-friendly cloud storage.

1. Install the CLI

curl -fsSL https://tessera.storage/install.sh | sh

The installer verifies the binary against the release's SHA256SUMS, never uses sudo, and installs to ~/.local/bin. If that is not on your PATH it adds one marked line to your shell's startup file — it asks when it can reach a terminal, and does it automatically (naming the file) when it runs headless. Set TESSERA_NO_MODIFY_PATH=1 to skip that; in the current shell run export PATH="$HOME/.local/bin:$PATH" or call ~/.local/bin/tessera directly. TESSERA_RELEASE_REPO=owner/repo installs from a fork or mirror instead of the official repo (the installer warns when it is set); TESSERA_INSTALL_DIR picks another directory.

Network needs: HTTPS to tessera.storage and index.tessera.storage, plus uploads and downloads need direct network access to the storage hosts (details below).

2. Sign up (headless)

Creates the account and its storage identity in one step and logs this machine in — no separate tessera login, no browser, no email confirmation. --contact-email is optional (billing notices only; not a login). It shows your recovery phrase and API key once: keep both. On a terminal it prints them; when stdout is a pipe, file or agent log it writes them to a private (0600) file instead and prints only its path, so they never land in logs. --secrets-file <path> chooses the file, --show-secrets prints them anyway.

tessera signup --name "my-agent"  # --contact-email optional (billing notices only)

════════════════════════════════════════════════════════════════
  ACCOUNT CREATED — KEEP THESE TWO THINGS SAFE
  They will not be shown again. Tessera's servers never see your phrase.
  This machine does not save the phrase unless you later choose an encrypted
  local copy at login (optional). Write it down now.
════════════════════════════════════════════════════════════════
  1. Recovery phrase (12 words) — restores your account and files:
       word1 word2 ... word12
  2. API key — your account password for scripts and support:
       tsk_xxxxxxxx_...
════════════════════════════════════════════════════════════════
  Account ID: AGNT-xxxxxxxxxxxx
  App ID:     xxxxxxxx...
  This machine is logged in — no 'tessera login' needed.
════════════════════════════════════════════════════════════════

Lost this machine? Log back in anywhere with:
  tessera login "<your 12-word recovery phrase>"

Balance: $0.00
Status:  technical validation
         Technical validation: one upload of up to 40 MiB (one block) and one download. Tessera pays the storage hosts for it. Your balance stays $0.00. Top up any time to continue: tessera topup 1
         Uploads: allowed now, no top-up needed

Next: tessera upload <file>. Add funds any time: tessera topup 1 (crypto minimum ~$0.38 in USDC on Base, more for other coins; live list: tessera topup --minimums).

$ tessera signup --name "my-agent" > signup.log     # stdout is not a terminal
  Your recovery phrase and API key were NOT printed (this output is
  not a terminal). They are in a private file readable only by you:
       ~/.tessera/signup-secrets-AGNT-xxxxxxxxxxxx.txt
  Copy both into a password manager now, then delete that file:
       tessera secrets done
       # or: rm ~/.tessera/signup-secrets-AGNT-xxxxxxxxxxxx.txt

Technical validation. Every new account starts at $0.00 with one upload of up to 40 MiB (one block) and one download, as a technical validation. Tessera pays the storage hosts for it; your balance never changes. tessera status, account and usage all show the validation state and whether uploads are allowed now; with --json the same facts are in a trial object (can_upload, top_up_required, balance_usd). On an unfunded account days_left is null. A network flag, Host funding ready: false, stays off until the first top-up; it does not stop the technical-validation uploads.

3. Log back in with the phrase

Signup already registered storage and logged this machine in — it wrote app_id and app_key (your private key, never printed; tessera whoami shows only its public half as Public key) into your config file. On any other machine, the recovery phrase alone restores the same account and App ID headlessly (add --api-key <key> if you have it):

rm -rf ~/.tessera                        # new machine, or a wiped config
tessera login "<your 12-word recovery phrase>"   # same account, same App ID, no browser

The phrase is printed exactly once at signup. Tessera never stores it. Optionally, login can save an encrypted copy on this machine only (phrase password). There is no recoverable copy on our side — losing the phrase is permanent and unrecoverable; everything stored under that identity becomes unreachable.

Pure-API agents (no CLI): you can create the billing account directly with POST /api/v1/agents (see Accounts, plans & billing), but the connect-key → storage-identity step is a cryptographic registration handshake, not a simple request/response pair we can hand you as a copy-pasteable call. There is currently no documented way to finish that step without running the CLI or the storage SDK it wraps. If you want to implement the signing scheme yourself, see Authentication.

4. Store and verify

tessera upload myfile.txt --as critical.txt
tessera download critical.txt

Signup pre-funds ~40 trial hosts and waits until enough are ready for an upload. If funding is still landing at upload time, the CLI waits (up to about 2 minutes) and shows waiting for host funding: N/30 hosts funded; the upload summary's wall time includes that wait. After you top up, host balances are already funded and uploads proceed without it. Uploads and downloads need direct network access to the storage hosts. If a transfer cannot run, the CLI says why: insufficient balance, account not ready yet, or too few hosts reachable — see transfer errors (direct TCP over siamux, on the port each host announces, usually 9984; each upload needs 30 reachable hosts, each download 10 of the hosts holding the file; host lists include IP addresses, so fake-IP DNS sandboxes work, but an HTTP(S)-only proxy is not enough).

Why usage shows three sizes. Files are stored in 40 MiB slabs, billed whole, so one small file uploaded on its own still fills a slab (folder uploads and tessera sync pack small files into shared slabs). Each slab becomes 30 pieces of 4 MiB on 30 hosts, any 10 of which rebuild it, so the network holds 3× the stored size. A technical-validation download shows the downloaded size as not billed; after you top up, download cost comes from measured host spend.

$ tessera usage        # after one 1.7 MB PDF upload and its technical-validation download
  logical size:    1.70 MiB (your files, all machines)
  stored:          40.00 MiB (1 slab of 40 MiB)
  network size:    120.00 MiB (3× redundancy across hosts)
  downloads:       1.70 MiB (1 technical-validation download, not billed)
  balance:         $0.00
  days left:       n/a — technical validation (top up to continue storing)

The CLI reports SHA-256. Compare the bytes yourself. For what "verify" actually checks on download, see how Tessera's 10/30 read-back works.

After technical validation

Steps 1–4 above are free: they use the one upload and one download of the technical validation, and Tessera pays the storage hosts for it. After that, uploads stop until you top up. To keep using Tessera, add funds with tessera topup 1. The built-in x402 wallet (tessera wallet init, then tessera topup 0.50 --wallet, USDC on Base) takes any amount from $0.01; a deposit address or browser invoice in USDC, USDT, BTC, ETH, XMR and many more coins needs that coin's minimum (about $0.38 for USDC on Base) — see adding funds for the payment rails, or see what a terabyte actually costs, and what a single slab costs to retrieve.