Owner
The owner is the party that owns the data and the accounts. Objects, principals, API keys, policies, and key pairs exist only as something that owner holds. There is no shared data between owners.
The owner id is written into every object name, after @:
simple:counter@YOUR_OWNER
That id says which owner holds the object. The id itself is not a secret. The root API key and the root private key issued for that owner are.
How an owner is created#
There are two ways to get the first owner. Both return the same four values, and both show the secrets only once.
- Dashboard or this site. Sign up, then copy the values from the Welcome page. See Account and credentials.
- From an edge. The edge signs with its own private key and the call creates the owner. Registration then returns
rootPrivateKey. Later request signatures use that key. See edge signature.
Edge signature → POST /v1/owner → owner + root credentials → store secrets → call the API
The request has no body. Do not send x-api-key. Send x-bs-edge-sign, x-bs-edge-sign-nonce, and x-bs-edge-sign-ts. The signature is Ed25519 over nonce + timestamp, using the edge private key.
What registration returns#
The Welcome page shows the same four values as owner, API key, public key, and private key.
owner— id of the owner. It marks the data and accounts that owner holds, including object names (name@owner).rootApiKey— first API key. Send it inx-api-key.rootPublicKey— public half of the root key pair. Identifies the pair and is included in a request signature.rootPrivateKey— private half of the root key pair. Signs requests as that owner.
rootApiKey and rootPrivateKey are secrets. Store them before you discard the response. Later calls do not return them again. rootPublicKey can be listed afterwards; the private key cannot.
After registration, authenticate with rootApiKey or with a request signature from the root key pair (nonce + timestamp + rootPublicKey). Use that access to create more principals, API keys, and policies.
When to call this endpoint#
- Provision an owner from an edge or backend that holds the edge private key
- Capture the root API key and root key pair at the moment they are issued
Do not call it to add another user or service inside an account you already have. Create a principal for that, then issue keys and policies for it.