0 Get started
Let a management client — the Pithy dashboard, or one you write yourself — reach into your own Worker, with no data plane in between. Present and denying by default: with no connection registered, every route answers 403.
@pithy-sh/core
pithy add controlplaneHow a management client — the Pithy dashboard, or one you write yourself — reaches into your own Worker to read and administer your own data, with no data plane in between.
Capabilities contribute their own admin routes behind it, so adding one adds its management surface with nothing to wire.
What it sits on
Adding it composes it; connecting a client is a deliberate second step.
The honest bit
A Worker that has never been connected answers every control-plane route with a refusal. The credential is asymmetric — the client holds a private key, you hold and can revoke the public one — so nothing secret of yours ever leaves your infrastructure, and a breach on our side is not a breach on yours.
Rotation is append, prove, then expire, so a failed rotation leaves the old key working. Revocation is a row you delete: immediate, and needing nothing from us.
If you build it yourself
Any API can be opened. The design problem is revocation you control.
A shared secret means their breach is your breach. A public key you hold means a compromise on their side is inert the moment you delete a row.
An unconnected Worker must refuse, with no flag left off and no backdoor to open.
Append, prove, then expire — never replace.
Single scope, bound to a digest of the request body, checked for replay, and expiring in a minute.
What a management client did, recorded separately from what your users did.
pithy add controlplaneComposes with
In the dashboard
This capability is what the dashboard talks to. Connecting it is what makes every other pane readable.
The dashboard is the admin interface for your own application: whatever this capability writes, your team can look up, check and act on from a browser. Reading is free, forever, with no time limit. Connect the project when you deploy.
Everything else
Each one composes the same way. Nothing you skip costs you anything.
One command installs the package, wires its bindings into every environment your project declares, and runs its migrations.