API REFERENCE
Authentication & keys
Keep machine access scoped, expiring and revocable.
Account sessions
Register with an email and a 15–128 character password. On computeruse.space, one browser sign-in is shared by the account portal, host portal, admin pages and desktop. Menu navigation, page refresh and opening another tab restore that session automatically. Administrators and network staff complete MFA when signing in, and that verified session is reused across pages.
Sessions retain their existing one-hour absolute lifetime. Navigating does not extend it. After expiry, explicit sign-out, revocation or suspension, sign in again. Sign-out revokes the browser credential and notifies other open account tabs; an expired or disconnected human desktop session leaves agents paused until explicit handback.
Browser login uses POST /api/v1/session/login and a Secure, HttpOnly, host-only cookie. GET /api/v1/session returns authenticated status and non-secret session/account metadata; POST /api/v1/session/logout revokes the session and clears the cookie. Website requests include X-ComputerUse-Request: 1; mutation requests must carry the matching website Origin. The API rejects cross-origin cookie access and does not enable CORS for it. The cookie is never copied into JavaScript, localStorage, sessionStorage, links or query strings.
Programmatic POST /api/v1/login keeps its existing bearer contract: token, credential id and expires as Unix seconds. API clients continue to send Authorization: Bearer .... An explicit bearer credential takes precedence over a browser cookie.
API scopes
| Scope | Permits |
|---|---|
| account:read | Account-owned rentals, balance and metadata |
| rentals:write | Purchase and renewal preference changes |
| agents:write | Assignment of an agent identifier to an owned active rental |
| desktop:read | Assigned desktop status and screenshots |
| desktop:write | Exclusive control leases and mouse/keyboard input |
API keys expire after 30 days in the current implementation. Create them using a signed-in session and POST /api/v1/keys with a scopes array. Billing/key administration and admin actions cannot be granted to ordinary API keys.
Least privilege
Give monitoring tools account:read. Enable write scopes only for agents explicitly authorized to spend credit or change assignments. An API key currently covers the account within its scopes; per-rental credentials are part of the planned connection broker, not an existing guarantee.
Revocation
POST /api/v1/keys/revoke accepts the credential id and only affects keys owned by the caller. Suspension revokes all account credentials. Desktop sessions require separate controller-side revocation once that service is connected.
Secret handling
Keep API keys out of frontend source, URL query strings, screenshots, logs and agent prompts. The browser viewer uses the protected website session to authorize the assigned desktop. Its direct local connection has a separate short authorization window and never receives the private guest-service token or a host administrator password.