The model

Tenant → App → Environment

Your org is a tenant. Each tenant has apps; each app has test and live environments with separate keys, users, sessions, and signing keys. RLS enforces isolation at the database level — not app logic.

Keys

pk_* publishable (client-safe, rate-limited) · sk_* secret (server) · whsec_* webhook signing. Stored as SHA-256 hashes; shown once at mint.

Sessions

Access token: 15-min RS256 JWT (per-tenant keypair, JWKS-verifiable offline). Refresh token: 30-day, rotating — use it and the old one dies.

Credits

Live sends debit credits — only after the provider accepts the send. Failed sends cost nothing. BYO gateways cost nothing, ever.