Developer
Developer Platform V1

Build with ALYSSIUN

Register a normal web application, receive a stable App ID, and declare only the ALYSSIUN services and permission scopes it needs.

Architecture

The platform reuses ALYSSIUN Account for sign-in and identity, ALYSSIUN Drive for canonical publisher Spaces, and the existing ALYSSIUN ID developer registry. It does not create developer credentials, users, profiles, Spaces, or file storage.

An App ID identifies an application. It is public and is never treated as a browser secret. Registered origins, publisher ownership, declared scopes, the user session, and future installation grants are validated server-side.

Register an app

  1. Sign in with your ALYSSIUN Account.
  2. Choose your personal identity or a Space you own as publisher.
  3. Enter the app URL and exact HTTPS origin.
  4. Select services and explicit permissions.
  5. Copy the generated App ID.
{
  "name": "Example App",
  "version": "1.0.0",
  "permissions": ["account.basic", "id.profile"]
}

The seven services

ALYSSIUN Account

account.basic

ALYSSIUN ID

id.profile

ALYSSIUN Permissions

Granted-scope checks.

ALYSSIUN Drive

drive.files.selected

ALYSSIUN Payments

Contract only in this foundation.

ALYSSIUN Notifications

notifications.send

ALYSSIUN AI

ai.generate

@alyssiun/sdk

npm install @alyssiun/sdk
import { createAlyssiun } from '@alyssiun/sdk';

const alyssiun = createAlyssiun({
  appId: 'app_REPLACE_WITH_YOUR_APP_ID',
  permissions: ['account.basic', 'id.profile']
});

const account = await alyssiun.account.getBasic();

SDK failures use AlyssiunError with a stable code. Before the secure OS bridge exists, service calls reject with BRIDGE_UNAVAILABLE; they never fall back to direct databases or browser-held credentials.

Security model

  • Third-party apps are untrusted.
  • Origins are exact HTTPS origins; paths and wildcards are rejected.
  • Scopes must be registered and later granted per app installation.
  • Drive access is selected-file only; whole-account and cross-Space access are not implied.
  • App ownership and publisher Space ownership are enforced on the server.
  • Production secrets never enter client code or the SDK.

Deferred

Store discovery and publishing, installation and approval UI, the OS embedded runtime, payments and publisher billing, moderation, Engine package installation, ratings, reviews, analytics, hosting, and native packaging are intentionally outside this foundation.