Admin SDK and dashboard

The HUB's Admin API drives accounts, users, regions, storages, volumes, and access keys. It is reached with the Admin SDK or over REST.

Authentication

Requests are signed with the admin key. appserv verifies each signature against PROVIDER_VERIFICATION_KEY. Only backends hold the admin key, so it never reaches a browser.

Two key pairs are in play. The admin key (MOUNTOS_SDK_SIGNING_KEY, verified by appserv against PROVIDER_VERIFICATION_KEY) authorizes Admin API calls. The dashboard session pair (DASHBOARD_SIGNING_KEY and DASHBOARD_VERIFICATION_KEY) backs the opaque token the dashboard browser holds.

User-level authorization is carried separately, signed with a dedicated DASHBOARD_USER_HMAC_KEY shared only between the dashboard backend and appserv. It is a distinct secret from the public PROVIDER_VERIFICATION_KEY, so the two authorization scopes stay separate.

SDK

The SDK is open source, with TypeScript, Go, and Rust packages generated from one API spec. All three expose the same resource groups. Accounts, users, regions and clusters, storages, volumes with forks and API keys, audit logs, nodes, client sessions, alerts, license, vault, discovery, and the dashboard. The packages are versioned together with the API, and the npm package ships a SKILL.md with version-matched guidance for AI agents. Source and reference live in the admin SDK repository.

npm i @mountos-io/admin-sdk

import { createServerClient } from '@mountos-io/admin-sdk'

const client = createServerClient({
  baseUrl: 'https://hub.example.com',
  privateKey: process.env.MOUNTOS_SDK_SIGNING_KEY!,
})

const { id } = await client.accounts.create({ name: 'mountOS' })

go get github.com/mountos-io/mountos-admin-sdk/go

import sdk "github.com/mountos-io/mountos-admin-sdk/go"

client, err := sdk.NewClient(sdk.Config{
  BaseURL:    "https://hub.example.com",
  PrivateKey: os.Getenv("MOUNTOS_SDK_SIGNING_KEY"),
})

acct, err := client.Accounts.Create(ctx, &sdk.CreateAccountRequest{Name: "mountOS"})

cargo add mountos-admin-sdk

use mountos_admin_sdk::{Client, Config, CreateAccountRequest};

let client = Client::new(Config {
    base_url: "https://hub.example.com".into(),
    private_key: std::env::var("MOUNTOS_SDK_SIGNING_KEY").unwrap(),
    ..Default::default()
})?;

let created = client.accounts.create(&CreateAccountRequest {
    name: "mountOS".into(),
    description: None,
    icon_url: None,
    provider_info: None,
}).await?;

REST

The API is served under /api/v1 on the HUB domain. Each request carries a bearer token in the Authorization header. The token is a JWT signed with the admin key. The SDKs mint it automatically. For direct REST, every route and the token claims are documented in api.md in the SDK repository.

curl https://hub.example.com/api/v1/accounts/list \
  -H "Authorization: Bearer $JWT"

Other languages

The API spec, api.yaml, is the source the three packages are generated from. Use it to generate a client in any other language, or contact support@mountos.io.

Dashboard

The admin dashboard is an optional UI over the same Admin API. Anything it does is also an SDK or REST call.

It runs as a browser frontend with a small backend gateway. The gateway holds the admin key and signs requests. The browser holds only a short-lived opaque session token. The dashboard is open source as mountos-admin-client.