Documentation

Architecture

One request path, two ways to store data. The platform checks auth, permissions, verification, rate limits and quotas on every request before the command ever reaches a store.

Request path Isolation Quotas

The path of a request

Transport. Your client speaks HTTPS (HTTP plane) or RESP over TCP (gateway). Both end into the same API: the gateway translates each Redis command into an authenticated REST call.
Identity. attachUser resolves your credential — a browser session token or an rk_ API key. An API key pins the request to exactly one database and one permission level (read-only or read-write).
Checks. Email verification for new accounts, CORS for browsers, body-size limits, per-database concurrency caps, then rate limits — 429 + Retry-After instead of queueing.
Execution. The command is validated against the engine registry and executed in your tenant namespace; writes carry their TTL (mandatory, default 24 h).
Reply. A uniform { success, data, meta } envelope, with timing surfaced in Server-Timing on every response.

Tenant isolation

Every database is a sealed namespace on the backing store. Keys are rewritten to rh:<namespace>:<key> at the boundary and stripped again on the way back — cross-tenant reads are structurally impossible, not forbidden-by-convention.
A read-only key that attempts any write gets 403 ERR_FORBIDDEN before the command executes.
Exactly one active API key per database; a second mint attempt returns 409 ERR_CONFLICT (revoke, then re-mint to rotate).
Another account's unknown database returns the same 404 contract as a missing key — the API never confirms other tenants exist.

Quotas that hold

Limit	Free-plan default	Behavior beyond the limit
Databases per account	5	Creation refused with ERR_QUOTA_EXCEEDED
Keys per database	10,000	Write refused; nothing partially stored
Value size per key	512 KiB	413 ERR_PAYLOAD_TOO_LARGE
Admin-raised ceilings	Adjustable per account	Admins can search accounts and tune limits

Operator data-plane modes

The client contract never changes; the backing store does:

Mode	Backing store	Notes
Embedded (default)	The platform engine itself	Zero configuration; same command surface
Remote (optional)	A real Redis server the operator configures	Connection lives server-side only; every DB becomes a namespaced tenant on that server

Server-side details (the TLS CA file, connection string, sweep loop) stay in the operator's environment and are never exposed to consumers — no API response, log line or docs page carries them.

Security and operations

Keys are stored hashed; plaintext is shown exactly once at mint time.
Revocation is immediate — the next request with a revoked key fails with 401 ERR_UNAUTHORIZED.
Every request carries a request id; key and database lifecycle changes land in the audit log.
Every write requires an expiry — forgotten keys cannot become silent storage costs (see TTL policy).
Rate-limit windows and quota counters are server-side; clients see only the 429 contract.