Scoped Tokens

┌─────────────────┐      POST /tokens       ┌──────────────────┐
│  Your Backend    │ ──────────────────────▶  │  Oblien API      │
│  (admin API key) │ ◀──────────────────────  │  returns JWT     │
└────────┬────────┘                          └──────────────────┘
         │ hand JWT to user
         ▼
┌─────────────────┐    Bearer <jwt>          ┌──────────────────┐
│  End User        │ ──────────────────────▶  │  /workspace/*    │
│  (browser/app)   │                          │  (namespace only)│
└─────────────────┘                          └──────────────────┘

{
  "success": true,
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "expiresAt": "2026-03-15T12:15:00.000Z",
  "scope": "namespace",
  "ttl": 900
}

import Oblien from 'oblien';

// ─── Your backend (runs on your server with admin key) ─────────

const admin = new Oblien({
  clientId: process.env.OBLIEN_CLIENT_ID!,
  clientSecret: process.env.OBLIEN_CLIENT_SECRET!,
});

// 1. Customer signs up → create their namespace
const ns = await admin.namespaces.create({
  name: `customer-${customerId}`,
  type: 'production',
  resource_limits: {
    max_workspaces: plan.maxWorkspaces,
    max_vcpus: plan.maxCpus,
    max_ram_mb: plan.maxRamMb,
  },
});

// 2. Set spending quota
await admin.namespaces.setQuota({
  namespace: ns.data.slug,
  service: 'sandbox',
  quotaLimit: plan.monthlyCredits,
  period: 'monthly',
  overdraft: plan.monthlyCredits * 0.1,
  onOverdraftAction: 'stop_workspaces',
});

// 3. Customer logs into your app → issue them a scoped token
const { token, expiresAt } = await admin.tokens.create({
  scope: 'namespace',
  namespace: ns.data.slug,
  ttl: 3600, // 1 hour
});

// Return token + expiresAt to your frontend

// ─── Your frontend (runs in the user's browser) ────────────────

const userClient = new Oblien({ token });

// User can only see and create workspaces in their namespace
const workspaces = await userClient.workspaces.list();

const newWorkspace = await userClient.workspaces.create({
  image: 'node-20',
  config: { cpus: 2, memory_mb: 2048 },
});
// namespace is automatically set to the bound namespace — cannot be overridden

// When the token expires, get a fresh one and swap it in:
const fresh = await fetchNewTokenFromYourBackend();
userClient.setToken(fresh.token);