drift Docs
Start
What is Drift?
The tour, if you are new here.
Why Drift?
The case for a smaller cloud.
Getting started
Nothing to deployed, in one command.
Architecture
How a slice is put together.
What it costs
The free grant, five unit prices, two rules.
Build
Atomic
Serverless functions.
Write a function
The handler shape, and what you pay for.
The directive
Trigger, route, auth and secrets on one line.
Six languages
Go, Python, Node, Ruby, PHP, Rust.
Runtime versions
Which interpreter version your function runs on.
Authentication
The auth= gate, and per-route API keys.
Request headers
What reaches your handler, and what does not.
Triggers
Queue-triggered and scheduled functions.
Streaming
SSE and WebSocket from one function.
Outbound egress
What a slice may dial.
Limits and alerts
Timeout, memory and rate, and being told.
Elements
One language, one manifest, many functions.
The CLI surface
Every drift atomic command.
Backbone
Secrets, data, blobs, queues.
NoSQL
JSON collections, upserted on _id.
SQL
Per-slice SQLite, with transactions.
Blobs
Files and uploads, organised by bucket.
Secrets
Encrypted config a function declares.
Queues
FIFO messages that trigger functions.
Cache
Key/value strings with a TTL.
Locks
Stop two workers doing one job.
Realtime
In-slice pub/sub over WebSocket.
Canvas
Static sites, same origin as your API.
Deed
Identity, devices and wallets.
KeyAuth
Passwordless login with device keys.
JWT
Sign and verify with the slice's own key.
Vault
Ciphertext the slice cannot read.
Link
Enroll a second device by attestation.
Pocket
E2EE app data that follows an identity.
Tools
CLI
One binary, every noun.
Reference
The binary, and every noun.
account
Sign up, log in, delete.
slice
Create, resize, snapshot, domains.
project
Deploy, diff, run locally.
file
Lint and explain a Driftfile.
atomic
One function at a time.
backbone
Reach into the data plane.
deed
One read-only status command.
canvas
Deploy a static site.
migrate
Move off another cloud.
Dashboard
What bare drift opens.
SDK
Six languages, zero dependencies.
Writing a handler
Arguments, request, return.
API reference
Both namespaces, every call.
NoSQL
Documents, by _id or storage key.
SQL
Queries and transactions.
Cache
Strings with a TTL.
Secrets
Read what the function declared.
Blobs
Bytes, addressed bucket/key.
Queues
Push, and pull if you must.
Locks
A token you hand back.
Realtime
Publish, and count who heard.
Deed
KeyAuth, JWT, Vault, Link, Pocket.
Utilities
Logs, egress, cross-slice calls.
Languages
The same handler, six ways.
Driftfile
One file that describes your app.
Anatomy
Every top-level key, and the name rules.
A worked example
One app with every section written out.
Atomic
Function limits, schedules, alerts, egress.
Backbone
Collections, databases, buckets, secrets.
Canvas
Sites, and the route each mounts on.
Domains
Custom hostnames the slice answers on.
Environments
One project, several slices, one file.
Deploying
Lint it, hook a build on, read its errors.
Operate
Auth
Accounts, tokens and scopes.
Security
Boundaries, sandboxing and hardening.

Deed Link

Multi-device continuity for a KeyAuth identity: enroll a second, third, … device without ever handing over the original private key. Not to be confused with cross-slice calling (drift slice link, an unrelated feature for one of your own slices calling another); this Link enrolls a device for one identity.

Called byWhat it does
  • Begin(pubkey, metadata?)
    Called by
    the joining device
    What it does
    Opens a session and returns its id. metadata is an opaque string the attester can read back.
  • QR(text)
    Called by
    either
    What it does
    Renders a short string, in practice the session id, as SVG markup, server-side.
  • SessionInfo(sessionID)
    Called by
    the attesting device
    What it does
    Returns the session's new_pubkey and metadata. Read-only and repeatable.
  • Attest(identity, sessionID, attestingPubkey, sig, sealed?)
    Called by
    an active device
    What it does
    Vouches for the session's device. sealed is an opaque payload relayed to the joiner.
  • Complete(sessionID)
    Called by
    the joining device
    What it does
    Polls the session: pending, then attested with the identity and any sealed payload.
  • Revoke(identity, targetPubkey, revokingPubkey, sig)
    Called by
    an active device
    What it does
    Deactivates a device, including itself.

Enrolling a second device

SessionInfo is not optional in practice. The attesting device only ever learns the session id, from a scanned or typed code, and the message it has to sign is over the joiner's new_pubkey. The slice verifies against its own stored copy of that value and never trusts the request body, so the attester has to fetch it and rebuild the message exactly.

Go
// on the NEW device: fresh keypair, open a session, show the code
sessionID, _ := drift.Deed.Link.Begin(newDevicePubkey, boxPubkeyHex)   // metadata: a key to seal for
svg, _ := drift.Deed.Link.QR(sessionID)

// on an ALREADY-ACTIVE device: read the session, sign client-side, attest
info, _ := drift.Deed.Link.SessionInfo(sessionID)   // info.NewPubkey, info.Metadata
drift.Deed.Link.Attest(identity, sessionID, activePubkey, sig, sealedForJoiner)

// back on the NEW device, polled until an active device has vouched
status, _ := drift.Deed.Link.Complete(sessionID)
// status.Status == "attested" → status.Identity, status.Sealed

sealed is how the joining device receives key material. Deed relays it and never opens it: seal a payload for the ephemeral key the joiner published as metadata, and Complete hands it back once the attestation lands. A session lives 5 minutes.

Link's two signatures are made client-side over a fixed domain of Link's own, not your app's in the same canonical form as KeyAuth's, with sorted keys and no whitespace:

JSON
{"domain":"drift-deed-link-attest-v1","identity":"<identity>","new_pubkey":"<joiner>"}
{"domain":"drift-deed-link-revoke-v1","identity":"<identity>","target_pubkey":"<device>"}

Revoking a device

Go
drift.Deed.Link.Revoke(identity, targetPubkey, revokingPubkey, sig)

Any currently-active device can revoke another, or itself. The revoked key still produces cryptographically valid signatures; KeyAuth refuses it anyway, which is what the registry is for.

Drift verifies, it never decides.

A device joins an identity's registry only on the strength of a signature from a device that is active in that same registry. An identity with no registry yet has exactly one implicit, active device: its own KeyAuth pubkey. The registry materialises the first time Attest succeeds, or the first time that implicit device revokes itself, which writes a one-entry registry marked revoked. Snapshot restore is the one path that writes a registry with no attestation at all, and it is operator-only.