oneclient
Sign inStart building
Quickstart

From empty folder to a live development app.

The complete path: account, project, schema, browser auth, SDK, and immutable deployment. No provider credentials required.

1. Install and sign in

terminalbash
npm install oneclientnpx oneclient login --email you@company.comnpx oneclient doctor

The hosted CLI already knows the OneClient control API. It emails a short-lived code and stores the signed developer session in an owner-only local file. You do not configure an API URL for account, project, billing, or deployment commands.

2. Create the project and keep the shown-once values

terminalbash
npx oneclient --json init --project-name "Northline" # The response includes:# project.id                            -> prj_...# development environment id + apiUrl -> env_... / https://dev_....api...# credentials.development.publicKey   -> pk_...# credentials.development.serverKey   -> sk_...

A new organization receives one tightly capped development project. Save the initial keys when they are shown: the publishable key is browser-safe, while the server key belongs only in a trusted shell or secret store. Existing projects can rotate keys with oneclient key:create.

3. Create a table and activate its client policy

migrations/001_feedback.sqlsql
CREATE TABLE IF NOT EXISTS feedback (  id TEXT PRIMARY KEY,  user_id TEXT NOT NULL,  message TEXT NOT NULL,  created_at TEXT NOT NULL);
oneclient.policy.jsonjson
{  "version": 1,  "tables": {    "feedback": {      "rules": [{        "id": "owner-feedback",        "effect": "allow",        "operations": ["select", "insert"],        "condition": {          "eq": [            { "ref": "record.user_id" },            { "ref": "auth.user.id" }          ]        },        "allowFields": ["id", "user_id", "message", "created_at"],        "maxRows": 50      }]    }  }}
terminalbash
export ONECLIENT_API_URL=https://dev_REFERENCE.api.one-client.comexport ONECLIENT_SERVER_KEY=sk_VALUE_SHOWN_ONCE npx oneclient sql --file migrations/001_feedback.sqlnpx oneclient policy:publish --table feedback --file oneclient.policy.json

SQL is server-key-only and bounded by declared read, write, and storage maxima. Browser queries remain deny-by-default until a policy is successfully activated.

4. Trust the local browser and add the React client

terminalbash
npx oneclient auth-origin:add \  --environment env_DEVELOPMENT \  --origin http://localhost:5173
.env.localbash
# .env.local — pk_* is intentionally browser-safeVITE_ONECLIENT_API_URL=https://dev_REFERENCE.api.one-client.comVITE_ONECLIENT_PUBLISHABLE_KEY=pk_VALUE_SHOWN_ONCE
src/oneclient.tstypescript
import { createClient } from "oneclient"; export const one = createClient({  baseUrl: import.meta.env.VITE_ONECLIENT_API_URL,  publishableKey: import.meta.env.VITE_ONECLIENT_PUBLISHABLE_KEY,}); await one.auth.sendOtp({ email });const session = await one.auth.getSession();const feedback = await one  .from("feedback")  .select("id", "message", "created_at")  .limit(20)  .execute();

Next.js uses public environment names such as NEXT_PUBLIC_ONECLIENT_PUBLISHABLE_KEY. Never put an sk_* or dp_* value in a public build variable.

5. Build a signed artifact

terminalbash
npm run buildmkdir -p .oneclientnpx oneclient artifact:create \  --directory . \  --manifest .oneclient/manifest.json \  --archive .oneclient/app.tar \  --framework vite \  --build-command "npm run build" \  --output-directory dist \  --lockfile npm

Packaging rejects unsafe paths, links, special files, oversized input, and secret-style environment files. The manifest hashes every included file before upload.

6. Create a scoped deploy token and publish development

terminalbash
npx oneclient deploy-token:create \  --environment env_DEVELOPMENT \  --name local-cli export ONECLIENT_DEPLOY_TOKEN=dp_VALUE_SHOWN_ONCEnpx oneclient deploy \  --manifest .oneclient/manifest.json \  --archive .oneclient/app.tar \  --project prj_PROJECT \  --environment env_DEVELOPMENT \  --wait npx oneclient deployments --environment env_DEVELOPMENT

The CLI uploads an immutable artifact, waits for the bounded build, and prints the preview URL only after the platform reports it ready. Development deployment never activates production.

Production remains deliberate. Use --production only after a human approves promotion and the organization has an active plan with sufficient funded credits. Hard stops reject unfunded work before it reaches Cloudflare.

7. Give an agent the same bounded workflow

terminalbash
npx oneclient mcpnpm install @oneclient/skill # Store one scoped sk_* or dp_* value in the agent's secret store.# Never paste it into a prompt or commit it to the application.

Continue with AI & MCP to connect the remote MCP endpoint, inspect the live model catalog, and declare a funded maximum before managed inference.