Smallware for developers and agents

From an empty directory to a live URL. Bun 1.0 or newer must be on PATH.

npx @pylonsync/cli login
npm create @pylonsync/pylon@latest my-app
cd my-app
bunx pylon projects create my-app
bunx pylon deploy

The app serves at https://my-app.smallware.run. Add --template saas to the scaffold command when the app needs accounts, organizations, and billing wired up already. bunx pylon dev runs the whole thing locally on one port, and bunx pylon --help lists every command.

Every API call carries Authorization: Bearer <token>. There are two kinds of token, and the prefix tells them apart.

User API keys start with pk. Any signed-in user mints one at the CLI tokens page in two clicks. The token is shown once, carries your own role on every organization you belong to, and can be revoked one machine at a time. npx @pylonsync/cli login mints one for you and stores it locally, so most people never copy a token by hand.

Platform credentials start with plat. They are server-to-server credentials for a partner service that provisions organizations and projects on behalf of customers, they carry an explicit list of named scopes, and they are issued by a Smallware operator rather than self-serve. Write to [email protected] if you need one.

A platform credential is refused for anything outside the scopes it carries, so ask for the narrowest set that does the job. The same list is published as scopes_supported in the RFC 9728 protected-resource metadata, which is where a client should read it rather than from this page.

org.create

Create an organization on behalf of a customer identified by email address. The customer owns it from creation; the credential holder does not become a member and does not gain access to the organization's data.

project.create

Create a project inside an existing organization and provision its machine, database, and system hostname. Does not grant access to the project's data or secrets.

deploy

Upload a build artifact for an existing project and deploy it. Does not grant project creation, secret reads, or organization changes.

model.resolve

Resolve which model provider serves a given (organization, model) pair and read that organization's stored provider key. Held only by the model proxy; kept separate so a deploy credential cannot read customer provider keys.

Every operation is a POST to /api/fn/<functionName> with the arguments as a flat JSON object — not wrapped in an args key. A successful call answers 200 with the return value as the entire body; a failure answers with {"error":{"code","message"}}, and code is the stable part to branch on. The OpenAPI document types every one of them.

Every page here is also a markdown document. Append .md to any path, or send Accept: text/markdown, and you get the page as text instead of HTML — no rendering, no scraping heuristics. Start from /llms.txt, which says what Smallware is for and links the rest.

• /openapi.jsonOpenAPI 3.1 description of every endpoint a bearer token can call.
• /.well-known/oauth-protected-resourceRFC 9728 protected-resource metadata: supported scopes and bearer methods.
• /llms.txtWhat Smallware is for, when to reach for it, and where everything lives.
• /api/manifestWhat this application exposes: entities, routes, policies, auth configuration.
• @pylonsync/cli on npmThe CLI. Deploys, logs, secrets, domains, database backups; `--json` on every read command.
• Pylon documentationSchema, policies, server functions, auth, jobs, search, SSR. Add `.md` to any page URL.
• Pylon authoring guideThe whole framework as one markdown file, written for a coding agent to load.
• Source on GitHubThe runtime, the SDKs, and the starter templates. MIT licensed.