Hub Control Plane

control plane

Humans use a session JWT or user token (with a grant). Daemons use a realm token (cliq_dt_…).
Interactive OpenAPI on this site: Hub API (public /v1). Tenancy provisioning stays on private Hub /internal routes (BFF only — not published here).

Auth

Credential	Who
`Bearer <session jwt \| cliq_tok_…>`	Console, `cliq login`, CI — limited by grant
`Bearer cliq_dt_…`	Daemon register, heartbeat, poll
BFF service grant	Private `/internal` only (signup, delete user/org, …)

User JWTs / user tokens are rejected for daemon enroll / poll. Grants: Auth.

Realms & tokens

Realm CRUD, members, invites, team list, agents, and A2A are under /v1/realms/* — see Realms and the Hub API tab groups (Realm teams, Realm agents, Realm A2A, Public A2A).

# Mint realm token (realm admin)
curl -s https://api.cliqhub.io/v1/auth/generate_token \
  -H "Authorization: Bearer $USER_JWT" \
  -H "Content-Type: application/json" \
  -d '{"type":"realm","realm_id":"…","name":"laptop"}'

Or: cliq realm token <realm_id> laptop. Plaintext token returned once. Revoke via /auth/revoke_token with type: "realm". Public invoke (host root, not /v1): GET /a2a/r/{slug}/.well-known/agent-card.json, POST /a2a/r/{slug}/send.

Daemon enroll

export CLIQ_DAEMON_ID=edge-1
export CLIQ_DAEMON_TOKEN=cliq_dt_…
# daemon registers + heartbeats with the realm token

POST /daemons/get (user credential) returns daemons in your realm intersection — same data as CliqHub Daemons.

Dispatch

Exactly one of daemon_ids or realm_id for install. Realm run (Hub UI):

curl -s https://api.cliqhub.io/v1/dispatch/enqueue \
  -H "Authorization: Bearer $USER_JWT" \
  -H "Content-Type: application/json" \
  -d '{"realm_id":"…","kind":"run","payload":{"team_id":"@cliq/hello-world","inputs":{}}}'

Pin to one daemon: POST /dispatch/run with daemon_id + workspace_id + team_id.
Enqueue is a write on dispatch / runs. Daemon claims via offer, then Hub calls local /v1/execute. See Concepts.

Internal vs public

Need	Where
Login, publish, realms, dispatch	Hub API tab
Create/delete users & orgs, signup	BFF → Hub `/internal` (not on public docs)

​Auth

​Realms & tokens

​Daemon enroll

​Dispatch

​Internal vs public

Auth

Realms & tokens

Daemon enroll

Dispatch

Internal vs public