InstantMLDocs

Auth, billing, and storage

Understand browser sessions, API keys, billing states, hosted storage, and customer-owned storage.

Open .md

Learn how the operational pieces fit together: who can sign in, what API keys can do, how billing state affects writes, and where your bytes live.

Sign in with a browser session

Humans use browser sessions for the dashboard through the hosted InstantML identity flow. Browser sessions are scoped to a workspace and role.

Authenticate automation with API keys

SDKs, uploaders, importers, exports, and automation use bearer API keys.

bash
export INSTANTML_API_KEY="instantml_..."

API keys can be unrestricted for a workspace or restricted to a project, depending on how they were created. Create and manage keys in Settings and API keys.

Understand billing states

Paid signup and billing changes go through hosted checkout or portal flows.

When a workspace is pending payment or payment-failed, product write routes can return a payment-required error. Reads keep working; only writes are blocked.

Free workspaces are blocked at included monthly API request and hosted storage allowances. Paid Pro and Premium subscriptions attach Stripe-metered overage items for hosted storage and API requests. See Pricing, limits, and billing for the current plan allowances and rates.

Know where hosted data lives

Uploaded artifact bytes are stored by the API in the workspace's configured artifact backend. The public artifact row returns opaque InstantML metadata rather than a raw storage URL.

Downloads go through:

text
GET /api/artifacts/:artifact_id/download

InstantML-hosted workspace data currently uses InstantML-owned ClickHouse on Google Cloud for User Data and tenant databases. Hosted artifact bytes use private Cloudflare R2 buckets and stay separate from metric ingestion.

Use customer-owned storage

Teams that need stronger data-control boundaries can use the Premium customer-owned storage setup, where product data routes to their self-hosted GCP ClickHouse deployment. Hosted artifact bytes and customer-owned ClickHouse bytes are accounted for differently in usage surfaces; InstantML storage guardrails count only artifact bytes stored by InstantML. See Customer-owned GCP ClickHouse for setup.

Keep secrets out of version control

Do not commit:

  • API keys.
  • Session cookies.
  • Auth provider secrets.
  • ClickHouse credentials.
  • Object-storage credentials.

Next steps