API
Everything the app does is available over HTTP. Cookie sessions need the X-Pa-Csrf header; API keys do not.
Authentication
Create a key in Settings → API keys. Send it as a bearer token:
Authorization: Bearer pa_live_xxxxxx_xxxxxxxxxxxxxxxxxxxxxxxx
Chat (streaming SSE)
Returns text/event-stream. The final frame carries pa_usage with exact token counts.
POST /api/chat
{ "message": "Summarise this week", "conversationId": "cnv_...", "model": "deepseek-chat" }
Endpoints
| Method | Path | Purpose |
|---|---|---|
| POST | /api/auth/signup | Create workspace |
| POST | /api/auth/login | Session cookie |
| GET | /api/bootstrap | Session, plan, usage, tools |
| POST | /api/chat | Streaming completion |
| GET | /api/usage/summary | Meter totals |
| GET | /api/metrics | 30-day rollups |
| GET/POST | /api/agents | List or create agents |
| POST | /api/agents/:id/run | Run now |
| GET | /api/runs | Run history |
| POST | /api/billing/checkout | Stripe Checkout |
| POST | /api/billing/webhook | Stripe events |
Cost model
DeepSeek V4.1 Flash off-peak: $0.15 per 1M input, $0.003 per 1M cached input, $0.60 per 1M output. Peak windows are 01:00–04:00 and 06:00–10:00 UTC on weekdays and bill at exactly double. Costs are stored in micro-USD integers so the meter cannot drift.