Concepts in plain words
Plain-words definitions of the handful of terms the Lockwell docs use, from tenants and scoped keys to surfaces, bearer tokens, and signed URLs.
The docs lean on a small set of terms. Here is what each one means, in plain words, with a link to the page that goes deeper. Skim this once and the rest of the docs read faster.
Tenant
One customer, workspace, or project in your app. Every bucket and key belongs to exactly one tenant, and a tenant can never see another tenant's data. When the docs say "org", they mean the tenant.
Deeper: Tenancy & auth.
Access key
The long-lived credential a server holds: an id plus a secret. The secret is shown once at creation and never again, so your app stores it in its own database.
Scoped key
An access key restricted to what it may do: which operations (read, write, delete), and optionally one bucket or
key prefix. A leaked read-only key cannot write; a key scoped to one bucket cannot touch another. Scoping is how you
give each part of your system the least access it needs.
Deeper: scoped access keys.
Surface
One of the three ways to talk to the same server: the S3 API (for existing S3 tools), the native API (JSON, made for app code), and the admin API (management). They are different doors into one building; the security checks inside are identical.
Deeper: The three surfaces.
Bearer token
A short-lived pass the native client mints from your access key and sends on each request. You never handle it: the SDK mints, caches, and refreshes it for you. If the underlying key is revoked, the token stops working too.
Admin token
A separate credential (lwadm_...) for the management API: creating tenants, minting keys, setting quotas, reading
audit logs. It lives on your server, never in a browser, and carries a role (owner, operator, or viewer).
Deeper: Admin API.
Signed URL
A link that grants one action on one object for a few minutes, with the authorization baked into the URL itself. Your server mints it; the browser uses it with no credential. This is how browsers upload and download directly without your app proxying the bytes.
Deeper: Signed URLs.
The app kit
LockwellKit, a helper that composes the admin and native clients into the five jobs every multi-tenant app needs:
provision a tenant, get a per-tenant client, configure browser CORS, sign browser URLs, and verify webhooks. It is
convenience only; it adds no new server behavior.
Deeper: The app kit.
Bucket, object, version
Same meaning as S3. A bucket is a named container inside a tenant. An object is a file plus its metadata,
addressed by a key like invoices/2026/03.pdf. With versioning on, every write keeps the previous version instead
of overwriting it.
Deeper: Upload & download and Versioning.
Idempotency key
A label you attach to a write so that retrying the same request applies it once instead of twice. Pair it with a checksum on the native API.
Deeper: Conditional writes & idempotency.
Webhook
An HTTP POST Lockwell sends to your endpoint when an object is created or removed, signed so you can verify it really came from your server.
Deeper: Webhooks.
Client configuration
Configure Lockwell SDK endpoints, regions, TLS trust, timeouts, retries, cancellation, concurrency, progress, and response correlation in Go, Node, and Java.
Conditional writes & idempotency
Gate Lockwell writes on an object's current state with If-None-Match and If-Match, and make retried writes replay-safe with idempotency keys.