# Concepts in plain words

The docs lean on a small set of terms. Here is what each one means, in plain words, with a link to the page that goes
deeper. Skim this once and the rest of the docs read faster.

## Tenant

One customer, workspace, or project in your app. Every bucket and key belongs to exactly one tenant, and a tenant can
never see another tenant's data. When the docs say "org", they mean the tenant.

Deeper: [Tenancy & auth](/guide/tenancy-and-auth).

## Access key

The long-lived credential a server holds: an id plus a secret. The secret is shown once at creation and never again, so
your app stores it in its own database.

## Scoped key

An access key restricted to what it may do: which operations (`read`, `write`, `delete`), and optionally one bucket or
key prefix. A leaked read-only key cannot write; a key scoped to one bucket cannot touch another. Scoping is how you
give each part of your system the least access it needs.

Deeper: [scoped access keys](/guide/tenancy-and-auth#scoped-access-keys).

## Surface

One of the three ways to talk to the same server: the **S3 API** (for existing S3 tools), the **native API** (JSON, made
for app code), and the **admin API** (management). They are different doors into one building; the security checks
inside are identical.

Deeper: [The three surfaces](/guide/the-three-surfaces).

## Bearer token

A short-lived pass the native client mints from your access key and sends on each request. You never handle it: the SDK
mints, caches, and refreshes it for you. If the underlying key is revoked, the token stops working too.

## Admin token

A separate credential (`lwadm_...`) for the management API: creating tenants, minting keys, setting quotas, reading
audit logs. It lives on your server, never in a browser, and carries a role (`owner`, `operator`, or `viewer`).

Deeper: [Admin API](/reference/admin-api).

## Signed URL

A link that grants one action on one object for a few minutes, with the authorization baked into the URL itself. Your
server mints it; the browser uses it with no credential. This is how browsers upload and download directly without your
app proxying the bytes.

Deeper: [Signed URLs](/guide/signed-urls).

## The app kit

`LockwellKit`, a helper that composes the admin and native clients into the five jobs every multi-tenant app needs:
provision a tenant, get a per-tenant client, configure browser CORS, sign browser URLs, and verify webhooks. It is
convenience only; it adds no new server behavior.

Deeper: [The app kit](/guide/app-kit).

## Bucket, object, version

Same meaning as S3. A **bucket** is a named container inside a tenant. An **object** is a file plus its metadata,
addressed by a key like `invoices/2026/03.pdf`. With versioning on, every write keeps the previous **version** instead
of overwriting it.

Deeper: [Upload & download](/guide/data-operations) and [Versioning](/guide/versioning).

## Idempotency key

A label you attach to a write so that retrying the same request applies it once instead of twice. Pair it with a
checksum on the native API.

Deeper: [Conditional writes & idempotency](/guide/conditional-writes).

## Webhook

An HTTP POST Lockwell sends to your endpoint when an object is created or removed, signed so you can verify it really
came from your server.

Deeper: [Webhooks](/guide/webhooks).