Goal of this module
Leave with a working mental model of the platform, your org code and test domain in hand, and a token you can use to call API Studio.
The mental model
nostackai is metadata-driven: you don't write and deploy backend code — you author definitions (entities, logic blocks, events, settings) and a shared runtime executes them. That means there are two tiers, and keeping them straight makes everything else click.
- Define tier — API Studio. Where you, the developer, build. You author entities and logic as configuration. Guarded by your org role (
org_admin/developer). - Run tier — the app gateway. Where your app's users hit live endpoints at
/app/{orgCode}/.... Guarded by tenant ACL.
Define and run never mix
Different gateways, different authorizers, different tables. Org-role checks guard what you can *build*; tenant ACL guards what your app's users can *access*. You'll feel this split in every module.
Org, workspace, environment
- Org — your account. Owns your definitions, settings, members, and billing plan. Every path is scoped to your org code.
- Workspace (tenant) — an isolated data space for your app's end-users. TaskFlow will use *multi* tenancy so each team gets its own.
- Environment — every org gets a test environment at signup and a production one on demand. You build in test and *publish* config to prod; app data never moves.
Tour the console
Get a token
API Studio calls are authenticated with a platform token. The console obtains one for you on sign-in; to call the define-tier endpoints yourself, grab one from the token endpoint by exchanging your provider identity token.
GET /token
oauthtoken: <provider id token | password-login token>
-> 200, header x-nostackai-token: <platform JWT> (~12h)Send that JWT on every API Studio request. The claims carry your org_code, domain, env_type, and your roles — which is what the define-tier authorizer checks.
Try it
Obtain a platform token and confirm it works by listing your entities: GET /api/entities with Authorization: <platform JWT>. An empty list is expected — you haven't built anything yet. That's Module 2.