Access & setup

How you get into Erasure and where configuration lives.

This page documents console and SDK access as the product works today, not every self-host deployment switch.

Get access (invite-only beta)

Hosted Erasure is not open for public signup. Access is by manual invite.

1. Request an invite from the marketing site (Request invite).
2. When approved, use the app link from your invite email to sign in.
3. Use a work email you control.

Self-hosting is documented separately if you run your own deploy. See Self-hosting.

Create an organization

An organization is the boundary for:

• Membership and roles
• Billing / entitlements
• Rights operations and Systems (connectors)

Create one organization for your company (or evaluation sandbox). You can add teammates later as Owner, Admin, or Viewer.

Create a project

A project is the consent surface:

• Consent draft and published versions
• Publishable keys
• Receipts
• Project-level settings (for example consent webhooks, when configured)

Typical first project name: Marketing Site or your primary product name.

You can create additional projects later for other apps (mobile, admin portal, etc.).

First workspace: where to click

After org + project exist, treat this as your home base:

Console navigation is hash-based in the app (for example #/…/consent, #/rights). Exact paths may vary by release; use the product sidebar as the source of UI labels.

Keys: publishable key vs operator session

Allowed origins

Under Develop → Allowed origins, list hosts that may call the SDK (e.g. localhost, app.example.com). New projects enable the allowlist by default. Empty patterns fail closed until you add hosts. When on, mismatched origins get origin_not_allowed.

Publishable key (SDK)

1. Open your project → Develop.
2. Create publishable key.
3. Copy pk_live_… once when shown.
4. Store it in your app environment (for example NEXT_PUBLIC_… only if you accept it as a public client key).

Use the key with the browser SDK. apiBaseUrl is the origin only (never /api/...):

npm install @erasurehq/accord

import { Accord } from "@erasurehq/accord";

const client = await Accord.init({
  publicKey: "pk_live_…",
  apiBaseUrl: "https://app.erasurehq.in", // Erasure origin; optional if same-origin
});

Full secret shown once on create; thereafter prefix only. Soft revoke via revokedAt. Prefer Bearer on HTTP, not ?key= (compatibility only; can appear in logs).

Auth API (operator)

See Authentication API and SDKs.

Operator API access

TODO: Public docs for authenticated operator REST usage (paths, auth header shapes). Derive from app_docs API maps when writing the API section. Do not invent endpoint lists here.

There is no generic "create REST API key" flow described for end customers beyond publishable keys for the consent SDK unless product surfaces document it.

Plans and limits

Organizations have entitlements (projects, systems/connectors, rights cases per period) driven by plan, not hard-coded plan names inside feature code.

Start on Free or a trial path as offered in-product. Upgrade from Billing when limits block you.

Self-hosting note

Self-hosting (your own DATABASE_URL, app process, worker process, optional demo reseed) is supported for development and private deploys.

See the full public guide: Self-hosting. For most evaluators, the hosted invite-only beta remains the default path.

Checklist