Aether
Overview
Multi-tenant OTA update platform for React Native apps.
Aether API 0.1.0
Section titled “Aether API 0.1.0”The Aether API powers over-the-air JavaScript bundle updates for React Native applications. It enables developers to push updates to deployed apps without going through the app store review process.
Authentication
Aether accepts two bearer credential families in the Authorization header:
- Access keys have wildcard scope and full account access. Login flows such
as POST /v1/auth/login create access keys with
isSession: true; dashboard and CLI sessions use these credentials, and only they satisfy session-only guards. Named access keys created through POST /v1/access-keys haveisSession: falseand cannot call session-only endpoints. - API keys use the
aether_sk_live_prefix and are created through POST /v1/api-keys. These long-lived credentials have scoped permissions for CI/CD pipelines and cannot call session-only endpoints.
See securitySchemes for details.
Versioning
All management and authentication endpoints are mounted under /v1. The canonical acquisition endpoints (consumed by the React Native SDK) live at /v1/public/aether/… Legacy acquisition paths (/v0.1/public/codepush/… and the camelCase /updateCheck and /reportStatus/… aliases) remain available for backward compatibility with the react-native-code-push SDK family and early Aether installs. Legacy paths return a Deprecation header and a Link header pointing to their canonical successor and to the CodePush migration guide.
Error envelope
All error responses share a canonical shape with an error string
field and an optional requestId string field. Validation failures
additionally include an errors array with field-level details. See
the Error and ValidationErrorResponse schemas under components.
JSON request bodies parsed by the JSON body parser are refused with
413 and error set to “The provided resource is too large.” when
they exceed 10 KB (10,240 bytes). That parser does not run on
POST /v1/billing/webhook, which uses a raw parser with a 100 KB
limit, or on the multipart release upload.
The requestId is also exposed as the X-Request-Id response header on every response and should be quoted when reporting issues.
Authentication
Section titled “Authentication”accessKeyAuth
Section titled “accessKeyAuth”Wildcard bearer credential backed by access_keys. Login flows create
credentials with isSession: true; POST /v1/access-keys creates named
credentials with isSession: false. Operations that require a login
session, including billing endpoints, reject the named subtype.
Security scheme type: http
Bearer format: AccessKey
apiKeyAuth
Section titled “apiKeyAuth”Long-lived API key with the prefix aether_sk_live_. Created via
POST /v1/api-keys. Carries a granular scope set declared at
creation time. Cannot be used for billing endpoints or for
session/access-key management, both of which require a login session.
Scope enforcement: every management route enforces the scope shown
on its operation. deploy and apps also grant read, so a key does
not need read listed explicitly to call the reads a deploy or app
workflow depends on. See ApiKeyScope for the full rule.
Security scheme type: http
Bearer format: ApiKey