Accounts and Permissions
Open Platform accounts are separate from general CZUR user accounts. Console sessions are used to manage Open Platform apps and API keys; general CZUR user sessions cannot manage Open Platform resources.
Registration Region and Login Session
| Scenario | Notes |
|---|---|
| Mainland China | register with mobile number and SMS verification. The account number is +86 plus the mobile number. |
| Other regions | Register with email verification. The account number is the lowercase email address. |
| Interface language | The console displays localized text based on the selected site language. |
App Boundary
An app is the container for API keys. Each app has its own appId and appKey, and every API key belongs to an app. When listing, rotating, or revoking keys, the service verifies that both the app and the key belong to the current Open Platform account.
API Key Boundary
| Field | Meaning |
|---|---|
licenseMode | online_api_key uses online authorization mode. offline_api_key is for offline deployments or local offline capabilities. |
hostAuthMode | Host authorization mode. Online keys usually use none; offline keys usually require machine activation. |
tier | vip, svip, or svip_plus; affects SDK entitlement level. |
deviceScope | VID/PID device allowlist. Device listing and opening are filtered by this scope. |
expiresAt | Expiration timestamp. 0 means no explicit expiration. |
status | ACTIVE is usable; REVOKED is revoked. |
Online and Offline Capabilities
- Online authorization is handled by the local SDK runtime and authorization service; applications do not call the authorization service directly.
- Offline authorization is validated by the local SDK runtime from the API key and offline activation code; it does not depend on console login.
- Offline device activation codes are generated from machine codes. The default 2-machine and 30-day validity policy is for trial/test device activation. For more devices, market or commercial rollout, or adjusted activation quota and validity, contact CZUR business staff.
Security Recommendations
- The full API key is displayed only once. Store it in backend configuration, secure storage, or protected local settings.
- Do not commit API keys to frontend repositories, logs, screenshots, or public issues.
- Rotating a key generates a new
sk-*value and revokes the previous key. Update local client configuration at the same time. - After revoking a key, active Command WS sessions should call
auth.destroy_sessionand create a new session with a valid key.