Quick start

Lantern in five minutes

Three commands against the demo library, three against a server of your own, and the whole path in one figure.

Read the demo library

The demo is a static library served with this site: nothing to install, nothing to sign in to.

  1. Read its handshake

    Every library says what it is, which features it offers and its limits in one document.

    curl -s https://lantern.boreale.dev/demo/lantern.json
  2. List its apps

    A page of apps for one platform: each carries its size, its sha256 and the path of its file.

    curl -s https://lantern.boreale.dev/demo/v1/apps/vita/pages/1.json
  3. Download and check

    The file's SHA-256 is the one the app announced. A client refuses what does not match.

    curl -s https://lantern.boreale.dev/demo/v1/blobs/sha256/fa75492f7b78cad7ca4044e8fb548ac67bfd7fbf05242ceecb29ebe492218a0d | sha256sum

More to try, including libraries made to break a client: Demo library

Talk to a server of your own

A server with accounts asks a device to pair first. These calls use a made-up address.

  1. Find it

    On a local network a client discovers it with a UDP datagram; with an address, it reads the handshake at a well-known path.

    curl -s https://shelf.example.org/.well-known/lantern
  2. Pair

    The server answers with a code to enter, on another device, where its owner signs in and approves.

    curl -s -X POST https://shelf.example.org/api/lantern/v1/pairing \
      -H 'Content-Type: application/json' \
      -d '{"schema":1,"device":"My console","scopes":["library"]}'
  3. Call it

    With the token it gave, as a bearer; a device that paired with a key also signs each request.

    curl -s https://shelf.example.org/api/lantern/v1/apps?page_size=5 \
      -H 'Authorization: Bearer et_…'

The whole path

Step through it: each press lights one step and dims the rest.

DeviceServerUser's phoneUDP 47115 {"lantern":"discover"}{"lantern":"server", uid, port, base}A hint only: trust comes from TLS and pairingGET /.well-known/lanternhandshake: uid, versions,platforms, features, limitsPairing (§ 5.2)POST /v1/pairing{device, scopes, key}code KQ4M-7TXD, verify_complete,poll, intervalShows the code, a QR codeand the key's short fingerprintOpens the link, signs in,compares the fingerprint, approvesGET <poll> (every interval)202 … then 200 {token: et_…}or 410 gone · 429 slow_downPins the server's keyfor this uid (§ 5.3)Then, on every callAuthorization: Bearer et_…+ request signature200 · 401 · 403
From finding a server to the first signed call
  1. Device → Server: UDP 47115 {"lantern":"discover"}
  2. Server → Device: {"lantern":"server", uid, port, base}
  3. A hint only: trust comes from TLS and pairing
  4. Device → Server: GET /.well-known/lantern
  5. Server → Device: handshake: uid, versions, platforms, features, limits
  6. Pairing (§ 5.2)
  7. Device → Server: POST /v1/pairing {device, scopes, key}
  8. Server → Device: code KQ4M-7TXD, verify_complete, poll, interval
  9. Shows the code, a QR code and the key's short fingerprint
  10. User's phone → Server: Opens the link, signs in, compares the fingerprint, approves
  11. Device → Server: GET <poll> (every interval)
  12. Server → Device: 202 … then 200 {token: et_…} or 410 gone · 429 slow_down
  13. Pins the server's key for this uid (§ 5.3)
  14. Then, on every call
  15. Device → Server: Authorization: Bearer et_… + request signature
  16. Server → Device: 200 · 401 · 403

Specification