Read the demo library
The demo is a static library served with this site: nothing to install, nothing to sign in to.
-
Read its handshake
Every library says what it is, which features it offers and its limits in one document.
curl -s https://lantern.boreale.dev/demo/lantern.json -
List its apps
A page of apps for one platform: each carries its size, its sha256 and the path of its file.
curl -s https://lantern.boreale.dev/demo/v1/apps/vita/pages/1.json -
Download and check
The file's SHA-256 is the one the app announced. A client refuses what does not match.
curl -s https://lantern.boreale.dev/demo/v1/blobs/sha256/fa75492f7b78cad7ca4044e8fb548ac67bfd7fbf05242ceecb29ebe492218a0d | sha256sum
More to try, including libraries made to break a client: Demo library
Talk to a server of your own
A server with accounts asks a device to pair first. These calls use a made-up address.
-
Find it
On a local network a client discovers it with a UDP datagram; with an address, it reads the handshake at a well-known path.
curl -s https://shelf.example.org/.well-known/lantern -
Pair
The server answers with a code to enter, on another device, where its owner signs in and approves.
curl -s -X POST https://shelf.example.org/api/lantern/v1/pairing \ -H 'Content-Type: application/json' \ -d '{"schema":1,"device":"My console","scopes":["library"]}' -
Call it
With the token it gave, as a bearer; a device that paired with a key also signs each request.
curl -s https://shelf.example.org/api/lantern/v1/apps?page_size=5 \ -H 'Authorization: Bearer et_…'
The whole path
Step through it: each press lights one step and dims the rest.
- Device → Server: UDP 47115 {"lantern":"discover"}
- Server → Device: {"lantern":"server", uid, port, base}
- A hint only: trust comes from TLS and pairing
- Device → Server: GET /.well-known/lantern
- Server → Device: handshake: uid, versions, platforms, features, limits
- Pairing (§ 5.2)
- Device → Server: POST /v1/pairing {device, scopes, key}
- Server → Device: code KQ4M-7TXD, verify_complete, poll, interval
- Shows the code, a QR code and the key's short fingerprint
- User's phone → Server: Opens the link, signs in, compares the fingerprint, approves
- Device → Server: GET <poll> (every interval)
- Server → Device: 202 … then 200 {token: et_…} or 410 gone · 429 slow_down
- Pins the server's key for this uid (§ 5.3)
- Then, on every call
- Device → Server: Authorization: Bearer et_… + request signature
- Server → Device: 200 · 401 · 403