Cloudflare-native coordination

Belt keeps devices in sync without reading the work.

Sign up with GitHub, get admin access when needed, then let signed devices pair, create jobs, claim leases, exchange encrypted envelopes, and ACK delivery.

Sign in with GitHubRuntime proof

Anyone can sign up or sign in with GitHub. Device APIs continue to use request signatures.

Phone, tablet, and worker laptop exchanging encrypted envelopes through Belt

Use it in seven steps

The server owns coordination. Your apps own plaintext.

  1. Sign up or sign in.GitHub OAuth creates a Belt web identity. Bootstrap logins become owners; everyone else starts as a user.
  2. Grant admin access.An owner can promote another GitHub login to admin without sharing secrets or device keys.
  3. Bootstrap an account.Use a tenant-admin signed request to create the tenant/account and the first trusted device.
  4. Pair more devices.A trusted device creates a 10-minute ticket; the new client, worker, or hybrid device registers public keys.
  5. Create opaque jobs.Clients create jobs with capabilities and delivery policy, never plaintext prompts or files.
  6. Claim and return results.Workers claim a lease, run locally, and append encrypted result envelopes for resolved recipients.
  7. Sync, decrypt, ACK.Recipients sync over HTTP or WebSocket, decrypt locally, persist, then ACK to advance cursors.

What Belt stores

Tenants, accounts, devices, pairing tickets, jobs, leases, encrypted envelope metadata, recipient keys, cursors, audit records, and retention state.

What Belt rejects

Plaintext product payloads, prompts, book content, notes, local files, model output, and product-specific semantics.