Oberik

Oberik is the AI layer you put inside your product. Your customers ask questions about their own data and get grounded answers with citations; the agent can also do the work — run code, transform files, hand results back.

You call it from your backend and from your frontend. Oberik handles retrieval, tool calling, sandboxed compute, scheduling, isolation and cost attribution.

import { createClient } from "@oberik/sdk";

// Your backend mints short-lived tokens; the SDK asks for a new one when the
// current one expires, so expiry never surfaces at a call site.
const ai = createClient({ getToken });

const res = await ai.chat.send({
  message: "How did Q3 revenue trend, and why?",
  tags: ["finance"],
});

res.content;     // grounded answer
res.citations;   // document · page · quote

The model in one minute

Concept	What it is
Project	One isolated workspace. Its documents, embeddings, files, sandboxes, credentials and spend are separate from every other project's. Most integrations use one project per customer, or one per environment.
Token	A short-lived JWT your backend mints for one end-user, carrying exactly the capabilities you grant. Your frontend never holds anything privileged.
Capability	A permission (chat, documents:read, computer…). A token can only hold what the project allows, and the API refuses anything outside it — including a tool the model decides to call.
Scope	A hierarchical path (acme:finance:user_9f3c) bounding which data a token can see, so one customer's users don't read each other's documents.

Where things live

Two hosts, two credentials. Nothing else to configure.

	URL	Credential	What it's for
Control plane	https://oberik.com	X-API-Key: pk_…	administering a project: minting end-user tokens, setting the capability ceiling, curating the corpus. Server-side only.
Data plane	https://api.oberik.com	Authorization: Bearer <jwt>	the AI itself: chat, documents, tools, sandboxes. This is what the SDK talks to.
Dashboard	https://oberik.com/app	your login	the same control plane with a UI on it.
SSH	ssh ssh.oberik.com	your account, or an SSH key	the same control plane as text — for terminals and coding agents.

npm install @oberik/sdk

The SDK defaults to the hosted data plane, so baseUrl is only needed for a self-hosted deployment. Self-hosting? Every URL above becomes yours; nothing else in these docs changes.

What you can turn on

Each of these is a capability you grant a project and then, per end-user, a token — and can still decline on any single request.

• Conversation — chat with citations over your customer's data, blocking or streaming, with steering into a running turn.
• Knowledge — documents you curate or your users upload, and memory and a wiki the agent keeps between chats.
• Internet — web search, page reads, and a real browser the agent can click and type in.
• Agentic work — plans it keeps, subagents beside it, a Linux sandbox per conversation, scheduled runs and webhook triggers.
• Human in the loop — questions it asks, permission before irreversible actions, components it draws in your UI, follow-ups and recaps.
• Extensions — your own tools, tools you host that work when nobody is connected, MCP servers, and skills that teach it your procedures.
• In and out — images, audio, files in; documents, media and downloads back.
• Guardrails — injection defence, groundedness, moderation, optional PII handling.

How do I…

get one cited answer	Quickstart
do all of this from a terminal, or from a coding agent	Oberik over SSH
mint a token for a signed-in user	Authentication
set up a project from a script instead of the dashboard	Project API
upload a corpus my users can only read	Documents
let the model call my application's functions	Tools
…including in a scheduled run, with no client attached	Webhook tools
stream tokens into a UI	Chat
call the API from a browser	Browser origins
let the agent run code	Sandboxed compute
stop it before it does something irreversible	Asking permission
run something every Monday	Scheduling
know what went wrong	Limits & errors
find the exact endpoint	API reference · Recipes

Start here

1. Quickstart — a cited answer in about five minutes.
2. Authentication — how to mint tokens, and why it belongs on your server.
3. Calling from the browser — required before your frontend calls us directly.

Working from a terminal, or building with an agent?

Everything here is also a shell: ssh ssh.oberik.com signs up, creates projects, mints tokens and talks to the agent, with no browser and no client to install. A coding agent can sign in without ever handling your password, and read these docs in place with docs, docs page <name> and docs search <term>. See Oberik over SSH.

This site is also published as llms.txt (an index) and llms-full.txt (every page, one file), and the data plane serves its own OpenAPI schema at api.oberik.com/openapi.json.