A management client for a Worker you own, and nothing more.
That sentence is the whole product definition, and every constraint on this page follows from it.
It is a client. Your Worker is the authority
What it never stores is the specific claim, the control-plane seam is the mechanism, and plans and pricing is what it costs.
Every read and every write goes through a credential you minted, you scoped, and you can revoke. There is no backdoor and no path that does not begin with your consent.
A Worker that has never been connected answers every administrative route with controlplane/not_connected. Connecting is a deliberate act you perform with pithy dashboard connect; revoking is a row you delete, immediate and needing nothing from us.
The seam it calls is the control-plane capability — MIT, in the open-source kit, and usable by a management client you wrote yourself just as readily as by this one.
It never stores your data
Your users, purchases, entitlements, audit events and support mail live in your D1. They are fetched live, rendered, and discarded.
What is stored here is our own: our users and organizations, our subscriptions, and connection metadata — the project, the environment, the endpoint, a reference to the credential. Nothing else.
Caching your data for performance is the tempting exception, and it is the one that would quietly end the argument. The moment a copy of your user table lives here, this has become the thing Pithy’s architecture exists to avoid.
What it never stores is the specific list, in both directions.
No capability is ever gated by tier
Every @pithy-sh/* capability stays fully usable from the CLI and the API regardless of what anyone pays.
No control-plane route checks a subscription. The dashboard gates its own UI and nothing else. Crippling MIT code would be both wrong and futile — anybody can read it, fork it, and remove the check.
So what is sold here is the UI, the workflows and their upkeep, rather than access to data you already own. Every operation the dashboard performs has a CLI command, and pithy testers is the clearest example: every route the control plane exposes has a command, each non-interactive and each with --json.
It is built on the kit it administers
Not as a gesture. It is the strongest proof the product has, and it makes us the first consumer of our own seams.
It was scaffolded with pithy init, it runs on pithy dev, it deploys with pithy deploy, and it composes auth, payments, audit, email, i18n, support, turnstile and the control-plane seam like any other adopter. Its own tables carry no pithy_ prefix, because here we are the adopter.
Every friction we hit is filed as a bug in the kit rather than worked around. Feeling it is half the reason it is built this way.
How we built the Dashboard is the step-by-step record — the commands in order, the config shapes, and what did not work first time.
What you can do with it
The panes read what your Worker’s composed capabilities expose: your users and their devices, purchases and subscriptions, entitlements and reconciliation, the support inbox, email jobs, the audit trail, the secret registry, what has migrated per environment, and which capability versions each Worker composes.
Every pane is exactly as capable as the scopes you granted. A connection you narrowed to reads is a dashboard that reads. A scope you left out is a pane that says so rather than a button that fails.
What it deliberately does not do
It does not provision. Creating a D1 database or deploying a Worker uses your Cloudflare token from your machine or CI. That is Cloudflare’s control plane — outbound, and nothing to do with this seam.
It does not sign in as your users. No route mints a session, and no read projects a session token.
It does not write your code. It is an operational surface, not an IDE.
It is not required. The kit is complete without it. The CLI does everything, and a management client you write yourself has the same access this one does.
Getting started
Three steps, and the second is the only one that involves us:
- Create your account — passwordless, the same as the kit’s own auth
- Compose the seam:
pithy add controlplane - Connect an environment —
pithy dashboard connect --env prod
Nothing is open until that third step, and nothing stays open longer than you want it to.