ASDev / developer portal
Build on the Syndicate.
A music catalogue you can query right now, an identity your users already have, a package registry and an inference endpoint. Developer access is free and starts the minute you ask for it.
badge issued on submit · no invite code · no card
open endpoints need no key at all
Start without asking.
Most of the platform answers anonymously. Nothing below needs an account, a key or a conversation with us — copy a line, run it, see what comes back.
| Method | Endpoint | Host | Auth | Returns |
|---|---|---|---|---|
| GET | /api/v1/catalog/tracks | resonance-api.aperturesyndicate.com | none | Tracks with artists, genres, bpm and play counts |
| GET | /api/v1/catalog/artists/:slug | resonance-api.aperturesyndicate.com | none | Artist page with its releases |
| GET | /api/v1/catalog/albums | resonance-api.aperturesyndicate.com | none | Albums, sorted and paginated |
| GET | /api/packages | synx.aperturesyndicate.com | none | SYNX registry — search, versions, download |
| GET | /.well-known/jwks.json | auth.aperturesyndicate.com | none | RS256 public keys — verify our tokens yourself |
| GET | /api/status | status.aperturesyndicate.com | none | Live platform status and incident history |
| GET | /api/v1/sso/authorize | auth.aperturesyndicate.com | client_id | OAuth 2.1 authorization code, PKCE required |
| POST | /api/v1/chat/completions | asai.aperturesyndicate.com | asai_ key | OpenAI-compatible chat, streaming and tools — paid plan |
Current limits are per IP: 300 req/min on the catalogue, 60 req/min per ASAI key. Third-party browser origins are blocked by CORS — call these from your server, not from a page. The terms are stricter than the code: catalogue data is for personal, non-commercial use with attribution back to Resonance. Read the Developer & API terms before you ship.
Access is one form, not a queue.
The badge is what unlocks developer-only surfaces. Getting it takes about five minutes and no one has to approve you first.
Sign in
Your ordinary Syndicate account. The portal reads the same session as every other service — nothing separate to create.
Apply
Three steps: who you are, what you are building, and which surfaces you need. The description is the part we read.
Badge
The Developer badge lands on your account the moment you submit. Nothing sits in a queue — we read applications afterwards and can revoke.
Build
The badge opens the studio: register applications, rotate secrets, see the surface you may call. Publishing lands there as it ships.
The form asks who you are, what you are building and which surfaces you need. The description is the part a person actually reads — write it the way you would tell a friend, not the way you would fill in a compliance sheet.
Open the applicationWhat you can build here.
Ordered by how ready each surface is. Where something is not finished, it says so.
- 01
Sign-in with Syndicate
Put a Syndicate login in your own app. Register the client in the studio, point it at your callback: authorization code with PKCE, four scopes, tokens you verify locally.
Live - 02
Anything on the catalogue
Charts, players, discovery bots, embeds, stats pages. The Resonance catalogue answers without a key.
Live - 03
Tools on ASAI
An OpenAI-compatible endpoint with three models. The key is created in ASAI settings; calling the API needs a paid ASAI plan.
Paid plan - 04
SYNX packages
Our config format has a public registry with search, versions and downloads. Publishing runs through the CLI.
Live - 05
Desktop apps
ASInstaller installs a .asins package straight from disk. Publishing third-party apps into the store is not open yet — write to us.
Planned
One identity, verified on your side.
People already have a Syndicate account for music, AI and the rest of the platform. Let them use it in your app: authorization code with PKCE, tokens signed RS256, public keys you can cache.
- Grantsauthorization_code, refresh_token. PKCE with S256 is mandatory — plain is refused.
- Scopesopenid · profile · email · subscription. The last one exposes plan and status, so you can gate features on it.
- TokensAccess 15 minutes, refresh 30 days and rotated on every use.
- VerifyFetch JWKS once, verify locally. No round trip to us on every request.
- CaveatOAuth 2.1, not full OIDC: no discovery document, no id_token. Configure the endpoints by hand.
Keys, and what they open today.
Straight answer, because it saves you an afternoon: the key that works right now is the ASAI one. It is created in ASAI settings, sent as a bearer token, and accepted by an OpenAI-compatible endpoint. A single platform-wide key is the next thing being wired.
- Formatasai_ + 43 characters, shown once, stored as a hash.
- PlanCalls need a paid ASAI plan. The free tier can create a key but the endpoint will refuse it.
- RevokeInstant, from the same settings screen. Revocation is checked on every call.
curl https://asai.aperturesyndicate.com/api/v1/chat/completions \ -H "Authorization: Bearer asai_…" \ -H "Content-Type: application/json" \ -d '{"model": "asai-code", "messages": [{"role": "user", "content": "explain this stack trace"}], "stream": true}' # models: asai-code · asai-mini · asai-arc
SYNX — the format we configure everything with.
Every service on the platform is configured in SYNX rather than YAML or JSON: typed values, validation, environment binding and secrets that never reach a log. The parser is a published npm package and the registry is open to read.
- RegistrySearch, versions and downloads are public; publishing runs through the SYNX CLI.
- SecretsA value marked :secret is redacted from every dump and log line by the parser itself.
- Playgroundsynx.aperturesyndicate.com runs the format live in the browser — paste a config, watch it parse.
# !active turns a data file into a config !active port[type:int]:env:default:7008 PORT db_url[required]:env DATABASE_URL secret[required]:secret:env JWT_PUBLIC_KEY workers[type:int, min:1, max:32] 4 # npm i @aperturesyndicate/synx-format
Desktop distribution, stated plainly.
ASInstaller is our Windows launcher: it installs and updates our own titles and gathers the games and apps you already own into one library. A package is a plain ZIP with a SYNX manifest, and it can install one straight from disk.
- Format.asins — manifest.synx at the root, payload under files/. Documented in the installer, not yet in the docs site.
- TodayHand someone a .asins file and it installs, with shortcuts and an uninstall entry.
- Not yetNo upload endpoint, no store submission, no third-party listings. When that lands it will be announced here first.
What you are building against.
Not a marketing stack list — the actual runtime your calls land on, so you can judge the latency and the failure modes for yourself.
- Runtime
- Bun 1.x
- HTTP
- Hono
- Data
- Postgres 17
- Events
- NATS JetStream
- Config
- SYNX
- Region
- EU · Helsinki
Every service runs on Bun, not Node — cold starts measured in milliseconds.
Thin, typed handlers. gRPC between services, REST at the edge.
One schema per service, Drizzle ORM, soft delete everywhere.
Durable, versioned subjects: v1.{domain}.{verb}.
Our own format instead of YAML — typed, validated, secret-aware.
Servers and object storage in Finland, billed by an Estonian OÜ.
Your applications live here.
The studio is where your applications live: register a client, rotate its secret, disable it, and read the surface you may call. Usage metering is the next piece — it does not exist yet, so the studio does not pretend to show it.
Open the studio
There is a person
on the other end.
APERTURESyndicate is a collective, not a support desk. The people who write these services are the same ones who read your application and register your OAuth client by hand — a handful of us, in the evenings, in a courtyard like this one. That is why the page tells you what is missing instead of pretending it is finished.
Questions we would ask.
It marks your account as a developer across the platform and is the gate that developer-only surfaces check — today that means registering an OAuth client so people can sign in to your app with their Syndicate account.
It is not a paywall and not a rate-limit tier. The open endpoints on this page work without it.
The badge is granted the moment you submit the form. We read applications afterwards, and the studio can revoke access if something looks wrong. So: no waiting, but not a free-for-all either.
Developer access is free, and so are the open endpoints. There is no developer tier to buy and no metered API billing — neither exists.
The one paid surface is ASAI inference: calling it needs a paid ASAI plan, because that is compute we pay for by the hour.
No. Catalogue and registry reads are anonymous, capped at 300 requests per minute per IP. Browser calls from a third-party origin are blocked by CORS, so call it from your server.
In the studio: Applications → New application. You give it a name, one or more redirect URIs and the scopes you need; the client_id appears immediately and the secret is shown once. You can rotate that secret or disable the client at any time.
Worth knowing up front: this is OAuth 2.1, not full OIDC. There is no discovery document and no id_token, so point your client at the three endpoints by hand.
Not yet. ASInstaller today installs our own titles and any .asins package you hand it directly — the format is a plain ZIP with a SYNX manifest. There is no upload endpoint, no store submission and no review flow, and we would rather say so than take your build and sit on it.
The rules are written and published: Developer & API terms on docs.aperturesyndicate.com cover keys, limits, OAuth clients and when access gets revoked. The endpoint reference is not — that section is still empty, and this page is the most accurate map of the public surface we have.
Treat the table above as the contract until the reference catches up.