Cloudflare-native coordination

Belt keeps devices in sync without reading the work.

Sign in with GitHub to own and audit a Belt account, create reusable enrollment keys, register signed devices, create jobs, claim leases, exchange encrypted envelopes, and ACK delivery.

GitHub OAuth not configuredAgent docsRuntime proof

Anyone can sign up or sign in with GitHub. Device APIs continue to use request signatures.

Phone, tablet, and worker laptop exchanging encrypted envelopes through Belt

Use it in seven steps

The server owns coordination. Your apps own plaintext.

  1. Sign up or sign in.GitHub OAuth verifies the human principal. Belt never trusts a user id supplied in a pairing body.
  2. Create your account.The browser session creates or opens one account per GitHub principal and tenant.
  3. Create a worker key.The dashboard creates a worker enrollment key; other roles and stricter scopes stay in the API.
  4. Claim from the device.The client, worker, or hybrid agent submits local public keys with the reusable enrollment key.
  5. Create opaque jobs.Clients create jobs with capabilities and delivery policy, never plaintext prompts or files.
  6. Claim and return results.Workers claim a lease, run locally, and append encrypted result envelopes for resolved recipients.
  7. Audit and sync.The GitHub principal audits account devices/events; devices sync, decrypt locally, and ACK.

What Belt stores

Tenants, accounts, devices, enrollment keys, install sessions, pairing tickets, jobs, leases, encrypted envelope metadata, recipient keys, cursors, audit records, and retention state.

What Belt rejects

Plaintext product payloads, prompts, book content, notes, local files, model output, and product-specific semantics.