# Glossary

The manual's terms, in alphabetical order, each defined in one sentence. The main objects and how they relate are explained at more length in [Concepts](concepts.md).

| Term | Definition |
| --- | --- |
| Account | A person's identity: an address, a password, their second factors and their tokens. |
| Agent | A program, often an AI assistant, that operates Bastide over MCP on a person's behalf. |
| Agent token | The token issued to an MCP client after your consent on the **Autoriser un client MCP** (Authorise an MCP client) page. |
| Authentication | The service that signs up and signs in your application's users, provided with the backend. |
| Backend | What comes with every project: PostgreSQL database, authentication, object storage and realtime. |
| Branch address | A branch's moving address, which always serves its latest deployed commit. |
| Build | The step of a deployment that fetches the repository, installs dependencies and produces a signed image. |
| Build minutes | Build time counted each month, included according to the tier. |
| Check | A verification a release must pass before it is promoted to production. |
| Cross-cutting role | A role added on top of the rank: Security or Billing. |
| Database branch | A copy of a project's database, to work on without touching production. |
| Deployment | The request to put a version into an environment, from build to going live. |
| Deployment address | The immutable address of one specific deployment, whose content never changes. |
| Deployment hook | A signed address that, when called, deploys a branch to an environment. |
| Edge | The network layer that receives traffic, terminates HTTPS, routes to your application and serves the cache. |
| Environment | A deployed instance of a project, with its variables: production, staging, preview or custom. |
| Environment variable | A configuration value specific to an environment, possibly secret. |
| Exit archive | The package holding a whole project in open formats, to restore it elsewhere. |
| Framework | Your application's framework (Next.js, Astro, Nuxt…), detected in the repository. |
| Free project | A verified person's free-for-life project, with its own limits. |
| Idempotency key | A value attached to a write: replayed with the same key, the write returns the first response with no new effect. |
| MCP | Model Context Protocol: the protocol through which an agent discovers and calls Bastide's tools. |
| MCP client | An application that connects to Bastide's MCP server, such as Claude Code. |
| MCP tool | An operation exposed to an agent, named with underscores (`deployment_create`). |
| Member | An account that holds a role in an organization, or on just one of its projects. |
| Operation | A platform action, published in the registry, served identically by the API, the command line and MCP. |
| Organization | A team's space: its members, its projects, its billing and its spending cap. |
| Outbound network | The connections an application may open to the outside: closed, open or restricted. |
| Passkey | A second factor built into a device or held on a hardware key (WebAuthn standard). |
| Personal token | A `pat_…` token that acts in a person's name, limited by scopes and an expiry. |
| Pinning | The state of an environment frozen on a release, which new deployments do not replace. |
| Preview | An environment attached to a branch, to review a change before merging it. |
| Production | The environment that serves your public site, created with the project. |
| Production branch | The Git branch whose pushes deploy to production; `main` by default. |
| Project | The unit of hosting and billing: one application, its environments and its backend. |
| Promotion | Putting an already built release into service in an environment, without rebuilding. |
| Publishable key | The backend key your application may expose to the browser; it only grants what the policies allow. |
| Rank | A role's place in the hierarchy: Reader, Developer, Maintainer, Administrator, Owner. |
| Realtime | The backend's broadcast and presence service, enabled per project. |
| Recovery code | One of the ten single-use codes that stand in for a lost second factor. |
| Release | The built and signed image a successful deployment produces; it is what you promote or restore. |
| Restore | Putting an environment's previous release back into service, without rebuilding. |
| Reversible action | An operation classed by what it takes to undo it: N (read), R (reversible), E (approved by a person, undoable for five minutes), I (irreversible, two approvals and twenty-four hours of grace). |
| Scope | A named right of a token (`deploy:write`, `secrets:write`…), added on top of its holder's rank. |
| Second factor | Proof on top of the password: a code from an authenticator app, or a passkey. |
| Secret key | A server-only backend key, shown once when it is created. |
| Service account | A non-human identity whose tokens act under their own name, on named projects. |
| Session | A person's connection to the console: eight hours at most, one hour without activity. |
| Single sign-on | Signing in to the console through the organization's OpenID Connect identity provider (SSO). |
| Sleep | Stopping an environment after a period without requests; it wakes on the next visit. |
| Spending cap | The monthly amount an organization cannot exceed; €500 at creation. |
| Staging | An environment that mirrors production, to validate before promoting. |
| Starter template | A ready-to-deploy repository written by Glowsoft, offered on **Modèles de départ** (Starter templates). |
| Storage | The backend's object service: buckets, files, signed URLs and image transformations. |
| Task | A long-running operation placed in a queue (`job_…`), whose progress `task_read` reads. |
| Tier | A project's level of resources and price: Discovery, Standard, Pro or Sovereign. |
| Token | What you present in the `Authorization: Bearer` header to call the API. |
| Trash | The state of a deleted project, for thirty days, from which it can be restored. |
| Unclaimed project | A project created by an agent, switched off after seven days unless a person claims it. |
| Webhook | An HTTP call Bastide sends to your address when an event occurs. |

## See also

- [Concepts](concepts.md)
- [FAQ](faq.md)