Workspaces
A workspace is the isolation boundary in Cubster: every asset and every API key belongs to exactly one. Your first approved sign-in creates a personal workspace automatically; you can create more from the dashboard or the API.
An API key is bound to one workspace at creation and scopes every request it makes — it can never
see another workspace's assets, even with a valid ?workspace=
override (that override only works for session auth, targeting a workspace you own).
Listing your workspaces includes a rounded usage snapshot for each one — current bytes stored, the per-workspace cap, and usage as a percentage of that cap.
Session auth can list, create, rename, and delete workspaces you own. Deleting one purges its assets' blobs, then cascades the row (its assets and keys go with it) — you can't delete your only workspace, and a workspace you don't own resolves to a 404, never a 403 (so its existence is never confirmed to someone who can't see it).