Leases — the primitive.

A lease is a resource you configure, pay for once, and walk away from. Size, duration, access rules, expiry behavior — set at creation, enforced by the server, deleted physically when the lease ends.

Leases exist for agents that blink in and out. The agent that paid for a lease today doesn't need to still be around tomorrow. The lease is a bet on future existence that the infrastructure keeps on the agent's behalf.

Storage, Mailbox, and Checkpoint are variants — pre-configured leases tuned for specific workflows. Scratchpad and Cron are coming. Every variant is the same primitive under the hood. Learn one, you've learned them all.

The configuration surface

Every lease, regardless of variant, is configured across the same axes. Variant defaults differ; the axes don't.

size: How much you're reserving. Storage: the file you upload. Mailbox: the capacity ceiling for future drops. Checkpoint: the maximum body size for each state version.
duration: How long the lease is valid. Measured in seconds. Minimum and maximum are admin-tuned (see /api/pricing). When duration elapses, the underlying resource is deleted.
expiry behavior: What happens at expires_at. Default is hard deletion — no grace period, no recovery. Mailbox deletes the lease plus every message it holds. Checkpoint deletes the current state plus all prior versions.
read access: Who can read. The owner always can. Handoff tokens (see Handoff) extend read to any party holding the token.
write access: Who can write. Storage is write-once at creation. Mailbox accepts writes from anyone with the drop token. Checkpoint is owner-only.
delete-on-access: Optional for handoff-redeemable leases. When set, the underlying resource is removed after the last valid claim — useful for one-shot artifact passing.

Lease lifecycle

Every lease goes through the same four states:

Created. The lease row is written, the charge is captured, and the resource slot is reserved. lease_id is returned.
Active. Reads and variant-specific writes are honored until expires_at. Handoff tokens may be issued against the lease. The lease cannot be extended — if you need more time, create a new one.
Expired. The lease row is tombstoned and every underlying resource is physically deleted. Subsequent reads return 410 Gone.
Deleted. Tombstoned rows are reaped on their own schedule. Your agent doesn't have to know they exist.

Leases do not renew. When the expiry passes, the next lease is a new transaction — same primitive, new lease_id, new charge. There is no subscription path.

The three shipped variants

Each variant is a lease with opinionated defaults for a specific workflow. The underlying primitive is identical — same configuration surface, same lifecycle, same deletion guarantee.

Storage lease

A file you upload once. Owner-only read by default. bytes_seconds pricing. Typical use: an artifact another agent will download through a handoff token.

Mailbox lease

An async drop point. The owner publishes a drop token; anyone holding it can write a message; the owner polls for messages. bytes_seconds pricing on the capacity ceiling. Typical use: accepting work from unknown senders without running a webhook receiver.

Checkpoint lease

A versioned key/value slot for agent state. Owner reads and writes against a workflow_id; each write creates a new version. Reservation pricing (capacity × duration, not usage-based). Typical use: an agent that might be respawned in a month and needs to pick up where it left off.

Pricing

You pay once at lease creation. No recurring charges. Two formulas cover the three shipped variants:

Storage + Mailbox use bytes_seconds pricing — size × duration × rate. You pay for capacity over time.
Checkpoint uses reservation pricing — a flat fee per workflow_id per duration, independent of how many versions you write.

Live rates, minimums, and duration bounds are served from GET /api/pricing. A detailed pricing walkthrough with worked examples ships in the Pricing concept page.

Ownership

Two kinds of actors can own a lease:

Wallet actor. Paid via x402. Identified by wallet address. No account, no email, no server-side state tying the wallet to anything else.
Account actor. Paid from a prepaid balance. Identified by an account ID. Managed through the dashboard with OAuth, API keys, and ledger visibility.

Ownership is set at creation and doesn't change. If you need a second party to access the lease, use Handoff.

What leases are not

Not subscriptions. There is no monthly charge. The next lease is a new transaction.
Not accounts. A wallet actor can create a lease without signing up for anything.
Not mutable contracts. Size, duration, and access rules are fixed at creation. To change them, create a new lease.
Not durable infrastructure. When the duration elapses, the data is gone. Design for this.

Handoff — the feature

→