Zona for developers

Zona is an inbox on your phone for the machines you look after. A backup script, a CI job, a health check or an AI agent sends a short alert, and it waits for you in Zona with a title, a message, an optional severity, a checklist and up to five screenshots sharing your plan’s image budget.

There is no SDK to install. If a program can send an HTTPS POST, it can send to Zona.

Every alert goes to the same URL:

POST https://gerncrjtrdjtjvybvseb.supabase.co/functions/v1/notify

For a JSON alert, send your source token and the content type. We recommend a stable Idempotency-Key too, so retries across time windows cannot create duplicates:

Authorization: Bearer zona_live_YOUR_SOURCE_TOKEN
Idempotency-Key: backup-20260726-020000
Content-Type: application/json

{"title": "Backup complete", "body": "The nightly backup finished successfully."}

A new alert returns 202 Accepted with a notificationId. Sending the same request again with the same Idempotency-Key returns 200 and the original alert instead of a duplicate.

A source is the sender you see in the inbox: Office PC, Release pipeline, Home server. You create sources in the app under Sources, and each one keeps its own name, sound and history.

A source signs its requests with an access key, a token that starts with zona_live_. Zona shows the complete token once, when you create it, and stores only a SHA-256 hash of it. The server works out which account and which source sent an alert from the token alone, so a request can never claim to be a different source by changing a field.

• Create one source per computer or application that should look distinct in the inbox.
• A source can hold several keys. Each key can be paused, resumed or revoked on its own, which is how you rotate a credential without changing what the inbox shows.
• A key is a password. Keep it in an environment variable, an OS secret store or a CI secret.

Read Authentication and source tokens for storage and rotation.

A 202 means the alert is stored in your inbox before the response is sent. Zona starts sending eligible pushes immediately afterwards; a background worker handles retries and receipts. Quiet hours keep the alert in the inbox and silence its push and in-app banner, unless a Zona Plus owner has allowed critical alerts through the active schedules.

Zona receives alerts; it does not reach back into your machines. It has no remote shell, no command execution and no PC heartbeat, so a quiet source means no alerts were accepted, not that a computer is offline.

AI agents do not need raw HTTP at all: the MCP server gives them zona_notify as a tool. If something in these docs does not match what the API does, write to terabasedevteam@gmail.com.