Tawa Platform

What this skill covers

The architecture of the Tawa platform — what services exist, how they connect, and the URLs you need.

Platform Services

How Services Connect

Developer -> tawa CLI -> iec-builder
                            |
                +-----------+-----------+
                |           |           |
             Bio-ID      Koko       Cloudflare
          (OAuth)    (Registry)     (DNS)
                            |
                       Kubernetes
                      (Helm deploy)
                            |
                  +---------+---------+
                  |         |         |
               Janus     Wallet    Your Service
            (Metrics)   (Gas)     (Running pod)

Internal Service URLs (Kubernetes DNS)

Services communicate inside the cluster using this pattern:

http://{service}.{service}-{environment}.svc.cluster.local:{port}

Examples:

• http://iec-wallet.iec-wallet-prod.svc.cluster.local:3000
• http://koko-iec-koko.koko-prod.svc.cluster.local:3001
• http://janus.janus-prod.svc.cluster.local:3000

External URL Patterns

Organization Identity

Organizations have two identifiers managed by Bio-ID:

• Wallet IDs: wallet-{orgSlug} (e.g., wallet-insureco)
• Bio-ID JWTs: carry both orgId (ORG-xxx) and orgSlug (slug) in the payload
• tawa CLI: extracts orgSlug for spec.owner scaffolding (never uses ORG-xxx for owner)
• Organization.resolve(): Bio-ID static method that accepts ORG-xxx, ObjectId, or slug

A service is owned by a single primary org, but can grant authorized orgs so devs from a second org can build and release it (gas still billed to the owner). See Authorized Orgs.

Key Facts

• All deployments go through tawa deploy — the builder handles everything
• OAuth is auto-provisioned via Bio-ID on every deploy
• Databases are declared in catalog-info.yaml and provisioned automatically
• Gas tokens pay for hosting and API calls (1 token = $0.01 USD)
• Services register in Koko automatically on first deploy
• DNS is managed via Cloudflare automatically