Architecture — Lakecode Docs

System overview

Lakecode consists of three components that work together:

CLI — The CLI installed on your machine. Handles Databricks and Snowflake API calls, workspace profiling, skills injection, and user interaction.
Proxy Worker — A Cloudflare Worker that sits between the CLI and Anthropic’s API. Validates license keys, tracks token usage, deducts credits, and forwards requests.
Auth Worker — A Cloudflare Worker that handles Google OAuth flows, license key generation, Stripe payment processing, and billing webhooks.

Request flow

CLI (your machine)
 |
 |-- Platform API calls (direct, using your credentials)
 |
 |-- AI requests --> Proxy Worker (Cloudflare)
                      |-- Verify license key (Ed25519)
                      |-- Check balance / deduct credits
                      |-- Forward to Anthropic API
                      |-- Return response to CLI

Data storage

D1 (SQLite) — User records, balances, charge history, and reload settings
KV — Key revocation lists and reload flags for fast edge lookups
Local cache — Workspace profiles (catalogs, schemas, tables, warehouses) are cached on your machine for fast context loading

License key structure

A license key (lk_<base64url>) is an Ed25519-signed payload containing:

User email
Plan type (free or pro)
Expiry timestamp
Issuer signature

The signing key is held by the Auth Worker. The corresponding public key is embedded in the Proxy Worker for verification. Keys cannot be forged or tampered with.

Workspace profiling

On first run (or when the cache is stale), Lakecode calls the Databricks or Snowflake REST API to discover your workspace topology: catalogs, schemas, tables, and SQL warehouses. This profile is cached locally in ~/.lakecode/ and refreshed periodically. It allows the AI to understand your environment without you having to describe it every time.