Core-X Web OS: Business/Enterprise management tools.

Core-X Developer Documentation

Welcome to the official developer portal for Core-X, ALmax Cloud's proprietary Web OS for business operations. Build immersive business applications, daemon services, windowed applets, and real-time state synchronization modules on top of our secure kernel architecture.

Quickstart Guide

Initialize your first Core-X Web OS container, authenticate via X-Engine, and launch a window applet.

Web OS & Applets API

Control desktop hierarchy, tiling layouts, virtual viewports, and inter-process messaging.

initialize-kernel.js

import XEngine, { Helpers, Payments } from "@almaxcloud/core-x";

window.xengine = XEngine();

if (typeof window !== "undefined" && typeof window.xengine !== "undefined") {
  let boot = await xengine.new_app(
    "com.almaxcloud.corex",
    "public_api_token_please_keep_in_env"
  );
}

// returns {
//   status: res.status ?? "success",
//   success: true,
//   token,
// }
// or
// {
//   status: res?.status ?? "error",
//   success: false,
//   token: null,
// }

export function MyApplication() {
  return {
    ...Helpers(),
    ...Payments(),
    // copy(text_to_clipboard)
    // open_file(valid_path_to_file_or_url)
    // ...
  };
}
//

# Authenticate and initialize Core-X session
curl -X POST https://api.almaxcloud.com/api/v1/app/boot \
  -H "Authorization: Bearer App_Public_key" \
  -H "Content-Type: application/json" \
  -d '{"cluster": "dev_server", "client_version": "2.5.0"}'

Last updated: October 2026

Getting Started

Quickstart Guide

Follow this step-by-step guide to integrate Core-X into your enterprise workflow.

1

Obtain API Credentials

Log into your ALmax Cloud Dashboard, navigate to Core-X Settings->Accounts->API and generate a Personal Access Token (PAT) with READ:UPDATE:CREATE:DELETE scope.

After obtaining your API token, email support@almaxcloud.com requesting developer activation and include: Developer Name, Developer Website, Support Email, Core-X user_id, Business Documents, and Relevant Docs.

2

Install the Core-X SDK

Install the official Node.js client package in your terminal:

npm install @almax/core-x

3

Spawn Your First Window Applet

Create a script to render a managed business window inside the Core-X workspace:

const applet = await Launcher.create({
  container: '#my_div_element',
  width: 1200,
  height: 800,
  name_space: 'com.my_app.namespace'
});
applet.mount();

Security

Authentication & X-Engine

Core-X enforces strict cryptographic verification and token-based authentication for all daemon requests.

Bearer Token Header

Every API request directed at Core-X must include the Authorization header with an active Personal Access Token (PAT) or Session JWT.

Authorization: Bearer public_key...

Security Warning

Never expose your master secret keys or service tokens in client-side Single Page Applications. Use ALmax Secure Proxy or Server-Side Rendering (SSR) for sensitive operations.

POST /v1/os/windows

Create Window Applet

Spawns a new secure window frame inside the Core-X Web OS workspace grid.

Request Parameters

Parameter	Type	Required	Description
namespace	str	Yes	The the Target App Namespace.
width	int	No	Initial window width in pixels (Default: 960).
height	int	No	Initial window height in pixels (Default: 640).
public_key	str	Yes	Secure public key in .env.

Context Menu

Snippet for context menu.

index.html

#cm.show {
    max-height: 100%;
    padding: 6px;
    box-shadow: 3px 3px 25px 0px var(--sd);
    opacity: 1;
}

#cm>list {
    transform: translate(0, -50%);
    opacity: 0;
    transition: transform 200ms ease-in-out, opacity 150ms 50ms;
}

#cm.show>list {
    opacity: 1;
    transform: none;
}

#cm.show-begin {
    display: block;
}

#cm>list>a {
    padding: 4.5px 12px;
    margin: 1px 0;
    border-radius: 6px;
    font-size: 15px;
    display: flex;
    line-height: 19px;
}

#cm>list>a>.bi {
    font-size: 17px;
    margin-right: 10px;
    display: block;
}

#cm>list>a>info {
    float: right;
    text-align: end;
    color: #888;
    flex-grow: 1;
}

#cm>list>*:not(hr):hover {
    background-color: var(--hover-b);
}

input.foc {
    display: block;
    height: 0;
    width: 0;
    opacity: 0;
    padding: 0;
    margin: 0;
    border: none;
    outline: none;
    background: none;
} 
</style>
 <div id="cm" tabindex="-1" x-data="contextMenu()" x-show="open" :class="{ 'show-begin': showBegin, 'show': showMenu }" :style="`top: ${y}px; left: ${x}px;`" @click.away="close" @blur.capture="close">

Interactive Sandbox

Core-X API Playground

Test Core-X OS endpoints in real-time. Simulated responses replicate live ALmax Cloud daemon behavior.

Request Configuration

Mock Sandbox Active

Request Payload (JSON)

Response Payload

200 OK • 142ms

Was this documentation helpful?

Help us improve the Core-X developer portal experience.

Storage

Secure IndexedDB Storage

Core-X includes a secure browser-side database layer for persisting small, non-sensitive application state such as preferences, local session snapshots, and ephemeral runtime data.

Overview

The secure database layer is built on IndexedDB and exposes a guarded API that only permits keys defined in the allowlist. This prevents arbitrary storage access and keeps the runtime predictable across applets and sessions.

secure-store.js

                                    import XEngine from "@almaxcloud/core-x";

window.xengine = XEngine();

const theme = await xengine.db_get("theme");

await xengine.db_set("theme", "dark", "string");
await xengine.db_set("balance", 2500, "number");
await xengine.db_set("is_active", true, "bool");
await xengine.db_set("cart_items", ["sku-101", "sku-202"], "array");

const saved = await xengine.db_get("cart_items");
await xengine.db_delete("session_token");

// Supported formats: ["string", "number", "bool", "array"]

Method	Purpose	Notes
xengine.db_get(key)	Read a stored value by key from the secure IndexedDB store.	Use only allowed keys from your local app schema; unsupported keys return nothing.
xengine.db_set(key, value, format)	Persist a value in the secure local database.	Supported formats: "string", "number", "bool", "array".
xengine.db_delete(key)	Delete a value from the local store.	This is the safe way to clear a stored key when a session or workflow ends.

Usage notes

• Instantiate the client once: window.xengine = XEngine();
• Use the instance methods directly: await xengine.db_get(key)
• Keep storage keys explicit and minimal to avoid accidental cross-app leakage.
• Store only session state, UI preferences, or lightweight metadata — not private secrets.

Real-Time

Webhooks & Event Subscriptions

Listen to real-time kernel events, applet state transitions, and user telemetry via secured HTTPS webhooks.

Event Payload Structure

All outbound webhook deliveries are signed using HMAC-SHA256 in the X-CoreX-Signature header.

{
  "event_id": "evt_99812739102",
  "event_type": "applet.spawned",
  "timestamp": 1760601513,
  "data": {
    "window_id": "win_x_8871",
    "owner": "usr_almax_admin"
  }
}

Troubleshooting

Error Codes & Rate Limits

Understand Core-X API status codes, rate limit headers, and troubleshooting protocols.

Status Code	Error Slug	Description & Resolution
429 Too Many Requests	rate_limit_exceeded	Exceeded 1,000 req/min threshold. Implement exponential backoff.
401 Unauthorized	invalid_token	Provided PAT or JWT has expired or been revoked in dashboard.
503 Service Unavailable	kernel_restart	Target Core-X daemon container is undergoing rolling cluster update.