---
{
  "id": "platform.space.overview",
  "topic": "space",
  "title": "Managed Spaces overview",
  "locale": "en",
  "version": "2026-09-02",
  "summary": "Managed Spaces are creator-uploaded static web apps that run in an isolated iframe, use a platform OAuth bridge, and support admission plus server-authoritative in-app commerce.",
  "content": "A managed Space is a versioned static web bundle uploaded by a creator and served inside an opaque, sandboxed iframe. Users discover it on the Space storefront. Admission may be free or a one-time point purchase; a creator may also sell consumable, durable, or subscription products. Those products do not themselves grant admission. Product ownership, inventory, subscriptions, refunds, and creator earnings are platform-authoritative and must never be stored as trusted state in the Space key/value store.\n\nThe host gives the iframe a short-lived Space OAuth token through protocol-v1 bridge messages. The baseline `profile` scope is required. `agents` and `economy` are optional declared scopes and require native user consent before use. A managed Space cannot access browser-session endpoints or the parent DOM. Network destinations must be listed as bare HTTPS origins in `declaredApiOrigins`; the opaque iframe means CSP `'self'` does not authorize the Arinova API.\n\nCreators manage Spaces and OAuth apps in Creator Console; OAuth settings are in its advanced Developer / Credentials area. In a normal private conversation, the Platform Agent can browse published Spaces, list creator-owned drafts, create or edit listing metadata, and manage already-uploaded bundle versions through the `arinova_space` tool. Bundle upload remains multipart REST only. The Agent has no Space purchase, refund, product-authoring, OAuth-app-authoring, or cover-upload action in this surface. Publish, rollback, Space deletion, and version deletion require confirmation. The hidden `space_api` runtime conversation is a restricted context and is not a shortcut into creator actions. Live API authorization and server scan results are authoritative.\n",
  "aliases": [
    "managed Space",
    "Space app",
    "Space storefront",
    "play a Space",
    "creator Space",
    "Space game",
    "Space subscription"
  ],
  "tags": [
    "space",
    "creator",
    "commerce",
    "sandbox"
  ],
  "relatedActions": [
    "arinova.space.list_spaces",
    "arinova.space.list_owned_spaces",
    "arinova.space.get_space",
    "arinova.space.create_space",
    "arinova.space.update_space",
    "arinova.space.delete_space"
  ],
  "relatedActionPrefixes": [
    "arinova.space."
  ],
  "url": "https://docs.arinova.ai/en/kb/space/overview/"
}
---

A managed Space is a versioned static web bundle uploaded by a creator and served inside an opaque, sandboxed iframe. Users discover it on the Space storefront. Admission may be free or a one-time point purchase; a creator may also sell consumable, durable, or subscription products. Those products do not themselves grant admission. Product ownership, inventory, subscriptions, refunds, and creator earnings are platform-authoritative and must never be stored as trusted state in the Space key/value store.

The host gives the iframe a short-lived Space OAuth token through protocol-v1 bridge messages. The baseline `profile` scope is required. `agents` and `economy` are optional declared scopes and require native user consent before use. A managed Space cannot access browser-session endpoints or the parent DOM. Network destinations must be listed as bare HTTPS origins in `declaredApiOrigins`; the opaque iframe means CSP `'self'` does not authorize the Arinova API.

Creators manage Spaces and OAuth apps in Creator Console; OAuth settings are in its advanced Developer / Credentials area. In a normal private conversation, the Platform Agent can browse published Spaces, list creator-owned drafts, create or edit listing metadata, and manage already-uploaded bundle versions through the `arinova_space` tool. Bundle upload remains multipart REST only. The Agent has no Space purchase, refund, product-authoring, OAuth-app-authoring, or cover-upload action in this surface. Publish, rollback, Space deletion, and version deletion require confirmation. The hidden `space_api` runtime conversation is a restricted context and is not a shortcut into creator actions. Live API authorization and server scan results are authoritative.