Demo mode

lantern demo starts the whole stack in kiosk mode: every visitor gets a private workspace with sample agents, a guided tour, and no sign-up. The workspace is deleted after 30 minutes. It needs Docker and nothing else: no LLM key.

In plain termsA demo that needs your API key is not a demo you can leave on a booth. Kiosk mode answers from recorded replays served by a local fixture server, labels every answer "replay", and gives each visitor a throwaway tenant that the database itself isolates from every other visitor.

Try it

lantern demo            # builds, starts, opens http://localhost:3001/kiosk
lantern demo --down     # stop and delete all demo data
make demo               # same stack without the CLI

Press Start demo. The tour has five steps over real pages: the inbox, running an agent (watch the step waterfall), a budget that returns HTTP 402, a signed-receipt check at /proof, and the sandbox view. After 120 seconds without input, or when the 30-minute timer ends, the session is closed and the workspace deleted.

How visitors are isolated

POST /v1/kiosk/session creates a fresh kiosk-<rand> tenant and returns a short-lived JWT with role kiosk. Row-level security is enforced, so visitor B reading visitor A's run or agent gets 404.
The token cannot write settings, connectors or budgets, mint API keys, or delete the tenant (LANTERN_AUTHZ_ENFORCE=1 is part of the overlay).
A sweep deletes expired tenants through the same erasure code path as DELETE /v1/tenants/{id}, across every table that has a tenant_id column.
No provider key exists in a kiosk tenant. The server refuses to start in kiosk mode if a provider key is set without a fixture base URL.

Reference

Variable	Default	Purpose
`LANTERN_KIOSK`	off	`1` enables the endpoint, sweep and guards. Otherwise `/v1/kiosk/session` is 404.
`LANTERN_KIOSK_ALLOW_PROD`	off	Required to run kiosk in prod/production/staging. Use only on a dedicated demo host.
`LANTERN_KIOSK_TTL_MIN`	30	Session lifetime in minutes.
`LANTERN_KIOSK_SWEEP_SEC`	60	How often expired sessions are purged.
`LANTERN_KIOSK_MAX_SESSIONS`	20	Live-session cap; over it returns 503.
`LANTERN_KIOSK_IP_PER_HOUR`	3	Sessions per client address per hour; over it returns 429.
`KIOSK_JWT_SECRET`	random per start	Compose overlay. Required; `make demo` and `lantern demo` generate a random one. The control-plane refuses to start kiosk mode with an empty or dev-default `JWT_SECRET`.

Kiosk mode also requires LANTERN_RLS_ENFORCE=1, LANTERN_AUTHZ_ENFORCE=1 and an explicit JWT_SECRET; the compose overlay infra/docker/docker-compose.kiosk.yml sets all of them and points LANTERN_LLM_BASEURL_OPENAI/_ANTHROPIC at the replay server.

Limits

Answers are recorded, not live. A live-model kiosk needs a separate, capped platform key and is not built.
The per-address limit is in-memory and per process; behind a proxy all visitors share one address.
The sandbox step shows the view only; the overlay does not start the microVM runtime.

See also Accounts & sign-up and Security.