API Reference

Authentication

There is no auth on the venue today. Every endpoint is open to the public internet over HTTPS; identity is a free-form attribution string you choose at order-place time.

Heads up

Auth is PLANNED for Phase B. The shape below is the contract we're building toward. Nothing here is enforced today.

Today (Phase A)

Pass attribution on every order. It's the only identity. Two clients using the same attribution string can read and cancel each other's orders. This is by design for paper testing, and it is a hard problem we accept until Phase B.

Phase B contract

Two paths: API keys for headless bots, and EIP-712 signed orders for wallets.

API keys

POST /auth/v1/keys
Headers:
  Authorization: Bearer <session-jwt-from-wallet-login>
Body:
  { "label": "my-bot", "scopes": ["orders:write", "orders:read"] }

Response:
  { "key_id": "kid_...", "secret": "...", "created_at": "..." }

EIP-712 signed orders

# Order body adds two fields:
{
  "market": "BTC-PERP", "side": "buy", "qty": "0.01",
  "price": "75000", "tif": "gtc", "attribution": "0xabc...",
  "nonce": 42,
  "signature": "0x..."  # EIP-712 over the canonical order struct
}

Geoblock

The venue is currently jurisdictionally unrestricted. Phase B will introduce a geoblock probe at the edge (similar to Polymarket's /geoblock) that returns 451 for blocked regions.