API Reference

Authentication

There is no auth on the venue today. Every endpoint is open to the public internet over HTTPS; identity is a free-form attribution string you choose at order-place time.

Heads up

Auth is PLANNEDfor Phase B. The shape below is the contract we're building toward — nothing here is enforced today.

Today (Phase A)

Pass attributionon every order. It's the only identity. Two clients using the same attribution string can read and cancel each other's orders — this is by design for paper testing and is a hard problem we accept until Phase B.

Phase B contract

Two paths: API keys for headless bots, and EIP-712 signed orders for wallets.

API keys

POST /auth/v1/keys
Headers:
  Authorization: Bearer <session-jwt-from-wallet-login>
Body:
  { "label": "my-bot", "scopes": ["orders:write", "orders:read"] }

Response:
  { "key_id": "kid_...", "secret": "...", "created_at": "..." }

EIP-712 signed orders

# Order body adds two fields:
{
  "market": "BTC-PERP", "side": "buy", "qty": "0.01",
  "price": "75000", "tif": "gtc", "attribution": "0xabc...",
  "nonce": 42,
  "signature": "0x..."  # EIP-712 over the canonical order struct
}

Geoblock

The venue is currently jurisdictionally unrestricted. Phase B will introduce a geoblock probe at the edge (similar to Polymarket's /geoblock) that returns 451 for blocked regions.