Authentication

API keys#

Send your key in the x-api-key header on every request. Keys identify your application for rate limiting and usage. Never ship a key in client-side code.

Wallet-scoped actions#

Endpoints that act for a user — creating listings or offers, claiming rewards, managing a profile — require proof that the caller controls the wallet. The planned flow is Sign-In with Ethereum: request a nonce, sign it with the wallet, exchange the signature for a short-lived token sent as Authorization: Bearer <token>.

Order creation itself never needs Unvault to hold a key: the user signs the order (EIP-712) and the API stores and serves it.

Errors#

• 401 — missing or invalid key or token.
• 403 — the key or token lacks the required scope.
• 429 — rate limited; see rate limits.